The Pakendikeskus packaging online store — eight page loads, 1722 requests. A banner with a single 'Nõustun' button declares that merely continuing to use the site is consent. The Meta pixel and the Adform advertising tracker run on every page, and the Mouseflow session recording scripts load along with them. Of all the advertising services, the policy names only Google — Meta and Adform are not in it.
Request timeline
Declared versus actual
Transfer timings
The Mouseflow session recording script.
Trackpoint 2054532 with the page name.
PageView, pixel 219148436188425.
The seventh Meta pixel event.
Detected trackers
- Meta Pixel (219148436188425) — connect.facebook.net, www.facebook.com/tr; a PageView at +10.9 s and six more events. Not named in the policy
- Adform (track.adform.net, s2.adform.net, trackpoint 2054532) — an advertising tracker on every page. Not named in the policy
- Google Tag Manager (GTM-MHSWMV8) and Google Analytics 4 (G-HMVJKW5QER) — scripts load on every page; no data-collection requests in the capture
- Mouseflow (cdn.mouseflow.com) — a session recording service; the script loads on every page, no recording submissions in the capture
- Zendesk (static.zdassets.com, ekr.zdassets.com) — support widget
- First party: www.pakendikeskus.ee, ipx.pakendikeskus.ee, strapi4.pakendikeskus.ee
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel and Adform with no way to refuseThe site has no mechanism that would hold tags back until the visitor decides. Together with the Google Tag Manager container, the Meta pixel (219148436188425) and the Adform advertising tracker load at +10.6 s. At +10.8 s, Adform trackpoint 2054532 fires with the page name, and at +10.9 s the Meta pixel sends a PageView with the page address. Over the capture, the pixel sends seven events, and Adform fires on every page. At the same time, the scripts of the Mouseflow session recording service and Google Analytics load on every page. The visitor cannot refuse any of this: the banner has no such button.
- GDPR Art. 4(11) / Art. 7(1) — consent through 'continued use', no refusalThe banner at the bottom of the page reads: 'Veebilehe kasutamist jätkates või nupul „Nõustun“ klikkides nõustud küpsiste kasutamisega' — by continuing to use the website or clicking 'Nõustun', you agree to the use of cookies. The banner has a single button — 'Nõustun'. Refusal is impossible, and mere continued use of the site is declared to be consent. Inaction and continued browsing do not constitute consent.
- GDPR Art. 13(1)(e) / Art. 5(1)(a) — the advertising trackers in operation are not namedPakendikeskus AS's policy names Google Analytics, Mouseflow, Zendesk, and payment services, and describes third parties in general terms — cookies for sharing pages on social networks and showing personalised advertising 'on the platforms of Google and its partners'. Meta and Adform — the two services that actually send data about the visitor in the capture — are not named in the policy.
Context
pakendikeskus.ee is the Pakendikeskus online store for packaging materials, household goods, and protective equipment. The controller is Pakendikeskus AS (registration code 10102167, Suur-Sõjamäe 37A, Soodevahe, Rae parish). The site has no consent-management platform — only a notice banner.
The measurement is a single capture: the homepage in Estonian and the Russian version — the homepage, services, and payment terms. Each page loads with a double redirect to itself, hence eight page loads. In total, 1722 requests, most of them catalogue images.
Processing is described by the terms of purchase, with sections on cookies and personal data processing.
Who receives data directly
Meta — through the pixel. Adform — advertising tracker. Mouseflow — session recording service. Google — Tag Manager and Analytics. Zendesk — support widget.
Declared versus actual
First — advertising without a choice. There is no mechanism to hold tags back. Together with the Google Tag Manager container, the Meta pixel and the Adform tracker load, and a tenth of a second later both send data: Adform a trackpoint with the page name, Meta a page view with its address. Then on every page. Over the capture, the Meta pixel sends seven events. Alongside them, the Mouseflow script loads on every page — a service that records mouse movements, clicks, and scrolling. There are no recording submissions in the capture, but the script is connected and ready to work.
Second — the banner does not ask. A line at the bottom of the screen states that continued use of the site already means consent and offers one button — “Nõustun”. There is no way to refuse.
Third — the policy names the wrong services. The policy lists Google Analytics, Mouseflow, Zendesk, and payment services, and speaks of personalised advertising “on the platforms of Google and its partners”. Yet the data about the visitor is actually received by Meta and Adform, of which the policy says not a word. The policy’s cookie text also describes a mechanism that does not exist on the site: that a cookie “asks for permission to be saved”.
Consent: what is proven and what is not
Proven: there is no consent mechanism. No requests to a consent platform, and the banner has a single “Nõustun” button.
Proven: the Meta pixel and Adform send data. Seven Meta events and Adform trackpoints on every page.
Proven: Meta and Adform are not named in the policy. A search of the saved text.
Not established: whether “Nõustun” was pressed. For the finding this is not decisive: refusal is impossible on the site, and consent is declared to be given by continued use.
Not established: whether Mouseflow records. The script loads on every page, but there are no session recording requests in the capture.
Not established: whether Google Analytics sends data. The script loads, but there are no data-collection requests in the capture.
Boundaries of this observation
The measurement covers the store’s public pages. The cart and checkout were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and POST request bodies were removed.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the terms themselves.
Conclusion
Pakendikeskus gives the visitor no choice: a banner with a single button declares continued use of the site to be consent, while the Meta pixel and the Adform tracker run on every page alongside a connected session recording service. The policy names Google, Mouseflow, and Zendesk but stays silent about precisely the two advertising services that send data in the capture.
Remedy: introduce a consent platform with an equally prominent refuse button, and do not load Meta, Adform, Mouseflow, or Google Analytics before consent; remove the wording about consent through continued use; name Meta and Adform in the policy as recipients, stating the purpose.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
833ec9ab882970fa8bcb37a1b9e5539496fc22ff2146726fa634e75621da5b2b
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — pakendikeskus.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта pakendikeskus.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На сайте нет механизма, который удерживал бы теги до решения посетителя. Вместе с контейнером Google Tag Manager на +10,6 с загружаются пиксель Meta (219148436188425) и рекламный трекер Adform. На +10,8 с срабатывает трекпойнт Adform 2054532 с названием страницы, на +10,9 с пиксель Meta отправляет PageView с адресом страницы. За замер пиксель отправляет семь событий, Adform срабатывает на каждой странице. Одновременно на каждой странице грузятся сценарии сервиса записи сессий Mouseflow и Google Analytics. Отказаться от этого посетитель не может: в баннере нет такой кнопки. 2) Баннер внизу страницы гласит: «Veebilehe kasutamist jätkates või nupul „Nõustun“ klikkides nõustud küpsiste kasutamisega» — продолжая пользоваться сайтом или нажав «Nõustun», ты соглашаешься с использованием cookie. Кнопка в баннере одна — «Nõustun». Отказаться нельзя, а согласием объявлено само продолжение пользования сайтом. Бездействие и продолжение просмотра согласием не являются. 3) Политика Pakendikeskus AS по имени перечисляет Google Analytics, Mouseflow, Zendesk и платёжные сервисы, а о третьих сторонах пишет общими словами — cookie для того, чтобы делиться страницами в соцсетях и показывать персонализированную рекламу «на платформах Google и его партнёров». Meta и Adform — два сервиса, которые в замере действительно отправляют данные о посетителе, — в политике не названы. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-pakendikeskus-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — pakendikeskus.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website pakendikeskus.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The site has no mechanism that would hold tags back until the visitor decides. Together with the Google Tag Manager container, the Meta pixel (219148436188425) and the Adform advertising tracker load at +10.6 s. At +10.8 s, Adform trackpoint 2054532 fires with the page name, and at +10.9 s the Meta pixel sends a PageView with the page address. Over the capture, the pixel sends seven events, and Adform fires on every page. At the same time, the scripts of the Mouseflow session recording service and Google Analytics load on every page. The visitor cannot refuse any of this: the banner has no such button. 2) The banner at the bottom of the page reads: 'Veebilehe kasutamist jätkates või nupul „Nõustun“ klikkides nõustud küpsiste kasutamisega' — by continuing to use the website or clicking 'Nõustun', you agree to the use of cookies. The banner has a single button — 'Nõustun'. Refusal is impossible, and mere continued use of the site is declared to be consent. Inaction and continued browsing do not constitute consent. 3) Pakendikeskus AS's policy names Google Analytics, Mouseflow, Zendesk, and payment services, and describes third parties in general terms — cookies for sharing pages on social networks and showing personalised advertising 'on the platforms of Google and its partners'. Meta and Adform — the two services that actually send data about the visitor in the capture — are not named in the policy. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-pakendikeskus-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — pakendikeskus.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi pakendikeskus.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Veebilehel puudub mehhanism, mis hoiaks silte kinni kuni külastaja otsuseni. Koos Google Tag Manageri konteineriga laaditakse +10,6 s juures Meta piksel (219148436188425) ja reklaamijälgija Adform. +10,8 s juures käivitub Adformi trackpoint 2054532 koos lehe nimega, +10,9 s juures saadab Meta piksel sündmuse PageView koos lehe aadressiga. Mõõtmise jooksul saadab piksel seitse sündmust ja Adform käivitub igal lehel. Samal ajal laaditakse igal lehel seansisalvestusteenuse Mouseflow ja Google Analyticsi skriptid. Külastaja ei saa sellest keelduda: bänneris sellist nuppu ei ole. 2) Lehe allosas olev bänner ütleb: „Veebilehe kasutamist jätkates või nupul „Nõustun“ klikkides nõustud küpsiste kasutamisega.“ Bänneris on üksainus nupp – „Nõustun“. Keelduda ei saa ning nõusolekuks on kuulutatud juba veebilehe kasutamise jätkamine. Tegevusetus ja lehitsemise jätkamine ei ole nõusolek. 3) Pakendikeskus AS-i privaatsustingimused loetlevad nimeliselt Google Analyticsi, Mouseflow, Zendeski ja makseteenused ning kirjeldavad kolmandaid osapooli üldsõnaliselt – küpsised lehtede jagamiseks sotsiaalvõrgustikes ja isikupärastatud reklaami näitamiseks „Google'i ja Google'i partnerettevõtete platvormidel“. Metat ja Adformi – kahte teenust, mis mõõtmise käigus tegelikult külastaja kohta andmeid saadavad – tingimustes ei nimetata. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-pakendikeskus-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — pakendikeskus.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом pakendikeskus.ee. 2. Обстоятельства Я посетил сайт pakendikeskus.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 01.10.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На сайте нет механизма, который удерживал бы теги до решения посетителя. Вместе с контейнером Google Tag Manager на +10,6 с загружаются пиксель Meta (219148436188425) и рекламный трекер Adform. На +10,8 с срабатывает трекпойнт Adform 2054532 с названием страницы, на +10,9 с пиксель Meta отправляет PageView с адресом страницы. За замер пиксель отправляет семь событий, Adform срабатывает на каждой странице. Одновременно на каждой странице грузятся сценарии сервиса записи сессий Mouseflow и Google Analytics. Отказаться от этого посетитель не может: в баннере нет такой кнопки. 2) Баннер внизу страницы гласит: «Veebilehe kasutamist jätkates või nupul „Nõustun“ klikkides nõustud küpsiste kasutamisega» — продолжая пользоваться сайтом или нажав «Nõustun», ты соглашаешься с использованием cookie. Кнопка в баннере одна — «Nõustun». Отказаться нельзя, а согласием объявлено само продолжение пользования сайтом. Бездействие и продолжение просмотра согласием не являются. 3) Политика Pakendikeskus AS по имени перечисляет Google Analytics, Mouseflow, Zendesk и платёжные сервисы, а о третьих сторонах пишет общими словами — cookie для того, чтобы делиться страницами в соцсетях и показывать персонализированную рекламу «на платформах Google и его партнёров». Meta и Adform — два сервиса, которые в замере действительно отправляют данные о посетителе, — в политике не названы. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-pakendikeskus-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — пиксель Meta и Adform без возможности отказа; GDPR Art. 4(11) / Art. 7(1) — согласие через «продолжение пользования», отказа нет; GDPR Art. 13(1)(e) / Art. 5(1)(a) — работающие рекламные трекеры не названы 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — pakendikeskus.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website pakendikeskus.ee. 2. Circumstances I visited the website pakendikeskus.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 1 October 2026 (open methodology, reproducible measurements) documents the following indications: 1) The site has no mechanism that would hold tags back until the visitor decides. Together with the Google Tag Manager container, the Meta pixel (219148436188425) and the Adform advertising tracker load at +10.6 s. At +10.8 s, Adform trackpoint 2054532 fires with the page name, and at +10.9 s the Meta pixel sends a PageView with the page address. Over the capture, the pixel sends seven events, and Adform fires on every page. At the same time, the scripts of the Mouseflow session recording service and Google Analytics load on every page. The visitor cannot refuse any of this: the banner has no such button. 2) The banner at the bottom of the page reads: 'Veebilehe kasutamist jätkates või nupul „Nõustun“ klikkides nõustud küpsiste kasutamisega' — by continuing to use the website or clicking 'Nõustun', you agree to the use of cookies. The banner has a single button — 'Nõustun'. Refusal is impossible, and mere continued use of the site is declared to be consent. Inaction and continued browsing do not constitute consent. 3) Pakendikeskus AS's policy names Google Analytics, Mouseflow, Zendesk, and payment services, and describes third parties in general terms — cookies for sharing pages on social networks and showing personalised advertising 'on the platforms of Google and its partners'. Meta and Adform — the two services that actually send data about the visitor in the capture — are not named in the policy. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-pakendikeskus-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel and Adform with no way to refuse; GDPR Art. 4(11) / Art. 7(1) — consent through 'continued use', no refusal; GDPR Art. 13(1)(e) / Art. 5(1)(a) — the advertising trackers in operation are not named 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil pakendikeskus.ee. 2. Asjaolud Külastasin veebisaiti pakendikeskus.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 01.10.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Veebilehel puudub mehhanism, mis hoiaks silte kinni kuni külastaja otsuseni. Koos Google Tag Manageri konteineriga laaditakse +10,6 s juures Meta piksel (219148436188425) ja reklaamijälgija Adform. +10,8 s juures käivitub Adformi trackpoint 2054532 koos lehe nimega, +10,9 s juures saadab Meta piksel sündmuse PageView koos lehe aadressiga. Mõõtmise jooksul saadab piksel seitse sündmust ja Adform käivitub igal lehel. Samal ajal laaditakse igal lehel seansisalvestusteenuse Mouseflow ja Google Analyticsi skriptid. Külastaja ei saa sellest keelduda: bänneris sellist nuppu ei ole. 2) Lehe allosas olev bänner ütleb: „Veebilehe kasutamist jätkates või nupul „Nõustun“ klikkides nõustud küpsiste kasutamisega.“ Bänneris on üksainus nupp – „Nõustun“. Keelduda ei saa ning nõusolekuks on kuulutatud juba veebilehe kasutamise jätkamine. Tegevusetus ja lehitsemise jätkamine ei ole nõusolek. 3) Pakendikeskus AS-i privaatsustingimused loetlevad nimeliselt Google Analyticsi, Mouseflow, Zendeski ja makseteenused ning kirjeldavad kolmandaid osapooli üldsõnaliselt – küpsised lehtede jagamiseks sotsiaalvõrgustikes ja isikupärastatud reklaami näitamiseks „Google'i ja Google'i partnerettevõtete platvormidel“. Metat ja Adformi – kahte teenust, mis mõõtmise käigus tegelikult külastaja kohta andmeid saadavad – tingimustes ei nimetata. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-pakendikeskus-ee/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — Meta piksel ja Adform ilma keeldumisvõimaluseta; IKÜM art 4 p 11 / art 7 lg 1 — nõusolek „kasutamise jätkamise“ kaudu, keeldumist ei ole; IKÜM art 13 lg 1 p e / art 5 lg 1 p a — töötavad reklaamijälgijad on nimetamata 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]