revalcafe.ee

Context

revalcafe.ee is the website of the Reval Café coffeehouse chain (13 coffeehouses in Tallinn, Viimsi and Tartu). The contact is info@revalcafe.ee, and supervision is named directly in the policy — Andmekaitse Inspektsioon. The site is built on WordPress, Apache/ZoneOS server.

Processing is described by the attached privacy policy (Privaatsuspoliitika, updated 29 April 2025). Attached to the material are a PDF snapshot of the site and five screenshots: the consent banner and the cookie-category settings window.

The measurement consists of one recording, one navigation — the home page. One hundred and two requests, seven nodes. The recording was made on 18 September 2026.

Who data goes to directly

CookieYes (the consent platform), Google (Fonts). The Google tag (GT-577RMJ8) is loaded but transmits no data in the recording. There is no analytics, advertising, social network or RTB in the recording.

Declared versus actual

The Reval Café privacy policy names Google Analytics directly as a tool for analysing traffic (clause 2) and states that consent for cookies is requested on visiting the site, and that optional cookies can be refused (clause 3). The CookieYes settings window (screenshots) lists in its categories cookies for Google Analytics (_ga, _ga_*), Facebook (_fbp) and embedded YouTube video.

The measurement yields a discrepancy in the favourable direction: there is less actual than declared.

The consent platform is present and correctly configured. CookieYes loads at +519 ms (initiated by the page markup). The banner, as seen in the screenshots, offers three buttons — ‘Customise’, ‘Reject all’ and ‘Accept all’, that is, refusal is available on equal footing with consent on the first screen; the categories in the settings window (analytics, performance, unclassified) are off by default. At +4442 ms a log.cookieyes.com/api/v1/consent request occurs — the recording of the user’s choice.

The declared analytics did not fire in the recording. Across 102 requests, not a single request to Google Analytics (no /g/collect or /collect), Facebook, advertising networks or RTB arises. A check of the entire file, including response bodies, yielded no match for these services. The Google tag (GT-577RMJ8) loads from the markup at +522 ms but, across the whole recording, sends no data request — that is, the counter is present in the markup, but no transmission to analytics occurs.

The actual third-party recipients are functional only. CookieYes — the consent platform itself, which calls directory.cookieyes.com/api/v1/ip to determine the IP address for the purpose of recording consent. Google Fonts (fonts.gstatic.com) — the Montserrat font, on the loading of which the visitor’s IP address is visible to Google.

Consent: what is proven and what is not

Proven: a consent-management platform is present and configured with categories off by default. The loading of CookieYes and the banner are legible in the recording and the screenshots; the ‘Reject all’ refusal is available on the first screen on equal footing with consent.

Proven: there are no transmissions to analytics or advertising in the recording. Across 102 requests there is not a single request to Google Analytics, Facebook, advertising networks or RTB; the Google tag transmits no data.

Not proven and not needed: the exact content of the consent record. The body of the api/v1/consent request is redacted in the “lean” file; this is immaterial to the conclusion, since there are no analytics or advertising requests in the recording.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers a single page — the home page. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 114 redactions and a checksum. The response bodies are largely preserved, but the body of the Google tag script (gtag/js) and the body of the consent record are replaced with stubs; the conclusion about the absence of transmissions to analytics rests on the absence of the corresponding network requests, not on parsing the script’s contents. No security headers are observed on the domain’s own responses.

The identification of services relies on domains and address patterns: the consent platform — by cookieyes.com; the Google tag — by googletagmanager.com/gtag/js and the identifier GT-577RMJ8; the fonts — by fonts.googleapis.com and fonts.gstatic.com. The absence of analytics and advertising is established by the absence of requests to google-analytics.com, connect.facebook.net, doubleclick.net, googlesyndication.com and by the absence of measurement identifiers and /collect requests in the traffic.

Conclusion

The Reval Café coffeehouse chain’s website transmits no data to analytics or advertising when browsed. A CookieYes consent-management platform operates on the site, with an equal-weight reject button on the first screen and categories off by default. The Google tag (GT-577RMJ8) is present in the markup and loads immediately, but across the whole recording sends no data request; the Google Analytics and Facebook cookies declared in the cookie table are not activated in the recording. The privacy policy names Google Analytics and promises consent for cookies — that is, the declared is broader than the actual, not the other way round. As a soft caveat it can be noted that the Google tag and the fonts load from the markup before consent (the fonts see the visitor’s IP address), and that the domain itself sets no security headers; there are, in any case, no transmissions to analytics or advertising in the recording that these measures would protect.