prototehas.ee
The website of the PROTO entertainment centre — three pages, 262 requests. Google Analytics and Google Ads run in denied mode, and this is done correctly. But the banner's first screen offers no way to refuse — only to agree or go into the settings. The policy still advises managing cookies through the browser, calls statistics anonymous, and mentions neither Google Ads nor the Askly chat, which holds a persistent visitor identifier from the first second.
Request timeline
Declared versus actual
Transfer timings
Askly chat with a persistent visitor identifier.
Chat websocket, repeated on every page.
page_view, gcs=G100.
AW-650736284, response 400.
Detected trackers
- Google Analytics 4 (G-WTKBJ59H5K) via region1.google-analytics.com — all requests with gcs=G100, the identifier changes between pages. The denial is respected
- Google Ads (AW-650736284) — a 'timer_45sek' conversion after 45 seconds on a page; in denied mode, response 400. Not named in the policy
- Google Tag Manager (GTM-PSBKDJX), pagead2.googlesyndication.com — service requests of the Google tag
- Askly (chat.askly.me, sessions.chat.askly.me) — chat with a persistent visitor identifier and a connection on every page before any choice. Not named in the policy
- Cloudflare Web Analytics (static.cloudflareinsights.com) — script on every page. Not named in the policy
- First party: prototehas.ee
Indicators of GDPR non-compliance
- GDPR Art. 4(11) / Art. 7(3) — refusing is harder than consenting, and the policy points to browser settingsThe banner's first layer offers 'Nõustun' and 'Küpsiste seaded'; there is no refuse button. To refuse, one must open the settings and press 'Keela kõik' — two clicks versus one for consent. The cookie section of the policy, meanwhile, describes an outdated model: most browsers accept cookies automatically, and anyone who does not want them can configure their browser or delete the cookies. Browser settings and inaction do not constitute consent, and refusing must be as easy as consenting.
- GDPR Art. 13(1)(e) / Art. 5(1)(a) — recipients not named, statistics described as anonymousThe policy names only Google Analytics and Mailchimp. The capture also shows Google Ads — the AW-650736284 tag sends a conversion after 45 seconds on a page — the Askly chat with a persistent visitor identifier on every page before any choice, and Cloudflare Web Analytics. None of them is mentioned in the policy. The advertising partners whose cookies, according to the policy text, are kept for up to 540 days are not named either. The policy describes statistics cookies as collecting data anonymously, although Google Analytics runs with a client identifier.
Context
prototehas.ee is the website of PROTO Avastustehas, an interactive entertainment centre in Tallinn. The controller is Proto OÜ (registration code 14158153, Peetri tn 10, Tallinn). The measurement is a single capture of three pages: the homepage twice and the privacy terms page. In total, 262 requests.
Processing is described by a single page, “Privaatsustingimused” — a privacy policy combined with a cookie section.
Who receives data directly
Google — Analytics and Ads in denied mode, Tag Manager. Askly — chat. Cloudflare — web analytics. Third-party libraries: jQuery CDN, BootstrapCDN, Google Fonts.
Declared versus actual
Google is configured correctly: both Analytics and Ads run in denied mode, the identifier is new on every page, and Google Ads conversions are rejected. The discrepancies lie in the banner’s design and in the policy.
First — refusing is harder than consenting. The banner’s first screen offers “Nõustun” and “Küpsiste seaded”. The “Keela kõik” button appears only on the second layer. The policy goes further still, describing cookies the way it was done before the GDPR: most browsers accept them automatically, and anyone who objects can configure their browser. Browser settings do not constitute consent, and refusal must be as easy as consent.
Second — the policy does not know what runs on the site. It names Google Analytics and Mailchimp. The capture also shows Google Ads — the tag sends a conversion once a visitor has spent 45 seconds on a page — the Askly chat, and Cloudflare Web Analytics. Askly stands out: it loads before any choice, receives a persistent visitor identifier, and opens a connection on every page. The policy mentions advertising partners with cookies lasting up to 540 days but names none of them. And it calls statistics cookies anonymous, although Google Analytics runs with an identifier.
Consent: what is proven and what is not
Proven: there is no refusal on the first layer. Screenshot 1; “Keela kõik” appears only in screenshot 2.
Proven: Google respects the denial. Every request carries gcs=G100, the identifiers differ between pages, and Google Ads conversions are rejected with response 400.
Proven: Askly runs before any choice with a persistent identifier. The same visitor identifier on every page in the capture.
Proven: Google Ads, Askly, and Cloudflare are not named in the policy. A search of the saved page.
Not established: the decision in the banner. No decision was made in the capture.
Boundaries of this observation
The measurement covers the homepage and the privacy terms page. Ticket booking was not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and script bodies were removed.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the policy itself.
Conclusion
Technically, PROTO has set up Google in good faith. But the banner does not allow refusal on the first screen, and the policy lives in the era when cookies were switched off in the browser. Of the services running on the site, it does not name them all: Google Ads, the Askly chat with a persistent identifier, and Cloudflare remain unknown to the visitor.
Remedy: add a “Keela kõik” button to the banner’s first layer; rewrite the cookie section, removing the reference to browser settings as the way to refuse; name Google Ads, Askly, Cloudflare, and the advertising partners in the policy; remove the claim that statistics cookies are anonymous.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
1a7ee0c3fc99a36da5de9c3e347c6737dd6ddaa15f88f51c397b8d9732b8d8b3
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — prototehas.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта prototehas.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Первый слой баннера предлагает «Nõustun» и «Küpsiste seaded»; кнопки отказа нет. Чтобы отказаться, нужно открыть настройки и нажать «Keela kõik» — два нажатия против одного на согласие. Раздел о cookie в политике при этом описывает устаревшую модель: большинство браузеров принимают cookie автоматически, а кто не хочет — может настроить браузер или удалить cookie. Настройки браузера и бездействие согласием не являются, а отказ должен быть так же прост, как согласие. 2) Политика называет по имени только Google Analytics и Mailchimp. В замере работают ещё Google Ads — тег AW-650736284 отправляет конверсию через 45 секунд пребывания на странице, — чат Askly с постоянным идентификатором посетителя на всех страницах до какого-либо выбора и Cloudflare Web Analytics. Ни один из них в политике не упомянут. Рекламные партнёры, чьи cookie, по тексту политики, хранятся до 540 дней, тоже не названы. Статистические cookie политика описывает как собирающие данные анонимно, хотя Google Analytics работает с идентификатором клиента. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-prototehas-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — prototehas.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website prototehas.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The banner's first layer offers 'Nõustun' and 'Küpsiste seaded'; there is no refuse button. To refuse, one must open the settings and press 'Keela kõik' — two clicks versus one for consent. The cookie section of the policy, meanwhile, describes an outdated model: most browsers accept cookies automatically, and anyone who does not want them can configure their browser or delete the cookies. Browser settings and inaction do not constitute consent, and refusing must be as easy as consenting. 2) The policy names only Google Analytics and Mailchimp. The capture also shows Google Ads — the AW-650736284 tag sends a conversion after 45 seconds on a page — the Askly chat with a persistent visitor identifier on every page before any choice, and Cloudflare Web Analytics. None of them is mentioned in the policy. The advertising partners whose cookies, according to the policy text, are kept for up to 540 days are not named either. The policy describes statistics cookies as collecting data anonymously, although Google Analytics runs with a client identifier. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-prototehas-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — prototehas.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi prototehas.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Bänneri esimene kiht pakub „Nõustun“ ja „Küpsiste seaded“; keeldumisnuppu ei ole. Keeldumiseks tuleb avada seaded ja vajutada „Keela kõik“ – kaks vajutust ühe nõusolekuvajutuse vastu. Privaatsustingimuste küpsiste peatükk kirjeldab seejuures aegunud mudelit: enamik brausereid lubab küpsiseid automaatselt ning kes seda ei soovi, võib brauseri seadistada või küpsised kustutada. Brauseri seaded ja tegevusetus ei ole nõusolek ning keeldumine peab olema sama lihtne kui nõusoleku andmine. 2) Privaatsustingimused nimetavad nimeliselt üksnes Google Analyticsi ja Mailchimpi. Mõõtmise käigus töötavad veel Google Ads – silt AW-650736284 saadab konversiooni 45-sekundilise lehel viibimise järel –, Askly vestlus külastaja püsiva identifikaatoriga kõigil lehtedel enne mis tahes valikut ning Cloudflare Web Analytics. Ühtegi neist tingimustes ei mainita. Samuti on nimetamata reklaamipartnerid, kelle küpsiseid säilitatakse tingimuste järgi kuni 540 päeva. Statistikaküpsiseid kirjeldatakse kui anonüümselt andmeid koguvaid, kuigi Google Analytics töötab kliendi identifikaatoriga. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-prototehas-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — prototehas.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом prototehas.ee. 2. Обстоятельства Я посетил сайт prototehas.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 28.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Первый слой баннера предлагает «Nõustun» и «Küpsiste seaded»; кнопки отказа нет. Чтобы отказаться, нужно открыть настройки и нажать «Keela kõik» — два нажатия против одного на согласие. Раздел о cookie в политике при этом описывает устаревшую модель: большинство браузеров принимают cookie автоматически, а кто не хочет — может настроить браузер или удалить cookie. Настройки браузера и бездействие согласием не являются, а отказ должен быть так же прост, как согласие. 2) Политика называет по имени только Google Analytics и Mailchimp. В замере работают ещё Google Ads — тег AW-650736284 отправляет конверсию через 45 секунд пребывания на странице, — чат Askly с постоянным идентификатором посетителя на всех страницах до какого-либо выбора и Cloudflare Web Analytics. Ни один из них в политике не упомянут. Рекламные партнёры, чьи cookie, по тексту политики, хранятся до 540 дней, тоже не названы. Статистические cookie политика описывает как собирающие данные анонимно, хотя Google Analytics работает с идентификатором клиента. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-prototehas-ee/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 4(11) / Art. 7(3) — отказ сложнее согласия, политика отсылает к настройкам браузера; GDPR Art. 13(1)(e) / Art. 5(1)(a) — получатели не названы, статистика описана как анонимная 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — prototehas.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website prototehas.ee. 2. Circumstances I visited the website prototehas.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 28 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The banner's first layer offers 'Nõustun' and 'Küpsiste seaded'; there is no refuse button. To refuse, one must open the settings and press 'Keela kõik' — two clicks versus one for consent. The cookie section of the policy, meanwhile, describes an outdated model: most browsers accept cookies automatically, and anyone who does not want them can configure their browser or delete the cookies. Browser settings and inaction do not constitute consent, and refusing must be as easy as consenting. 2) The policy names only Google Analytics and Mailchimp. The capture also shows Google Ads — the AW-650736284 tag sends a conversion after 45 seconds on a page — the Askly chat with a persistent visitor identifier on every page before any choice, and Cloudflare Web Analytics. None of them is mentioned in the policy. The advertising partners whose cookies, according to the policy text, are kept for up to 540 days are not named either. The policy describes statistics cookies as collecting data anonymously, although Google Analytics runs with a client identifier. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-prototehas-ee/ 3. GDPR provisions I ask you to examine GDPR Art. 4(11) / Art. 7(3) — refusing is harder than consenting, and the policy points to browser settings; GDPR Art. 13(1)(e) / Art. 5(1)(a) — recipients not named, statistics described as anonymous 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil prototehas.ee. 2. Asjaolud Külastasin veebisaiti prototehas.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 28.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Bänneri esimene kiht pakub „Nõustun“ ja „Küpsiste seaded“; keeldumisnuppu ei ole. Keeldumiseks tuleb avada seaded ja vajutada „Keela kõik“ – kaks vajutust ühe nõusolekuvajutuse vastu. Privaatsustingimuste küpsiste peatükk kirjeldab seejuures aegunud mudelit: enamik brausereid lubab küpsiseid automaatselt ning kes seda ei soovi, võib brauseri seadistada või küpsised kustutada. Brauseri seaded ja tegevusetus ei ole nõusolek ning keeldumine peab olema sama lihtne kui nõusoleku andmine. 2) Privaatsustingimused nimetavad nimeliselt üksnes Google Analyticsi ja Mailchimpi. Mõõtmise käigus töötavad veel Google Ads – silt AW-650736284 saadab konversiooni 45-sekundilise lehel viibimise järel –, Askly vestlus külastaja püsiva identifikaatoriga kõigil lehtedel enne mis tahes valikut ning Cloudflare Web Analytics. Ühtegi neist tingimustes ei mainita. Samuti on nimetamata reklaamipartnerid, kelle küpsiseid säilitatakse tingimuste järgi kuni 540 päeva. Statistikaküpsiseid kirjeldatakse kui anonüümselt andmeid koguvaid, kuigi Google Analytics töötab kliendi identifikaatoriga. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-prototehas-ee/ 3. Sätted, mille järgimist palun kontrollida IKÜM art 4 p 11 / art 7 lg 3 — keeldumine on keerulisem kui nõusolek, privaatsustingimused viitavad brauseri seadetele; IKÜM art 13 lg 1 p e / art 5 lg 1 p a — vastuvõtjad on nimetamata, statistikat kirjeldatakse anonüümsena 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]