RU EN
www.
Technical audit · 09.09.2026

piletilevi.ee

Estonia's largest ticketing service
EE

Estonia's largest ticketing service — a single capture with navigation (the homepage and an info page from the footer), 352 requests, 7 nodes. The case is largely clean: the Cookiebot consent management platform is in place, the cookie declaration is detailed and names recipients individually (Google, Facebook/Meta, Microsoft, reCAPTCHA), and Google analytics respect the denial — GA4 events carry status gcs=G100, both storages denied, and the first event goes out only after Cookiebot has done its work. There are almost no third-party components — the site runs on its own infrastructure. The one caveat is about load order: the GTM container appears about 217 ms before the consent platform itself, but releases no actual tracking requests before consent.

Request timeline

+1555…+1787 ms · tag container
www.googletagmanager.com/gtm.js (GTM-MHMXH4) at +1555 ms and gtag for two counters (G-F42M76QVYK, G-5ZHYQRXF3L). The container appears slightly before the consent platform, but itself sends no tracking requests.
+1772…+2540 ms · Cookiebot consent platform
consent.cookiebot.eu/uc.js (+1772 ms), then consentcdn.cookiebot.eu/consentconfig/…/set and /sta (+2134…+2540 ms) — Cookiebot loads and records the consent configuration before analytics is sent. CBID ec165a53-f8c0-4fb7-b0dc-1f0d136db77e.
+7901…+28122 ms · analytics (cookieless)
region1.google-analytics.com/g/collect — GA4 page_view and scroll events (G-F42M76QVYK) with status gcs=G100: both storages denied, pings cookieless. The first event goes out at +7901 ms — after Cookiebot has done its work.

Declared versus actual

✓ Controller — AS Piletilevi PLG (reg. code 10568581, Maakri 23A, Tallinn); data-minimisation principle — declared
✓ Consent management — Cookiebot; a detailed cookie declaration with categories and retention periods — declared
✓ Recipients named individually in the cookie declaration: Google, Facebook / Meta Platforms Inc., Microsoft, reCAPTCHA, bilesuserviss.lv (group) — declared
✓ The general data-processing policy is about principles (definitions, data-subject rights), does not list recipients (the cookie declaration does that) — declared
✓ Supervisory authority — Andmekaitse Inspektsioon — declared
+ The GTM container loads about 217 ms before the consent platform (with no actual data transfer before consent) — not declared

Transfer timings

+1555 ms www.googletagmanager.com

GTM-MHMXH4; releases no tracking requests before consent.

+1772 ms consent.cookiebot.eu

uc.js, CBID ec165a53-…; does its work before analytics is sent.

+7901 ms region1.google-analytics.com

GA4 page_view, G-F42M76QVYK, gcs=G100; after Cookiebot.

Detected trackers

Context

piletilevi.ee is Estonia’s largest service for selling tickets to concerts, theatre, sport and festivals. The controller is AS Piletilevi PLG (reg. code 10568581, Maakri 23A, Tallinn), part of a group (the Latvian bilesuserviss.lv is a sister company). The processing is described by two documents: a general data-processing policy (principles, definitions, data-subject rights) and a detailed cookie declaration running on the Cookiebot engine. Consent is managed by the Cookiebot platform.

The capture is a single recording with navigation: the homepage, then an «about the company» info page from the footer (/uldinfo/company/373/meistfooter). The site runs on its own infrastructure: www.piletilevi.ee and the in-house CMS cms-i.piletilevi.ee, plus Web eID for login via Estonian e-identification.

Who receives data directly

There are almost no third-party recipients in this capture. Analytics — Google Analytics 4 (cookieless, denial respected). Consent management — Cookiebot. Everything else is first party: the site and the in-house CMS. Functionally — Web eID (login via e-identification). The request to edge.microsoft.com/translate is the translation feature of the Edge browser used for the capture, not a site component.

Declared versus actual

Here the declared and the actual largely agree — a tidy case.

Google analytics respect the denial. Cookiebot is configured for Google consent mode, and the GA4 events (G-F42M76QVYK) — page_view, scroll — carry status gcs=G100: both storages denied, pings cookieless. The first event goes out at +7901 ms — after Cookiebot has loaded and recorded the consent configuration (+1772…+2540 ms). This is a correct sequence: the consent platform does its work before analytics is sent.

Recipients are disclosed individually. The cookie declaration running on Cookiebot is detailed: it names Google, Facebook / Meta Platforms Inc., Microsoft, reCAPTCHA and bilesuserviss.lv, with categories and retention periods. This is disclosure at a good level. Notably, Facebook / Meta is named in the declaration but no requests to it were observed in the capture itself — the marketing components did not fire in this session, which is consistent with the denied state of the storages.

The one caveat is the container’s load order. The GTM container (GTM-MHMXH4) appears at +1555 ms, whereas the Cookiebot platform itself is at +1772 ms, that is, the container loads about 217 ms earlier. GTM in itself is a tag orchestrator, not a tracker; it released no actual tracking requests before consent in this capture (the first GA event went out much later, under gcs=G100). So this is a minor untidiness in initialisation order, not a transfer of data before consent. The clean fix is to load the container after the consent platform.

Proven: the consent platform does its work before analytics. Cookiebot loads at +1772…+2540 ms, the first GA event is at +7901 ms.

Proven: analytics respect the denial. All GA4 requests carry gcs=G100 and are cookieless.

Proven: recipients are named in the declaration. The Cookiebot cookie declaration lists Google, Facebook/Meta, Microsoft, reCAPTCHA, bilesuserviss.lv individually.

Proven: GTM loads slightly before the CMP. The container — +1555 ms, Cookiebot — +1772 ms; but the container released no tracking requests before consent.

Not established: the consent decision in detail. Cookiebot recorded a configuration (consentconfig/set), but exactly which choice was made (accepted/rejected per category) cannot be read unambiguously from this capture; the gcs=G100 status indicates a denied state of the storages.

Not established unambiguously: the per-field breakdown of gcd. A gcd signal is present in the events, but the exact field breakdown is not reliably decoded; the conclusion rests on gcs=G100 and the load order.

Observation boundaries

The capture covers the homepage and one info page, records browser behaviour, not server-side processing: how the GTM container is configured and what Google does with the received (storage-denied) signals are not verified by a browser capture. The request to edge.microsoft.com is attributed to capture-tool artefacts (translation in the Edge browser), not to site tracking. The recipients named in the cookie declaration but not surfacing in the capture (Facebook/Meta, Microsoft) are placed under «declared» — their actual activity in this session was not observed.

The file is published cleaned of personal data (356 redactions, self-check clean); the load order, the gcs=G100 status and the Cookiebot → analytics sequence can be verified directly against the

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/piletilevi-ee-2026-09-09.har
SHA-256: 5e78b7019963b9acba0d40f89674279163a82368937754663fb6c6345c203868
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — piletilevi.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website piletilevi.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-piletilevi-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]