Estonia's largest news portal — a single capture of the homepage, 4262 requests, 66 nodes. The disclosure here is exemplary: the Didomi consent platform under the IAB TCF standard and a named partner list of about 950 thousand characters — Google, Adform, Criteo, RTB House, Cxense, Chartbeat and hundreds of others are named. But the user's decision is not protected by this disclosure. The user refused: the TCF consent string encodes zero purposes and zero legitimate interest. Despite the refusal, immediately afterwards a full advertising auction starts — over two hundred requests to Google Ad Manager, Setupad, Criteo, RTB House, Adform, DoubleClick — and each carries the partners the same 'no consent' string. And even before the choice, in the first seconds, the Cxense audience data platform already profiles the visitor by a stored identifier, Chartbeat sends a pageview with a token, and the Google ad server loads before the banner itself. GA4 runs with no consent signal at all.
Request timeline
Declared versus actual
Transfer timings
Google Publisher Tag (gpt.js) from the markup, before the Didomi SDK.
segment/lookup with a persistent identifier persisted=af85f1f8…. Advertising audience segments.
pageview /ping with a user token.
consent.given on click; the TCF string CQqOSAA… = zero purposes, zero legitimate interest.
gdpr_consent=CQqOSAA… (the zero string) goes to Google Ad Manager; the auction starts after the refusal.
Criteo receives the zero-consent string.
DoubleClick receives the zero-consent string.
GA4 page_view, G-380QQP0TRP, consent mode not configured.
Detected trackers
Show data recipients (22)
- Didomi (sdk.privacy-center.org — 2829 req., api.privacy-center.org) — IAB TCF consent management platform (CMP ID 7); banner 'Olen nõus' / 'Halda valikuid'. The user's recorded choice is a refusal (the consent string encodes zero purposes and zero legitimate interest)
- Cxense / Piano DMP (cdn.cxense.com, api.cxense.com, comcluster.cxense.com) — audience data platform; api.cxense.com/segment/lookup carries a persistent identifier and requests advertising segments at +1167 ms — before the choice
- Chartbeat (pong.chartbeat.net — 231 req., static.chartbeat.com, mab.chartbeat.com) — publisher analytics; pong/ping with a user token at +1437 ms — before the choice
- Google Publisher Tag / Ad Manager (pagead2.googlesyndication.com — 237 req.) — ad server; gpt.js at +190 ms (before the CMP itself), /pagead/ping at +2526 ms — before the choice; the full auction — afterwards, under a recorded refusal
- Weborama (static.wwcloud.eu — 12 req.) — audience data platform; loads at +247 ms — before the choice
- Confiant (www.npttech.com) — ad quality and safety verification; +213 ms — before the choice
- Piano Analytics / AT Internet (tag.aticdn.net, xqnzlnc.pa-cd.com — 26 req., api-esp.piano.io) — content-consumption measurement; pa-cd.com/event before the choice carries idclient=OPT-OUT (no identifier)
- Google Tag Manager (www.googletagmanager.com — 20 req.) — tag container; +1350 ms — before the choice
- Google Analytics 4 (region1.analytics.google.com, G-380QQP0TRP) — runs with the status gcs=- (consent mode not configured); Universal Analytics (www.google-analytics.com) — legacy counter
- Setupad (node.setupad.com — 28 req., wb.setupad.com, stpd.cloud) — header-bidding platform; the auction starts AFTER the refusal
- Google DoubleClick (ad.doubleclick.net, stats.g.doubleclick.net, s0.2mdn.net, tpc.googlesyndication.com, *.safeframe.googlesyndication.com) — ad delivery and display; AFTER the refusal, carrying the zero-consent string
- Google Ad Traffic Quality (ep1.adtrafficquality.google, ep2.adtrafficquality.google) — ad-traffic quality control; AFTER the refusal
- Criteo (static.criteo.net, gum.criteo.com) — advertising network / retargeting (RTB); AFTER the refusal, receives the zero-consent string
- RTB House (invstatic101.creativecdn.com) — advertising network (RTB); AFTER the refusal
- Adform (track.adform.net) — advertising network (RTB); AFTER the refusal
- euddn.net (le303.euddn.net — 29 req., router.euddn.net, ode601.euddn.net, ode602.euddn.net) — advertising delivery infrastructure (RTB); AFTER the refusal
- Adobe (animate.adobe.com) — ad-creative animation library; AFTER the refusal
- Kanal2 (tigu.kanal2.ee) — a node of the Estonian TV channel (media group); AFTER the refusal
- city24 (static.img-city24.ee) — a node of a sister site of the media group; AFTER the refusal
- Libraries and fonts (cdnjs.cloudflare.com, cdn.jsdelivr.net, code.jquery.com, cdn.ampproject.org, fonts.googleapis.com, fonts.gstatic.com, www.gstatic.com, www.google.com, www.google.ee) — functional delivery
- First party (www.postimees.ee, v.postimees.ee, vx.postimees.ee, services.postimees.ee, auth.postimees.ee, c2/infographics/ams/andy/cdn.postimees.ee, f.pmo.ee and f7–f12/f302.pmo.ee, sisuturundus.pmo.ee) — Postimees Grupp infrastructure
- Partner list — an IAB TCF vendor list of ~950 thousand characters; Google, Adform, Criteo, RTB House, Weborama, Piano, Cxense, Setupad, Xandr, Chartbeat and hundreds of others are named
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — advertising processing under a recorded refusal, and tracking before the choiceThe portal has the Didomi consent platform (CMP ID 7) installed under the IAB TCF standard, and the partner list is disclosed exhaustively. The user made a choice in the banner, and Didomi recorded the TCF consent string CQqOSAA…, which decodes to a full refusal: consent to all twenty-four processing purposes — 0, legitimate interest — 0. Nevertheless, immediately after the choice is recorded, a full programmatic auction starts: over two hundred requests to the Google Ad Manager ad server (pagead2 — 233 requests), Setupad header bidding, Criteo, RTB House, Adform, the euddn infrastructure, Google DoubleClick. The requests carry that same zero-consent string to the partners (verified: gdpr_consent=CQqOSAA… goes to pagead2.googlesyndication.com, gum.criteo.com, ad.doubleclick.net). That is, the ad auction is tied to the mere fact of the decision, not to its content: it fires under a refusal as well, merely passing the partners a 'no consent' signal. Separately, before the choice, in the first seconds, trackers are already running: the Cxense audience data platform requests the visitor's advertising segments carrying a persistent identifier (api.cxense.com/segment/lookup, persisted=af85f1f8…, +1167 ms), Chartbeat sends a pageview with a user token (+1437 ms), the Google Publisher Tag ad server loads before the CMP itself (+190 ms), and Weborama is loaded (+247 ms).
- GDPR Art. 5(1)(a) / Art. 6(1)(a) — exemplary disclosure alongside an ignored decisionPostimees's disclosure of recipients is done at an exemplary level: the Didomi platform under the IAB TCF standard and a named partner list of about 950 thousand characters. But this disclosure is not accompanied by respect for the user's decision. The recorded refusal (zero purposes, zero legitimate interest) does not stop the advertising stack — it starts precisely after the refusal. Meanwhile the banner assigns to necessary, on the basis of legitimate interest, content-consumption measurement among other things, whereas Cxense's request for advertising audience segments using a stored identifier before the choice goes beyond measurement — it is profiling, for which consent is required. GA4 analytics (G-380QQP0TRP) additionally runs with the status gcs=- — no consent signal is passed to Google at all. The upshot: the completeness of the partner list replaces neither holding processing back until the choice nor respecting the refusal after it.
Context
postimees.ee is Estonia’s largest news portal; the controller is Postimees Grupp. Consent is managed by the Didomi platform under the IAB TCF standard. The capture is a single recording of the homepage: 4262 requests, 66 nodes, a long session during which the user explored the consent settings and ultimately refused.
This audit stands apart twice over. First, the disclosure of recipients here is done at an exemplary level: the partner list is laid out by name and in full — an IAB TCF vendor list of about 950 thousand characters, where Google, Adform, Criteo, RTB House, Cxense, Chartbeat, Setupad and hundreds of others are named. Second, it is precisely this completeness that makes the main discrepancy plain: disclosing everyone is not the same as respecting the user’s decision.
Who receives data directly
Before the choice — Cxense / Piano (audience data, profiling), Chartbeat (analytics), Google Publisher Tag (ad server), Weborama (audience data), Confiant (ad verification), Google Tag Manager. After the recorded refusal — a full advertising auction: Setupad, Criteo, RTB House, Adform, euddn, Google DoubleClick, plus GA4 and Universal Analytics. Piano Analytics measurement before the choice goes out without an identifier (OPT-OUT).
Declared vs. actual
The discrepancy here is not in the set of recipients but in the attitude to the user’s decision — and that is fundamental.
First — the disclosure is exemplary. The Didomi consent platform under the IAB TCF standard, a banner with the choice ‘Olen nõus’ / ‘Halda valikuid’, and a named partner list of ~950 thousand characters. As for who was named, there is no complaint against the site: it named practically everyone.
Second — but the refusal is ignored. The user made a choice, and Didomi recorded the TCF consent string CQqOSAA…. This string decodes unambiguously: consent to all twenty-four processing purposes — zero, legitimate interest — zero. That is, a full refusal is recorded. Nevertheless, precisely after the refusal is recorded, a full programmatic auction starts: over two hundred requests to the Google Ad Manager ad server, Setupad header bidding, Criteo, RTB House, Adform, the euddn infrastructure, Google DoubleClick. And the requests carry the partners the same zero string — verified, gdpr_consent=CQqOSAA… goes to Google, Criteo and DoubleClick. The mechanics are these: the auction is tied to the mere fact of the decision, not to its content. It fires identically both under consent and under refusal — in the latter case merely honestly passing the partners a ’no consent’ signal. But a refusal should stop processing, not accompany it.
Third — and before the choice, profiling is already happening. Already in the first seconds, long before the decision, the Cxense audience data platform requests the visitor’s advertising segments (api.cxense.com/segment/lookup, +1167 ms), carrying a persistent identifier persisted=af85f1f8…. This is the reading of a stored device identifier and profiling for advertising — not the measurement that the banner assigns to legitimate interest. Alongside, Chartbeat sends a pageview with a user token (+1437 ms), the Google Publisher Tag ad server loads at +190 ms — before the CMP itself — and Weborama is loaded (+247 ms).
Fourth — analytics without a consent signal. GA4 (G-380QQP0TRP) sends events with the status gcs=- — Google’s consent mode is not configured.
Consent: what is proven and what is not
Proven: the user clicked ‘Keeldun kõigist’ (reject all). In the Didomi ‘Nõusolekuhaldus’ panel, the button rejecting all categories, including advertising ones (Reklaamküpsised), is selected. Didomi records the decision at +3443371 ms with a consent.given event (the event type means ‘a decision was made’, not ‘consent was given’), and the recorded TCF string CQqOSAA… decodes to zero consent across all twenty-four purposes and zero legitimate interest — that is, a machine-confirmed refusal.
Proven: the ad auction starts after the refusal. Right after the decision is recorded (+3443383 ms onwards), over two hundred advertising requests go out — Google Ad Manager, Setupad, Criteo, RTB House, Adform, euddn, DoubleClick.
Proven: the partners receive the zero string. gdpr_consent=CQqOSAA… is present in the requests to Google Ad Manager, Criteo and DoubleClick — that is, a ’no consent’ signal is passed, but the requests still happen.
Proven: trackers run before the choice. Cxense segment/lookup with a stored identifier — at +1167 ms; Chartbeat pong/ping with a token — at +1437 ms; Google Publisher Tag — at +190 ms; Weborama — at +247 ms.
Proven: part of the stack respects the refusal. The Piano Analytics collector sends idclient=OPT-OUT, without an identifier; against this backdrop the ad auction that starts under a refusal stands out especially plainly.
Not proven, and not reproduced: the content of the segments and the full identifier. Which advertising segments exactly Cxense returned and what the full stored identifier is are not reproduced in the audit; the conclusion rests on the fact of a request with a stored identifier and on the fact of the advertising requests after the refusal.
Observation boundaries
The capture covers the homepage and a long session during which the user explored the settings and refused; browser behaviour is recorded, not the services’ internal workings. The TCF consent string is decoded from the gdpr_consent parameter that the site passes to the partners; the type of decision (consent.given) is read from the Didomi events. The attribution of requests to recipients relies on domains and URL schemes. The Cxense persistent identifier is presented in the audit in truncated form. How each advertising partner handles the received zero string on its side — whether it respects the refusal server-side — is not verified by a browser-level capture; what matters is that the requests to them after the refusal took place.
Separately, on reading consent: the Didomi platform, on any choice — both acceptance and refusal — sends an event of type consent.given (‘a decision was recorded’). Therefore an automated check that keys on the event name may mistakenly show ‘consent given’; the actual state is read not from the event name but from the TCF string, which here encodes a full refusal.
The file is published redacted of personal data: cookie values in requests have been removed, and stored identifiers in the evidence bodies are truncated. Response headers, statuses, the load order, initiators, the moment the decision is recorded and the TCF consent string are preserved and verified directly against the published file.
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The country’s largest news portal approached disclosure in an exemplary way: the Didomi consent platform under the IAB TCF standard and a named partner list of almost a million characters, where practically all recipients are named. To the question ‘who processes the data’ the site answers more fully than most. But the user’s decision is not protected by this disclosure.
The user refused — the TCF consent string encodes zero purposes and zero legitimate interest. Despite the refusal, immediately afterwards a full advertising auction starts: over two hundred requests to Google Ad Manager, Setupad, Criteo, RTB House, Adform, DoubleClick — and each carries the partners the same ’no consent’ string. The mechanism is tied to the fact of the decision, not to its content: it fires under a refusal as well. And even before the choice, in the first seconds, the Cxense audience data platform profiles the visitor by a stored identifier, Chartbeat sends a pageview with a token, the Google ad server loads before the banner, and GA4 runs with no consent signal at all.
Tellingly, part of the stack behaves correctly: the Piano Analytics collector sends OPT-OUT, without an identifier, before the choice. This makes the discrepancy especially plain — where measurement manages without an identifier, the ad auction starts right on top of the refusal. Exhaustive disclosure of recipients is necessary but not sufficient: it replaces neither holding processing back until the choice nor respecting the refusal after it.
Remediation: stop the ad auction on a refusal — condition the launch of header bidding and requests to Google Ad Manager, Criteo, RTB House, Adform, euddn and DoubleClick on the actual content of the decision, not on the mere fact of its being recorded; condition the Cxense segment request and any reading of stored identifiers before the choice on consent; condition the loading and pings of the Google Publisher Tag, Chartbeat and Weborama on consent; configure Google’s consent mode so that GA4 passes a consent signal (currently gcs=-); and reconsider assigning advertising audience profiling to legitimate interest.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
9b5dedce72b3411d8de72aabdd9d4fbec18b8af3f7b5c03c16fd74ccefc0b404Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — postimees.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта postimees.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На портале установлена платформа согласия Didomi (CMP ID 7) по стандарту IAB TCF, а список партнёров раскрыт исчерпывающе. Пользователь сделал выбор в баннере, и Didomi записал строку согласия TCF CQqOSAA…, которая декодируется в полный отказ: согласие на все двадцать четыре цели обработки — 0, легитимный интерес — 0. Несмотря на это, сразу после фиксации выбора запускается полный программатик-аукцион: свыше двухсот обращений к рекламному серверу Google Ad Manager (pagead2 — 233 обращения), заголовочные ставки Setupad, Criteo, RTB House, Adform, инфраструктура euddn, Google DoubleClick. Обращения несут партнёрам ту самую нулевую строку согласия (проверено: gdpr_consent=CQqOSAA… уходит в pagead2.googlesyndication.com, gum.criteo.com, ad.doubleclick.net). То есть рекламный аукцион привязан к самому факту решения, а не к его содержанию: он срабатывает и при отказе, лишь передавая партнёрам сигнал «согласия нет». Отдельно, ещё до выбора, в первые секунды работают трекеры: платформа аудиторных данных Cxense запрашивает рекламные сегменты по устойчивому идентификатору (api.cxense.com/segment/lookup, persisted=af85f1f8…, +1167 мс), Chartbeat отправляет pageview с токеном пользователя (+1437 мс), рекламный сервер Google Publisher Tag загружается раньше самого CMP (+190 мс), подгружается Weborama (+247 мс). 2) Раскрытие получателей у Postimees сделано на образцовом уровне: платформа Didomi по стандарту IAB TCF и поимённый список партнёров примерно на 950 тысяч знаков. Но это раскрытие не сопровождается соблюдением решения пользователя. Зафиксированный отказ (ноль целей, ноль легитимного интереса) рекламный стек не останавливает — он запускается ровно после отказа. При этом баннер относит к необходимым, на основании законного интереса, в том числе измерение потребления контента, а запрос рекламных аудиторных сегментов Cxense по сохранённому идентификатору до выбора выходит за рамки измерения — это профилирование, для которого требуется согласие. Аналитика GA4 (G-380QQP0TRP) вдобавок идёт со статусом gcs=- — сигнал согласия Google не передаётся вовсе. Итог: полнота списка партнёров не заменяет ни удержания обработки до выбора, ни соблюдения отказа после него. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-postimees-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — postimees.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website postimees.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The portal has the Didomi consent platform (CMP ID 7) installed under the IAB TCF standard, and the partner list is disclosed exhaustively. The user made a choice in the banner, and Didomi recorded the TCF consent string CQqOSAA…, which decodes to a full refusal: consent to all twenty-four processing purposes — 0, legitimate interest — 0. Nevertheless, immediately after the choice is recorded, a full programmatic auction starts: over two hundred requests to the Google Ad Manager ad server (pagead2 — 233 requests), Setupad header bidding, Criteo, RTB House, Adform, the euddn infrastructure, Google DoubleClick. The requests carry that same zero-consent string to the partners (verified: gdpr_consent=CQqOSAA… goes to pagead2.googlesyndication.com, gum.criteo.com, ad.doubleclick.net). That is, the ad auction is tied to the mere fact of the decision, not to its content: it fires under a refusal as well, merely passing the partners a 'no consent' signal. Separately, before the choice, in the first seconds, trackers are already running: the Cxense audience data platform requests the visitor's advertising segments carrying a persistent identifier (api.cxense.com/segment/lookup, persisted=af85f1f8…, +1167 ms), Chartbeat sends a pageview with a user token (+1437 ms), the Google Publisher Tag ad server loads before the CMP itself (+190 ms), and Weborama is loaded (+247 ms). 2) Postimees's disclosure of recipients is done at an exemplary level: the Didomi platform under the IAB TCF standard and a named partner list of about 950 thousand characters. But this disclosure is not accompanied by respect for the user's decision. The recorded refusal (zero purposes, zero legitimate interest) does not stop the advertising stack — it starts precisely after the refusal. Meanwhile the banner assigns to necessary, on the basis of legitimate interest, content-consumption measurement among other things, whereas Cxense's request for advertising audience segments using a stored identifier before the choice goes beyond measurement — it is profiling, for which consent is required. GA4 analytics (G-380QQP0TRP) additionally runs with the status gcs=- — no consent signal is passed to Google at all. The upshot: the completeness of the partner list replaces neither holding processing back until the choice nor respecting the refusal after it. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-postimees-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — postimees.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi postimees.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Portaalil on IAB TCF standardile vastav Didomi nõusoleku platvorm (CMP ID 7) ning partnerite nimekiri on täielikult avalikustatud. Kasutaja tegi valiku bänneris ja Didomi salvestas TCF CQOSAA nõusoleku stringi ..., mis dekodeeritakse täielikuks keeldumiseks: nõusolek kõigi kahekümne nelja töötlemise eesmärkidel on 0, õigustatud huvi on 0. Sellest hoolimata käivitatakse kohe pärast valiku fikseerimist täielik programmiline oksjon: üle kahesaja kõne Google Ad Manageri reklaamiserverisse (pagead2 - 233 päringut), päisehinnad Setupad, Criteo, RTB House, Adform, euddn infrastruktuur, Google DoubleClick. Kontaktid kannavad partnereid, kellel on sama nõusoleku nullrida (kontrollitud: gdpr consent=CQOSAA... läheb pagead2). googlesyndication.com, gum criteo.com, ad. doubleclick.net. See tähendab, et reklaamioksjon on seotud otsuse faktiga, mitte selle sisuga: see toimib keeldumise korral, edastades partneritele ainult signaali "nõusoleku puudumine". Eraldi, isegi enne valimist, töötavad jälgijad esimeste sekunditega: Cxense auditium andmeplatvorm nõuab reklaami segmente, kasutades stabiilset identifikaatorit (api.cxense.com/segment/lookup, persisted=af85f1f8..., +1167 ms), Chartbeat saadab lehevaate kasutaja tokeniga (+1437 ms), Google Publisher Tag reklaamiserver laadib enne CMP enda (+190 ms) laadimist Weama (+247 ms). 2) Postimehe saajate avalikustamine toimub eeskujulikul tasemel: Didomi platvorm IAB TCF standardi järgi ja partnerite nimekiri umbes 950 tuhande tähemärgi kohta. Kuid selle avalikustamisega ei kaasne kasutaja otsuse järgimine. Fikseeritud rike (nulleesmärgid, null õigustatud huvi) ei peata reklaamikogumit - see algab täpselt pärast ebaõnnestumist. Samal ajal viitab bänner õigustatud huvi alusel vajalikule, sealhulgas sisu tarbimise mõõtmisele ja Cxense reklaamipubliku segmentide taotlusele salvestatud identifikaatori kohta enne valimist läheb mõõtmisest kaugemale - see on profileerimine, mille jaoks on vaja nõusolekut. GA4 analüüsiga (G-380QP0TRP) kaasneb ka staatus gcs=- - Google'i nõusoleku signaali ei edastata üldse. Alumine rida: partnerite nimekirja täielikkus ei asenda töötlemise säilitamist enne valimist ega sellele järgnevat keeldumist. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-postimees-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — postimees.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом postimees.ee. 2. Обстоятельства Я посетил сайт postimees.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 08.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На портале установлена платформа согласия Didomi (CMP ID 7) по стандарту IAB TCF, а список партнёров раскрыт исчерпывающе. Пользователь сделал выбор в баннере, и Didomi записал строку согласия TCF CQqOSAA…, которая декодируется в полный отказ: согласие на все двадцать четыре цели обработки — 0, легитимный интерес — 0. Несмотря на это, сразу после фиксации выбора запускается полный программатик-аукцион: свыше двухсот обращений к рекламному серверу Google Ad Manager (pagead2 — 233 обращения), заголовочные ставки Setupad, Criteo, RTB House, Adform, инфраструктура euddn, Google DoubleClick. Обращения несут партнёрам ту самую нулевую строку согласия (проверено: gdpr_consent=CQqOSAA… уходит в pagead2.googlesyndication.com, gum.criteo.com, ad.doubleclick.net). То есть рекламный аукцион привязан к самому факту решения, а не к его содержанию: он срабатывает и при отказе, лишь передавая партнёрам сигнал «согласия нет». Отдельно, ещё до выбора, в первые секунды работают трекеры: платформа аудиторных данных Cxense запрашивает рекламные сегменты по устойчивому идентификатору (api.cxense.com/segment/lookup, persisted=af85f1f8…, +1167 мс), Chartbeat отправляет pageview с токеном пользователя (+1437 мс), рекламный сервер Google Publisher Tag загружается раньше самого CMP (+190 мс), подгружается Weborama (+247 мс). 2) Раскрытие получателей у Postimees сделано на образцовом уровне: платформа Didomi по стандарту IAB TCF и поимённый список партнёров примерно на 950 тысяч знаков. Но это раскрытие не сопровождается соблюдением решения пользователя. Зафиксированный отказ (ноль целей, ноль легитимного интереса) рекламный стек не останавливает — он запускается ровно после отказа. При этом баннер относит к необходимым, на основании законного интереса, в том числе измерение потребления контента, а запрос рекламных аудиторных сегментов Cxense по сохранённому идентификатору до выбора выходит за рамки измерения — это профилирование, для которого требуется согласие. Аналитика GA4 (G-380QQP0TRP) вдобавок идёт со статусом gcs=- — сигнал согласия Google не передаётся вовсе. Итог: полнота списка партнёров не заменяет ни удержания обработки до выбора, ни соблюдения отказа после него. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-postimees-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — рекламная обработка при зафиксированном отказе и трекинг до выбора; GDPR Art. 5(1)(a) / Art. 6(1)(a) — образцовое раскрытие при проигнорированном решении 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — postimees.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website postimees.ee. 2. Circumstances I visited the website postimees.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 8 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The portal has the Didomi consent platform (CMP ID 7) installed under the IAB TCF standard, and the partner list is disclosed exhaustively. The user made a choice in the banner, and Didomi recorded the TCF consent string CQqOSAA…, which decodes to a full refusal: consent to all twenty-four processing purposes — 0, legitimate interest — 0. Nevertheless, immediately after the choice is recorded, a full programmatic auction starts: over two hundred requests to the Google Ad Manager ad server (pagead2 — 233 requests), Setupad header bidding, Criteo, RTB House, Adform, the euddn infrastructure, Google DoubleClick. The requests carry that same zero-consent string to the partners (verified: gdpr_consent=CQqOSAA… goes to pagead2.googlesyndication.com, gum.criteo.com, ad.doubleclick.net). That is, the ad auction is tied to the mere fact of the decision, not to its content: it fires under a refusal as well, merely passing the partners a 'no consent' signal. Separately, before the choice, in the first seconds, trackers are already running: the Cxense audience data platform requests the visitor's advertising segments carrying a persistent identifier (api.cxense.com/segment/lookup, persisted=af85f1f8…, +1167 ms), Chartbeat sends a pageview with a user token (+1437 ms), the Google Publisher Tag ad server loads before the CMP itself (+190 ms), and Weborama is loaded (+247 ms). 2) Postimees's disclosure of recipients is done at an exemplary level: the Didomi platform under the IAB TCF standard and a named partner list of about 950 thousand characters. But this disclosure is not accompanied by respect for the user's decision. The recorded refusal (zero purposes, zero legitimate interest) does not stop the advertising stack — it starts precisely after the refusal. Meanwhile the banner assigns to necessary, on the basis of legitimate interest, content-consumption measurement among other things, whereas Cxense's request for advertising audience segments using a stored identifier before the choice goes beyond measurement — it is profiling, for which consent is required. GA4 analytics (G-380QQP0TRP) additionally runs with the status gcs=- — no consent signal is passed to Google at all. The upshot: the completeness of the partner list replaces neither holding processing back until the choice nor respecting the refusal after it. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-postimees-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — advertising processing under a recorded refusal, and tracking before the choice; GDPR Art. 5(1)(a) / Art. 6(1)(a) — exemplary disclosure alongside an ignored decision 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil postimees.ee. 2. Asjaolud Külastasin veebisaiti postimees.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 08.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Portaalil on IAB TCF standardile vastav Didomi nõusoleku platvorm (CMP ID 7) ning partnerite nimekiri on täielikult avalikustatud. Kasutaja tegi valiku bänneris ja Didomi salvestas TCF CQOSAA nõusoleku stringi ..., mis dekodeeritakse täielikuks keeldumiseks: nõusolek kõigi kahekümne nelja töötlemise eesmärkidel on 0, õigustatud huvi on 0. Sellest hoolimata käivitatakse kohe pärast valiku fikseerimist täielik programmiline oksjon: üle kahesaja kõne Google Ad Manageri reklaamiserverisse (pagead2 - 233 päringut), päisehinnad Setupad, Criteo, RTB House, Adform, euddn infrastruktuur, Google DoubleClick. Kontaktid kannavad partnereid, kellel on sama nõusoleku nullrida (kontrollitud: gdpr consent=CQOSAA... läheb pagead2). googlesyndication.com, gum criteo.com, ad. doubleclick.net. See tähendab, et reklaamioksjon on seotud otsuse faktiga, mitte selle sisuga: see toimib keeldumise korral, edastades partneritele ainult signaali "nõusoleku puudumine". Eraldi, isegi enne valimist, töötavad jälgijad esimeste sekunditega: Cxense auditium andmeplatvorm nõuab reklaami segmente, kasutades stabiilset identifikaatorit (api.cxense.com/segment/lookup, persisted=af85f1f8..., +1167 ms), Chartbeat saadab lehevaate kasutaja tokeniga (+1437 ms), Google Publisher Tag reklaamiserver laadib enne CMP enda (+190 ms) laadimist Weama (+247 ms). 2) Postimehe saajate avalikustamine toimub eeskujulikul tasemel: Didomi platvorm IAB TCF standardi järgi ja partnerite nimekiri umbes 950 tuhande tähemärgi kohta. Kuid selle avalikustamisega ei kaasne kasutaja otsuse järgimine. Fikseeritud rike (nulleesmärgid, null õigustatud huvi) ei peata reklaamikogumit - see algab täpselt pärast ebaõnnestumist. Samal ajal viitab bänner õigustatud huvi alusel vajalikule, sealhulgas sisu tarbimise mõõtmisele ja Cxense reklaamipubliku segmentide taotlusele salvestatud identifikaatori kohta enne valimist läheb mõõtmisest kaugemale - see on profileerimine, mille jaoks on vaja nõusolekut. GA4 analüüsiga (G-380QP0TRP) kaasneb ka staatus gcs=- - Google'i nõusoleku signaali ei edastata üldse. Alumine rida: partnerite nimekirja täielikkus ei asenda töötlemise säilitamist enne valimist ega sellele järgnevat keeldumist. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-postimees-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) - reklaami töötlemine registreeritud rikke korral ja jälgimine enne valimist; GDPR art 5(1)(a) / art 6(1)(a) – eeskujulik avalikustamine ignoreeritud otsusega 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]