Website of the Estonian National Opera — one recording, two loads of the home page, 225 requests, eleven nodes. The Cookiebot consent platform is correctly configured: refusal is on equal footing with consent, categories are off by default, and the refusal is recorded and shown in the settings. However, Google Analytics 4 runs in Consent Mode's advanced mode: the first page_view goes out even before the banner is shown, and after the recorded refusal page_view and scroll events carrying device and page information keep going to Google. Cookies are not stored, but the transmission does not stop. The policy of the operator — a public-law legal person — promises to transfer data to third parties only by law, under contract or with consent, and does not name Google. The browser did not send a DNT header.
Request timeline
Declared versus actual
Transfer timings
GTM-WXLXM5H; launches both Cookiebot and Google Analytics.
uc.js, leveloptin mode.
page_view, gcs=G100, gcd=13p3p3p2p5l1.
logconsent.ashx?action=decline.
scroll, gcs=G100, gcd=13q3q3q2q5l1; then page_view +173622 ms and scroll +182841 ms.
Detected trackers
- Google Analytics 4 (G-8VGE9CCDY8) via region1.google-analytics.com — page_view and scroll in the 'denied' consent state (gcs=G100), including after refusal
- Google Tag Manager (www.googletagmanager.com, container GTM-WXLXM5H, gtag/js, analytics.js) — the container that launches both Cookiebot and the analytics
- Cookiebot (consent.cookiebot.eu, consentcdn.cookiebot.eu; configuration 886e92e8-a5cf-4353-95b9-…) — consent-management platform in opt-in mode
- Google reCAPTCHA (www.google.com/recaptcha, www.gstatic.com) — form protection, loaded on every page
- Google Fonts (fonts.gstatic.com) — the Roboto font of the reCAPTCHA widget
- Amazon S3 (s3.eu-central-1.amazonaws.com/estonian-opera-production) — the site's media files
- jQuery CDN (ajax.googleapis.com) — the jQuery 3.4.1 library
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))The Cookiebot platform is correctly configured but does not stop transmission to Google Analytics. Container GTM-WXLXM5H launches both Cookiebot (+1506 ms) and Google Analytics (+1522…+1535 ms); the first page_view goes out at +2291 ms — before the banner configuration has loaded (+2336 ms) — with the status gcs=G100 and gcd=13p3p3p2p5l1 ('denied by default'). The refusal is recorded at +112357 ms (logconsent.ashx?action=decline), after which gcd takes the value 13q3q3q2q5l1 — the denial is confirmed by an update. Nonetheless GA4 keeps sending a scroll event to Google (+123890 ms), and on the next page a page_view and a scroll (+173622, +182841 ms). Each request carries the page title and address, the referrer, the screen resolution 1536x864, browser client hints (Microsoft Edge 153, Windows 19.0, x86/64) and the language. Under EDPB Guidelines 2/2023 on the technical scope of Art. 5(3), reading such information from the device by script requires consent even without the use of cookies.
- GDPR Art. 5(1)(a), Art. 13(1)(c), (e) — transparency: the declared diverges from the actualThe Rahvusooper Estonia personal-data processing principles give laws and legitimate interest as the basis for processing and state that personal data is transferred to third parties when fulfilling legal obligations, in supervisory and court proceedings, to perform contracts, and also at the person's request and/or with their consent. Google is not named in the document as a recipient of web data; cookies are described only as files 'used for tracking or identification', with a suggestion to disable them in the browser. In fact browsing information goes to Google even after refusal. The Cookiebot declaration, moreover, classifies the Google cookie test_cookie as necessary, while noting next to it that this provider's data is used for personalisation and measuring advertising.
Context
opera.ee is the website of the Estonian National Opera (Rahvusooper Estonia): the repertoire, operas, operettas and musicals, ballets, performances for children, and ticket sales via tickets.opera.ee. The operator is a public-law legal person acting under the Estonian National Opera Act; the data-protection specialist is andmekaitse@opera.ee. The site is served by an nginx server, with media files from Amazon S3.
Processing is described by the Rahvusooper Estonia personal-data processing principles and the Cookiebot cookie declaration (updated 27 August 2026). Attached to the material are two screenshots: the consent banner and the consent state after the choice.
The measurement consists of one recording of about three minutes: a load of the Estonian home page and its reload. Two hundred and twenty-five requests, eleven nodes. The recording was made on 25 September 2026.
Who data goes to directly
Google (Analytics 4, Tag Manager, reCAPTCHA, Fonts, jQuery CDN), Cookiebot (the consent platform), Amazon (S3 — the site’s media files). There is no advertising, Meta, Spotify, YouTube or Sentry in the recording.
Declared versus actual
The data-processing principles give laws and legitimate interest as the basis and list the cases in which data is transferred to third parties: fulfilling legal obligations, supervisory and court proceedings, performing contracts, and the person’s own request or consent. Google is not named in the document; cookies are said to be ‘used for tracking or identification’ and can be disabled in the browser. The Cookiebot declaration is detailed: Google Analytics and Sentry session recording under statistics; Meta, Google advertising pixels, Spotify and YouTube under marketing.
The measurement shows the following.
The consent platform is correctly configured. Cookiebot runs in leveloptin mode. The banner, as seen in the screenshot, offers ‘Keeldu’, ‘Luba valik’ and ‘Luba kõik’ — refusal is on equal footing with consent, and the preference, statistics and marketing categories are off. The refusal is recorded at +112357 ms (logconsent.ashx?action=decline), and the state window after the choice shows all three categories as declined. The services declared under marketing — Meta, Google advertising pixels, Spotify, YouTube — did not fire in the recording.
Google Analytics sends data before the banner and after refusal. The Google Tag Manager container GTM-WXLXM5H launches both Cookiebot and Google Analytics at the same time. The first page_view of property G-8VGE9CCDY8 goes out at +2291 ms — before the banner configuration loads (+2336 ms) — with the status gcs=G100 and gcd=13p3p3p2p5l1: analytics and advertising ‘denied by default’. After the refusal gcd takes the value 13q3q3q2q5l1 — the denial is confirmed by an update — yet GA4 keeps sending a scroll event on the same page (+123890 ms), and after the reload a page_view (+173622 ms) and a scroll (+182841 ms). Each request carries the page title and address, the referrer, the screen resolution 1536x864, browser client hints (Microsoft Edge 153, Windows 19.0, x86/64) and the language.
Cookies are not stored, but transmission continues. On the new page the client identifier is new and the first-visit flag is set again — the refusal stops Google Analytics from writing cookies. However, under EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, reading device information by script and transmitting it requires consent even without the use of cookies.
The documents do not reflect this transmission. The processing principles promise transfer to third parties only by law, under contract or with consent, and do not name Google; in fact browsing information goes to Google even after refusal. The Cookiebot declaration, moreover, classifies the Google cookie test_cookie as necessary, while noting next to it that this provider’s data is used for personalisation and measuring advertising.
Functional nodes: Google reCAPTCHA (www.google.com/recaptcha, www.gstatic.com) is loaded by the site’s own script on every page, with the Roboto font from Google Fonts; jQuery — from ajax.googleapis.com; media files — from s3.eu-central-1.amazonaws.com/estonian-opera-production.
Consent: what is proven and what is not
Proven: the consent platform is correctly configured and the refusal is recorded. By the screenshots and the logconsent.ashx?action=decline request.
Proven: the first page_view goes out before the banner is shown. The /g/collect request at +2291 ms precedes the loading of the Cookiebot configuration at +2336 ms.
Proven: after refusal GA4 keeps sending page_view and scroll. Three requests with the status gcs=G100 and gcd=13q3q3q2q5l1 after +112357 ms.
Proven: there is no persistent identifier between pages. The cid values on the two loads differ, and the first-visit flag is set on both.
Not proven and not asserted: how Google processes the received requests on its side. A browser measurement captures the fact and content of the transmission, not how Google uses it.
Separately: the browser did not send a DNT header in this recording.
Bounds of observation
The measurement covers the site’s home page and its reload; no tickets were purchased. Observation captures the browser’s behaviour, not the internal side of the services. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.
The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 207 redactions and a checksum. The consent-mode parameters, the set of fields in the Google Analytics requests, the consent decision and the timings are fully legible from the recording.
The identification of services relies on domains and address patterns: analytics — by google-analytics.com and property G-8VGE9CCDY8; the container — by GTM-WXLXM5H; the consent platform — by cookiebot.eu; reCAPTCHA — by google.com/recaptcha and gstatic.com. The gcd values are interpreted according to Google’s documentation on consent-mode parameters.
Conclusion
A correctly configured Cookiebot consent platform operates on the Estonian National Opera’s website: refusal is on equal footing with consent, categories are off by default, and the refusal is recorded and visible in the settings. However, Google Analytics 4 is launched by the same Google Tag Manager container in Consent Mode’s advanced mode: the first page_view goes out even before the banner is shown, and after the recorded refusal page_view and scroll events keep going to Google with the page address and title, screen resolution, browser client hints and language. The refusal stops the writing of cookies, but not the transmission of data. The data-processing principles of the operator — a public-law legal person — promise transfer to third parties only by law, under contract or with consent and do not name Google, while the Cookiebot declaration classifies the Google test_cookie, an advertising cookie by its own description, as necessary.
Remediation: switch Google Analytics to Consent Mode’s basic mode, in which the tag neither loads nor sends requests before consent, and launch it only after a choice in the banner; name Google Analytics, Google Tag Manager and reCAPTCHA in the data-processing principles and state the purposes and legal basis of web analytics; move test_cookie out of the necessary category into one requiring consent; set a content security policy and a referrer policy.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
870bc4cc26d64d93b8962e2329487d5a02c99e6967bd620f0a673492e02bb2e0
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — opera.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта opera.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Платформа Cookiebot настроена корректно, но не останавливает передачу в Google Analytics. Контейнер GTM-WXLXM5H запускает и Cookiebot (+1506 мс), и Google Analytics (+1522…+1535 мс); первый page_view уходит на +2291 мс — до того, как загружена конфигурация баннера (+2336 мс), — со статусом gcs=G100 и gcd=13p3p3p2p5l1 («запрещено по умолчанию»). Отказ записан на +112357 мс (logconsent.ashx?action=decline), после чего gcd принимает значение 13q3q3q2q5l1 — запрет подтверждён обновлением. Тем не менее GA4 продолжает отправлять в Google событие scroll (+123890 мс), а на следующей странице — page_view и scroll (+173622, +182841 мс). Каждое обращение несёт заголовок и адрес страницы, реферер, разрешение экрана 1536x864, клиентские подсказки браузера (Microsoft Edge 153, Windows 19.0, x86/64) и язык. Согласно Руководству EDPB 2/2023 о техническом охвате ст. 5(3), считывание таких сведений с устройства скриптом требует согласия и без использования cookie. 2) Принципы обработки персональных данных Rahvusooper Estonia называют основанием обработки законы и законный интерес и сообщают, что персональные данные передаются третьим лицам при исполнении закона, в надзорных и судебных процедурах, для исполнения договоров, а также по просьбе лица и/или с его согласия. Google как получатель веб-данных в документе не назван; cookie описаны лишь как файлы, «используемые для отслеживания или идентификации», с предложением отключать их в браузере. Фактически сведения о просмотре уходят в Google и после отказа. Декларация Cookiebot, кроме того, относит к необходимым cookie Google test_cookie, указывая рядом, что данные этого поставщика используются для персонализации и измерения рекламы. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-opera-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — opera.ee
To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]
I request access to my personal data processed in connection with the website opera.ee.
1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:
1) The Cookiebot platform is correctly configured but does not stop transmission to Google Analytics. Container GTM-WXLXM5H launches both Cookiebot (+1506 ms) and Google Analytics (+1522…+1535 ms); the first page_view goes out at +2291 ms — before the banner configuration has loaded (+2336 ms) — with the status gcs=G100 and gcd=13p3p3p2p5l1 ('denied by default'). The refusal is recorded at +112357 ms (logconsent.ashx?action=decline), after which gcd takes the value 13q3q3q2q5l1 — the denial is confirmed by an update. Nonetheless GA4 keeps sending a scroll event to Google (+123890 ms), and on the next page a page_view and a scroll (+173622, +182841 ms). Each request carries the page title and address, the referrer, the screen resolution 1536x864, browser client hints (Microsoft Edge 153, Windows 19.0, x86/64) and the language. Under EDPB Guidelines 2/2023 on the technical scope of Art. 5(3), reading such information from the device by script requires consent even without the use of cookies.
2) The Rahvusooper Estonia personal-data processing principles give laws and legitimate interest as the basis for processing and state that personal data is transferred to third parties when fulfilling legal obligations, in supervisory and court proceedings, to perform contracts, and also at the person's request and/or with their consent. Google is not named in the document as a recipient of web data; cookies are described only as files 'used for tracking or identification', with a suggestion to disable them in the browser. In fact browsing information goes to Google even after refusal. The Cookiebot declaration, moreover, classifies the Google cookie test_cookie as necessary, while noting next to it that this provider's data is used for personalisation and measuring advertising.
2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-opera-ee/
3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — opera.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi opera.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Cookieboti platvorm on õigesti seadistatud, kuid ei peata andmete edastamist Google Analyticsisse. Konteiner GTM-WXLXM5H käivitab nii Cookieboti (+1506 ms) kui ka Google Analyticsi (+1522…+1535 ms); esimene page_view saadetakse +2291 ms juures — enne bänneri konfiguratsiooni laadimist (+2336 ms) — olekuga gcs=G100 ja gcd=13p3p3p2p5l1 (vaikimisi keelatud). Keeldumine registreeritakse +112357 ms juures (logconsent.ashx?action=decline), mille järel omandab gcd väärtuse 13q3q3q2q5l1 — keeld on uuendusega kinnitatud. Sellest hoolimata saadab GA4 Google'ile jätkuvalt sündmuse scroll (+123890 ms) ning järgmisel lehel page_view ja scroll (+173622, +182841 ms). Iga päring kannab lehe pealkirja ja aadressi, viitajat, ekraani eraldusvõimet 1536x864, brauseri kliendivihjeid (Microsoft Edge 153, Windows 19.0, x86/64) ja keelt. Euroopa Andmekaitsenõukogu suuniste 2/2023 (artikli 5 lõike 3 tehnilise ulatuse kohta) kohaselt nõuab selliste andmete lugemine seadmest skripti abil nõusolekut ka ilma küpsisteta. 2) Rahvusooper Estonia isikuandmete töötlemise põhimõtted nimetavad töötlemise alusena seadusi ja õigustatud huvi ning teatavad, et isikuandmeid edastatakse kolmandatele isikutele seaduse täitmisel, järelevalve- ja kohtumenetlustes, lepingute täitmiseks ning isiku palvel ja/või tema nõusolekul. Google'it ei ole dokumendis veebiandmete vastuvõtjana nimetatud; küpsiseid kirjeldatakse üksnes failidena, mida kasutatakse jälgimiseks või tuvastamiseks, ning soovitatakse need brauseris välja lülitada. Tegelikult liiguvad sirvimisandmed Google'ile ka pärast keeldumist. Lisaks liigitab Cookieboti deklaratsioon vajalikuks Google'i küpsise test_cookie, märkides samas, et selle teenusepakkuja andmeid kasutatakse reklaami isikupärastamiseks ja mõõtmiseks. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-opera-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — opera.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом opera.ee. 2. Обстоятельства Я посетил сайт opera.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 25.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Платформа Cookiebot настроена корректно, но не останавливает передачу в Google Analytics. Контейнер GTM-WXLXM5H запускает и Cookiebot (+1506 мс), и Google Analytics (+1522…+1535 мс); первый page_view уходит на +2291 мс — до того, как загружена конфигурация баннера (+2336 мс), — со статусом gcs=G100 и gcd=13p3p3p2p5l1 («запрещено по умолчанию»). Отказ записан на +112357 мс (logconsent.ashx?action=decline), после чего gcd принимает значение 13q3q3q2q5l1 — запрет подтверждён обновлением. Тем не менее GA4 продолжает отправлять в Google событие scroll (+123890 мс), а на следующей странице — page_view и scroll (+173622, +182841 мс). Каждое обращение несёт заголовок и адрес страницы, реферер, разрешение экрана 1536x864, клиентские подсказки браузера (Microsoft Edge 153, Windows 19.0, x86/64) и язык. Согласно Руководству EDPB 2/2023 о техническом охвате ст. 5(3), считывание таких сведений с устройства скриптом требует согласия и без использования cookie. 2) Принципы обработки персональных данных Rahvusooper Estonia называют основанием обработки законы и законный интерес и сообщают, что персональные данные передаются третьим лицам при исполнении закона, в надзорных и судебных процедурах, для исполнения договоров, а также по просьбе лица и/или с его согласия. Google как получатель веб-данных в документе не назван; cookie описаны лишь как файлы, «используемые для отслеживания или идентификации», с предложением отключать их в браузере. Фактически сведения о просмотре уходят в Google и после отказа. Декларация Cookiebot, кроме того, относит к необходимым cookie Google test_cookie, указывая рядом, что данные этого поставщика используются для персонализации и измерения рекламы. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-opera-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 5(1)(a), Art. 13(1)(c), (e) — прозрачность: заявленное расходится с фактическим 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — opera.ee
1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website opera.ee.
2. Circumstances
I visited the website opera.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 25 September 2026 (open methodology, reproducible measurements) documents the following indications:
1) The Cookiebot platform is correctly configured but does not stop transmission to Google Analytics. Container GTM-WXLXM5H launches both Cookiebot (+1506 ms) and Google Analytics (+1522…+1535 ms); the first page_view goes out at +2291 ms — before the banner configuration has loaded (+2336 ms) — with the status gcs=G100 and gcd=13p3p3p2p5l1 ('denied by default'). The refusal is recorded at +112357 ms (logconsent.ashx?action=decline), after which gcd takes the value 13q3q3q2q5l1 — the denial is confirmed by an update. Nonetheless GA4 keeps sending a scroll event to Google (+123890 ms), and on the next page a page_view and a scroll (+173622, +182841 ms). Each request carries the page title and address, the referrer, the screen resolution 1536x864, browser client hints (Microsoft Edge 153, Windows 19.0, x86/64) and the language. Under EDPB Guidelines 2/2023 on the technical scope of Art. 5(3), reading such information from the device by script requires consent even without the use of cookies.
2) The Rahvusooper Estonia personal-data processing principles give laws and legitimate interest as the basis for processing and state that personal data is transferred to third parties when fulfilling legal obligations, in supervisory and court proceedings, to perform contracts, and also at the person's request and/or with their consent. Google is not named in the document as a recipient of web data; cookies are described only as files 'used for tracking or identification', with a suggestion to disable them in the browser. In fact browsing information goes to Google even after refusal. The Cookiebot declaration, moreover, classifies the Google cookie test_cookie as necessary, while noting next to it that this provider's data is used for personalisation and measuring advertising.
Full technical documentation is published at: https://gdpru.eu/en/audits/ee-opera-ee/
3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 5(1)(a), Art. 13(1)(c), (e) — transparency: the declared diverges from the actual
4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.
5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil opera.ee. 2. Asjaolud Külastasin veebisaiti opera.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 25.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Cookieboti platvorm on õigesti seadistatud, kuid ei peata andmete edastamist Google Analyticsisse. Konteiner GTM-WXLXM5H käivitab nii Cookieboti (+1506 ms) kui ka Google Analyticsi (+1522…+1535 ms); esimene page_view saadetakse +2291 ms juures — enne bänneri konfiguratsiooni laadimist (+2336 ms) — olekuga gcs=G100 ja gcd=13p3p3p2p5l1 (vaikimisi keelatud). Keeldumine registreeritakse +112357 ms juures (logconsent.ashx?action=decline), mille järel omandab gcd väärtuse 13q3q3q2q5l1 — keeld on uuendusega kinnitatud. Sellest hoolimata saadab GA4 Google'ile jätkuvalt sündmuse scroll (+123890 ms) ning järgmisel lehel page_view ja scroll (+173622, +182841 ms). Iga päring kannab lehe pealkirja ja aadressi, viitajat, ekraani eraldusvõimet 1536x864, brauseri kliendivihjeid (Microsoft Edge 153, Windows 19.0, x86/64) ja keelt. Euroopa Andmekaitsenõukogu suuniste 2/2023 (artikli 5 lõike 3 tehnilise ulatuse kohta) kohaselt nõuab selliste andmete lugemine seadmest skripti abil nõusolekut ka ilma küpsisteta. 2) Rahvusooper Estonia isikuandmete töötlemise põhimõtted nimetavad töötlemise alusena seadusi ja õigustatud huvi ning teatavad, et isikuandmeid edastatakse kolmandatele isikutele seaduse täitmisel, järelevalve- ja kohtumenetlustes, lepingute täitmiseks ning isiku palvel ja/või tema nõusolekul. Google'it ei ole dokumendis veebiandmete vastuvõtjana nimetatud; küpsiseid kirjeldatakse üksnes failidena, mida kasutatakse jälgimiseks või tuvastamiseks, ning soovitatakse need brauseris välja lülitada. Tegelikult liiguvad sirvimisandmed Google'ile ka pärast keeldumist. Lisaks liigitab Cookieboti deklaratsioon vajalikuks Google'i küpsise test_cookie, märkides samas, et selle teenusepakkuja andmeid kasutatakse reklaami isikupärastamiseks ja mõõtmiseks. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-opera-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsuse direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a); IKÜM art 5 lg 1 p a, art 13 lg 1 p c, e — läbipaistvus: deklareeritu erineb tegelikust 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]