RU EN
www.
Technical audit · 09.09.2026

rahvaraamat.ee

Estonia's largest bookstore
EE

Estonia's largest bookstore — two captures of a single operator, and the trackers are split between them plainly. The main site rahvaraamat.ee has the Cookiebot consent platform, and the user explicitly declines consent (action=decline) — but the Microsoft Clarity session recording carries a stream of data to Microsoft both before the refusal and after it, and Clarity itself is not named in the policy at all. The app.rahvaraamat.ee application has no consent platform whatsoever, and there the full advertising stack fires: Google Analytics, the Facebook pixel, Google DoubleClick and Google Ads conversion tracking — all without any consent signal. One operator, two properties: on one, consent is asked and ignored; on the other, it is not asked at all.

Request timeline

MAIN +2337 ms · Clarity session recording
www.clarity.ms/tag/rk0m9l1d2i and scripts.clarity.ms/clarity.js, then the stream b.clarity.ms/collect (POST 204) — the Microsoft Clarity session recording begins right on load. Cookiebot is loaded by this point (+312 ms), but Clarity is not held by it.
MAIN +1662…+4667 ms · PostHog
eu-assets.i.posthog.com/array, eu.posthog.com/flags, then eu.i.posthog.com/e/ — the PostHog product analytics sends an event before any consent choice.
MAIN +122395 ms · the user declines consent
consent.cookiebot.com/logconsent.ashx?action=decline — an explicit refusal (method strict, country EE). By this point Clarity has been recording the session for two minutes.
MAIN +134743…+191845 ms · Clarity continues after the refusal
The b.clarity.ms/collect stream does not stop: the requests continue after the refusal until the end of the capture. The refusal had no effect on the session recording.
APP · no consent platform
Across 166 requests of the application there is no request to Cookiebot or any other CMP. No consent mechanism is observed on the application subdomain.
APP +8612…+9166 ms · advertising stack
www.googletagmanager.com/gtag/js, connect.facebook.net/fbevents.js, region1.analytics.google.com/g/collect (GA4 G-WT3HBPL13E, page_view), www.facebook.com/tr (PageView, pixel 1838212177017029), ad.doubleclick.net and googleads.g.doubleclick.net (conversions, view-through), www.google.com/ccm/conversion/16939341 (Google Ads). All with the status gcs=-.

Declared versus actual

✓ Controller — Rahva Raamat; cookie declaration on the Cookiebot engine — declared
✓ The cookie declaration names: PostHog, Google Analytics, Facebook / Meta, Google Ads, Askly — declared
✓ Categories: necessary, statistics (statistika), marketing (turundus) — with consent configuration — declared
✓ Consent management — Cookiebot (on the main site); supervisory authority — Andmekaitse Inspektsioon — declared
+ Microsoft Clarity — a session-recording tool on the main site; not named in the cookie declaration — not declared
+ That the Clarity session recording and the PostHog analytics run before and despite the refusal (action=decline) — not declared
+ That the app.rahvaraamat.ee application has no consent mechanism, while the advertising stack (GA4, Facebook Pixel, DoubleClick, Google Ads) fires without a consent signal (gcs=-) — not declared

Transfer timings

No exact timing

MAIN +2337 ms b.clarity.msMicrosoft Clarity, project rk0m9l1d2i. The /collect stream from load. Not named in the policy.
MAIN +122395 ms consent.cookiebot.comlogconsent.ashx?action=decline, method strict.
MAIN +191845 ms b.clarity.msThe /collect stream continues to the end of the capture, despite the refusal.
APP +9036 ms region1.analytics.google.comGA4 page_view, G-WT3HBPL13E, gcs=-.
APP +9126 ms www.facebook.comPageView, pixel 1838212177017029.
APP +8955 ms googleads.g.doubleclick.netviewthroughconversion — view-through advertising.
APP +8962 ms www.google.comccm/conversion/16939341 — a Google Ads conversion.

Detected trackers

Indicators of GDPR non-compliance

Context

rahvaraamat.ee is the website of Estonia’s largest bookstore, Rahva Raamat. The capture consists of two recordings of a single operator: the main site rahvaraamat.ee (318 requests, about three minutes, served via Apache/ZoneOS) and the application app.rahvaraamat.ee (166 requests, about twenty seconds, served via nginx). Both were recorded on 9 September 2026 in a single session, about ten minutes apart.

The audit combines the two recordings because the trackers are split between the properties — and that split is telling. On the main site there is a consent management platform and behavioural analytics; in the application there is an advertising stack with no consent platform. Processing is described by the ‘Policy and cookies’ document with a cookie declaration on the Cookiebot engine.

Who receives data directly

On the main site — Microsoft (Clarity, session recording — before and after the refusal), PostHog (product analytics). In the application — Google (Analytics, DoubleClick, Ads) and Meta (Facebook Pixel), without a consent mechanism. Functionally — Askly (chat) and the image networks.

Declared vs. actual

The discrepancy here is twofold — by the number of properties.

The main site: consent is asked and ignored. The Cookiebot platform on rahvaraamat.ee shows a banner, and in the recording the user explicitly declines consent — the logconsent.ashx request carries action=decline at +122395 ms, method strict. But the Microsoft Clarity session recording does not respect that choice: the stream of b.clarity.ms/collect requests begins at +2337 ms, two minutes before the refusal, and continues after it until the end of the capture — more than forty requests over three-plus minutes. Clarity records the session both before the choice and after the explicit ’no’. The PostHog product analytics also sends an event before the refusal. Neither of these services is held by the Cookiebot platform.

The main site: Clarity is additionally undisclosed. The cookie declaration names PostHog, Google Analytics, Facebook, Google Ads and Askly. But Microsoft Clarity — the very service that performs the session recording — is not mentioned in it at all. The recipient that records the visitor’s behaviour and transmits it to Microsoft is undisclosed.

The application: consent is not asked at all. In app.rahvaraamat.ee there is no consent management platform — neither Cookiebot nor any other; across 166 requests there is no request to a CMP and no script with the signs of a banner. Yet at +8612…+9166 ms a full advertising stack fires: Google Analytics 4 (G-WT3HBPL13E), the Facebook / Meta Pixel (1838212177017029, a PageView event), Google DoubleClick (conversions and view-through), Google Ads conversion tracking (account 16939341). All the requests carry the status gcs=- — Google’s consent mode is not configured. That is, on the property where the visitor logs in and makes purchases, consent is not asked, and the advertising stack runs unconditionally.

The result is plain: one operator, two properties. On the storefront consent is shown — and not respected even for an explicit refusal; in the application consent is not shown at all.

Proven: on the main site the user declined consent. The consent.cookiebot.com/logconsent.ashx request carries action=decline, method strict, country EE.

Proven: Clarity records the session before and after the refusal. The b.clarity.ms/collect stream runs from +2337 ms (before the refusal at +122395 ms) and continues after — up to +191845 ms.

Proven: PostHog sends an event before the refusal. eu.i.posthog.com/e/ — at +4667 ms.

Proven: there is no consent mechanism in the application. Across 166 requests there is no request to Cookiebot or any other CMP; the status of all advertising requests is gcs=-.

Proven: the advertising stack in the application transmits data. GA4 page_view, Facebook pixel PageView (response 200), DoubleClick viewthroughconversion, a Google Ads conversion to the account 16939341.

Proven: Clarity is undisclosed. Microsoft Clarity is absent from the cookie declaration.

Not proven, and not reproduced: the content of the recorded sessions. What exactly the Clarity recording captured is not reproduced in the audit; the conclusion rests on the fact of the session-recording request stream before and after the refusal.

Observation boundaries

The capture consists of two recordings — the main site and the application — and records browser behaviour, not the services’ internal workings: server-side processing, the configuration of the tag containers and contracts with recipients are not verified by a browser-level capture. The session-recording tool is identified by the Clarity domains and the character of the /collect stream; the type of decision (action=decline) is read from the Cookiebot request. Cookie values in the published files were removed during redaction. The image networks (S3, beat.no) and the Askly widget are classified as the functional part.

The files are published redacted of personal data. Response headers, statuses, the load order, initiators, the Clarity request stream and the moment of the refusal are verified directly against the published files. Security headers: on the main site HSTS and X-Content-Type-Options nosniff are set (Content-Security-Policy, Referrer-Policy, Permissions-Policy and X-Frame-Options are absent); in the application only the server header is set on the main document — there are no protective headers.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

Conclusion

The country’s largest bookstore spread its tracking across two properties, and both treat the user’s decision carelessly — each in its own way. On the main site the Cookiebot consent platform is present, the user explicitly declines consent, but the Microsoft Clarity session recording carries a stream of data to Microsoft both two minutes before the refusal and after it — the platform does not hold this service, and Clarity itself is not named in the cookie declaration at all. In the application, where the visitor logs in and buys, there is no consent platform whatsoever, and there the full advertising stack fires unconditionally: Google Analytics, the Facebook pixel, Google DoubleClick and Google Ads conversion tracking, all without a consent signal.

The split is telling: the presence of a banner on the storefront does not stop an explicit refusal from being ignored, and on the application property there is no banner at all. Added to this is the weakness of the security headers, especially in the application.

Remediation: condition the Microsoft Clarity session recording and the PostHog product analytics on actual consent, so that under a refusal (action=decline) no recording is performed and no events go out; name Microsoft Clarity in the cookie declaration as a recipient with the purpose stated; deploy a consent management platform in the app.rahvaraamat.ee application and condition the entire advertising stack (GA4, the Facebook pixel, DoubleClick, Google Ads) on it, configuring Google’s consent mode (currently gcs=-); and complete the set of protective headers on both properties, primarily in the application.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/rahvaraamat-ee-2026-09-09.har
SHA-256: 0db26a5b31ee88bf0fe3da36f02ad9045384ab134a4398a827f10737b6621e79
SHA-256: 2cf0af1b0f7c02544b1683622c4a35b610c0e0b5b90254f0896838334593535d
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — rahvaraamat.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website rahvaraamat.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The main site rahvaraamat.ee has the Cookiebot consent management platform installed, and in the recording the user explicitly declined consent: the consent.cookiebot.com/logconsent.ashx request carries action=decline (at +122395 ms, method strict). Nevertheless, the Microsoft Clarity session recording (project rk0m9l1d2i) runs independently of that choice. The stream of POST requests b.clarity.ms/collect begins at +2337 ms — two minutes before the refusal — and continues after it, until the end of the capture at +191845 ms: more than forty requests over three-plus minutes. That is, Clarity records the session both before the choice and after the explicit refusal. The PostHog product analytics sends an event at +4667 ms, also before the refusal. The Cookiebot platform does not gate these two services.

2) The app.rahvaraamat.ee application has no consent management platform at all: across 166 requests there is no request to Cookiebot or any other CMP, and no script with the signs of a banner. Yet at +8612…+9166 ms a full advertising stack fires, all requests with the status gcs=- (Google's consent mode not configured). Google Analytics 4 (G-WT3HBPL13E) sends a page_view; the Facebook / Meta Pixel (ID 1838212177017029) a PageView to facebook.com/tr; Google DoubleClick — ccm/collect and viewthroughconversion; Google Ads conversion tracking — pagead/1p-conversion and ccm/conversion requests to the account 16939341. None of these requests is conditioned on anything: consent is not asked on this subdomain.

3) The cookie declaration on the Cookiebot engine names the recipients: PostHog, Google Analytics, Facebook / Meta, Google Ads, Askly. However, Microsoft Clarity — the session-recording tool that carries a stream of the visitor's behavioural data on the main site — is not mentioned in it at all. The recipient that actually records the user's session and transmits it to Microsoft is undisclosed.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-rahvaraamat-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — rahvaraamat.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website rahvaraamat.ee.

2. Circumstances
I visited the website rahvaraamat.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 9 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The main site rahvaraamat.ee has the Cookiebot consent management platform installed, and in the recording the user explicitly declined consent: the consent.cookiebot.com/logconsent.ashx request carries action=decline (at +122395 ms, method strict). Nevertheless, the Microsoft Clarity session recording (project rk0m9l1d2i) runs independently of that choice. The stream of POST requests b.clarity.ms/collect begins at +2337 ms — two minutes before the refusal — and continues after it, until the end of the capture at +191845 ms: more than forty requests over three-plus minutes. That is, Clarity records the session both before the choice and after the explicit refusal. The PostHog product analytics sends an event at +4667 ms, also before the refusal. The Cookiebot platform does not gate these two services.

2) The app.rahvaraamat.ee application has no consent management platform at all: across 166 requests there is no request to Cookiebot or any other CMP, and no script with the signs of a banner. Yet at +8612…+9166 ms a full advertising stack fires, all requests with the status gcs=- (Google's consent mode not configured). Google Analytics 4 (G-WT3HBPL13E) sends a page_view; the Facebook / Meta Pixel (ID 1838212177017029) a PageView to facebook.com/tr; Google DoubleClick — ccm/collect and viewthroughconversion; Google Ads conversion tracking — pagead/1p-conversion and ccm/conversion requests to the account 16939341. None of these requests is conditioned on anything: consent is not asked on this subdomain.

3) The cookie declaration on the Cookiebot engine names the recipients: PostHog, Google Analytics, Facebook / Meta, Google Ads, Askly. However, Microsoft Clarity — the session-recording tool that carries a stream of the visitor's behavioural data on the main site — is not mentioned in it at all. The recipient that actually records the user's session and transmits it to Microsoft is undisclosed.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-rahvaraamat-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — session recording and analytics before and despite the refusal (main site); ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — an advertising stack without a consent mechanism (application); GDPR Art. 13(1)(e) — an undisclosed recipient (Microsoft Clarity)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]