Technical audit · 30.09.2026

peatus.ee

peatus.ee, the state public transport journey planner

The state journey planner peatus.ee — Estonian and Russian versions, 262 requests. The banner is one line and one button, 'Nõustu'; there is no way to refuse. Google Analytics runs from the first second without consent mode and immediately sends the visitor's identifier to Google's advertising features. The 'more information' link leads to the cookie page of another website — the ministry's — which says nothing about peatus.ee.

Request timeline

+0 s · entering
Redirect http → https. The planner application fetches data from web.peatus.ee and api.peatus.ee.
+0.2…+0.8 s · Google without consent mode
GTM-NMFBQ8G7, gtag for G-3G6TXCW63K. At +0.8 s — a page_view to GA4 and the same identifier to stats.g.doubleclick.net and www.google.ee/ads/ga-audiences.
+1.0 s · Matomo Cloud
cdn.matomo.cloud responds 404 — the script is included but does not work.
+30 s · 'Rohkem teavet'
Navigation to agri.ee/kupsised — the cookie page of the ministry's website.
+151…+255 s · Russian version
peatus.ee/ru: Google Analytics and ga-audiences with the same client identifier.

Declared versus actual

✓ Banner: the website uses cookies for convenient and personalised use; a 'Nõustu' button — declared
✓ 'Rohkem teavet' leads to agri.ee/kupsised — cookies of www.agri.ee, including Google Analytics; information is collected anonymously — declared
✓ Accessibility statement: the planner belongs to the Information Technology Centre of the Ministry of Regional Affairs and Agriculture — declared
+ The cookies and data processing of peatus.ee itself — not declared
+ Google advertising features — stats.g.doubleclick.net and ga-audiences — not declared
+ The controller of peatus.ee in the cookie information — not declared

Transfer timings

+0.8 s region1.analytics.google.com

page_view, G-3G6TXCW63K, consent mode not configured.

+0.8 s stats.g.doubleclick.net

Google advertising endpoint, the same identifier.

+0.8 s www.google.ee

ads/ga-audiences — advertising audiences.

+254.9 s www.google.ee

ga-audiences on the Russian version, the same identifier.

Detected trackers

Indicators of GDPR non-compliance

Context

peatus.ee is the state journey planner for public transport across Estonia. According to its accessibility statement, it belongs to the Information Technology Centre of the Ministry of Regional Affairs and Agriculture. It is a digital public service used by practically every resident who travels by public transport.

The measurement is a single capture: the Estonian version, a click on the “Rohkem teavet” link to the ministry’s cookie page, and the Russian version with a route search. In total, 262 requests. Of these, 19 requests to edge.microsoft.com — a browser service — are excluded from the review. The requests to agri.ee belong to the ministry’s website, not to the planner.

peatus.ee has no separate privacy policy or cookie section. The banner refers to the cookie page of the ministry’s website.

Who receives data directly

Google — Analytics, the DoubleClick and ga-audiences advertising features, Tag Manager.

Declared versus actual

First — Google from the first second, including advertising features. Google consent mode is not configured. At +0.8 s, a page view goes to Google Analytics, and in the same millisecond the same client identifier is sent to stats.g.doubleclick.net and www.google.ee/ads/ga-audiences — Google’s advertising features. The identifier follows the visitor from the Estonian version to the Russian one. For a public service that people use to get to work or to the doctor, passing the identifier to advertising infrastructure has no justification.

Second — the banner asks nothing. A line at the top of the page states that the site uses cookies for “convenient and personalised use” and offers one button — “Nõustu”. There is no way to refuse.

Third — “more information” leads to the wrong place. The banner’s link opens the cookie page of the ministry’s website, agri.ee. It describes the cookies of agri.ee itself, including Google Analytics “on www.agri.ee”, and says that information is collected anonymously. About peatus.ee, its cookies, who is responsible for it, and Google’s advertising features — not a word.

Separately: the planner includes a Matomo Cloud script, but its server responds 404. Apparently there was an intention to move from Matomo to Google Analytics or back, and the old code was left in place.

Proven: Google Analytics and Google’s advertising features run without consent. Requests at +0.8 s, consent mode not configured.

Proven: the banner offers no refusal. The single “Nõustu” button in screenshot 1.

Proven: the identifier is shared across the site’s language versions. It is identical in requests from the Estonian and Russian pages.

Proven: the cookie information concerns another website. The agri.ee/kupsised page describes the cookies of www.agri.ee.

Not established: whether “Nõustu” was pressed. This does not change the finding: Google runs from the first second, before any click.

Boundaries of this observation

The measurement covers the planner’s homepage in two language versions and the route search. The mobile app was not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and script bodies were removed. The Google client identifier is not reproduced in this review.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.

Conclusion

The state journey planner passes every visitor’s identifier to Google Analytics and to Google’s advertising features from the first second, without asking for consent. The banner is a notice with a single “I agree” button, and the “more information” link leads to the cookie page of another ministry website that says nothing about peatus.ee.

Remedy: disable Google signals and advertising features in Google Analytics; do not load Google Analytics before consent, or switch to analytics without identifiers; replace the notice banner with a consent request that has an equally prominent refuse button; publish peatus.ee’s own information on cookies and data processing, naming the controller; remove the non-functional Matomo Cloud script.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/peatus-ee-2026-09-30.har
SHA-256: 02294ff0dddededb9d4a61d2e885553d4d00c57a2003e305f0b45fba44df1a4b
Screenshot
Скриншот интерфейса
The peatus.ee banner — a line at the top of the page with a single 'Nõustu' button · 30.09.2026
Скриншот интерфейса
'Rohkem teavet' leads to the cookie page of the ministry's website agri.ee, with its own banner · 30.09.2026
Скриншот интерфейса
The Russian version of the peatus.ee planner · 30.09.2026
Скриншот интерфейса
A city bus route in the planner · 30.09.2026
Скриншот интерфейса
An intercity bus route in the planner · 30.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.