RU EN
www.
Technical audit · 29.08.2026

smsraha.ee

Placet Group consumer-loan service
EE

The Estonian Placet Group consumer-loan service under the SMS Raha brand — 428 requests, 5 nodes, a 5-minute recording. There is no consent mechanism on the loan-application site, but the Google Ads conversion tracking and Google Analytics start automatically in the second second: the site transmits to Google's advertising infrastructure the fact of a visit to the loan-application pages with the consent marker gcs=G100, although the user's choice is nowhere recorded. The cookie policy discloses these services and states that marketing is carried out with consent — but there is nowhere on the site to give it.

Request timeline

+0 ms · browser telemetry (not the site)
At the very start of the recording there is one request to browser.events.data.msn.com with the origin ntp.msn.com — telemetry of the start page of the Microsoft Edge browser. It has nothing to do with the smsraha.ee site and does not enter the analysis of its behaviour.
+599 ms · loading the loan page
The page smsraha.ee/sms-laen is opened. Served through nginx. Set: strict transport, the frame-embedding ban SAMEORIGIN and the referrer policy no-referrer. There is no content-security-policy and no permissions policy. The browser was sending the DNT: 1 header.
session state — no consent mechanism
Across 428 requests no request to a consent-management platform, no script bearing the marks of a banner, and no Set-Cookie header was found. The advertising and analytics scripts are initiated by the markup and start before any user choice.
+983 ms · Google Tag Manager
www.googletagmanager.com — the tag loader, initiated by the sms-laen page. Through it the Google Ads conversion tracking and Google Analytics are connected.
+1603 ms · Google Ads conversion tracking
pagead2.googlesyndication.com/pagead/conversion/1020561179 — the conversion tracking of Google Ads advertising campaigns, followed by /ccm/collect. The site transmits to Google's advertising infrastructure the fact of a visit to the loan-application page.
+1614 ms · Google Analytics transmits data
region1.google-analytics.com/g/collect: property G-97RX*, client identifier, the sms-laen page URL, page_view event. The consent-mode marker gcs=G100 — 'consent granted', although the user's choice is nowhere recorded in the recording.
+15753…+305282 ms · navigation across the site
Navigation across the Russian version: sms-kredit, consumer loan, business loan, terms of receipt, payment methods, login. On each page the Google Ads conversions and the Google Analytics page_view go out again with the same gcs=G100 marker.

Declared versus actual

✓ Controller — Placet Group OÜ (SMS Raha brand, smsraha.ee); data-protection specialist dpo@placetgroup.com, info@placet.ee, Ahtri tn 6, Tallinn — declared
✓ The cookie policy (9 pages) names Google Analytics, Google Ads, Google AdSense, Facebook/Meta directly, as well as the cookies _gcl_au (Google Ads, 3 months), _ga_* (2 years), Bing MR — declared
✓ Cookies are used for functionality, statistics and — with your consent — marketing — declared
✓ Consent can be withdrawn; cookie management — through contacting Placet Group OÜ and the data-protection specialist — declared
✓ A separate list of authorised processors: Aktiva Finants (debt collection), Creditinfo Eesti (credit history), DPD, Eesti Post and others — declared
✓ Supervisory authority — the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) — declared
+ There is no consent-obtaining mechanism on the site, although the policy declares marketing 'with your consent' — not declared
+ The Google Ads conversion tracking and Google Analytics start with gcs=G100 before any user choice — not declared
+ Transmission of the fact of a visit to the loan-application pages to Google's advertising infrastructure before consent — not declared

Transfer timings

+983 ms www.googletagmanager.com

Google Tag Manager, 50 requests.

+1603 ms pagead2.googlesyndication.com

Google Ads conversions AW-1020561179, the fact of a visit to the loan page.

+1614 ms region1.google-analytics.com

GA4 G-97RX*, client identifier, page_view, gcs=G100.

+0 ms browser.events.data.msn.com

Origin ntp.msn.com — the Microsoft Edge start page, outside smsraha.ee behaviour.

Detected trackers

Indicators of GDPR non-compliance

Context

smsraha.ee is the site of a consumer-loan service operating under the SMS Raha brand. The controller is Placet Group OÜ, an Estonian licensed credit provider; the data-protection specialist is dpo@placetgroup.com. The site is served through nginx; the content is in Estonian and Russian. An extensive set of contractual documents is attached to the materials: the credit provider’s licence, pre-contractual information on consumer loans, the credit card and the credit account, price lists, campaign terms, and three documents on data processing — the cookie policy, the principles of client-data processing, and the list of recipients and authorised processors.

The recording: 428 requests, 5 nodes, a recording length of 310 seconds (about five minutes), taken on 29 August 2026. Besides the main domain, the site addresses three Google nodes — Tag Manager, the Google Ads conversion tracking (pagead2.googlesyndication.com) and Google Analytics — and one request of Microsoft browser telemetry not related to the site. The session runs across the loan-application pages and the site’s sections on the Russian version.

The processing of the site side is described by three Placet Group OÜ documents: the cookie policy, the principles of client-data processing, and the list of recipients and authorised processors.

Who receives data directly

Google (Ads conversions, Tag Manager, Analytics).

Declared versus actual

The cookie policy discloses the trackers — and this should be noted. The nine-page document names Google Analytics, Google Ads, Google AdSense and Facebook/Meta directly, and lists specific cookies with their purpose and duration: _gcl_au (Google Ads, three months), _ga_* (Google Analytics, two years), MR (Bing). That is, the composition of advertising and analytics technologies is declared honestly. The policy also states that marketing processing is carried out “with your consent”, that consent can be withdrawn, and that for cookie-management matters one should contact Placet Group OÜ or the data-protection specialist.

But there is no consent-obtaining mechanism on the site. Here the declared diverges from the actual. Across 428 requests neither a consent-management platform nor a banner, nor a single Set-Cookie header, was found. The policy reduces cookie management to contacting the company by email — that is, there is no built-in way to give or withdraw consent on the site. Meanwhile Google Tag Manager starts at +983 ms, the Google Ads conversion tracking at +1603 ms, and Google Analytics sends page_view with the gcs=G100 marker at +1614 ms. The G100 marker means “consent granted”, but it is set before and irrespective of any user choice. Marketing is carried out not “with your consent”, as declared, but by default.

Advertising tracking on a loan service transmits the fact of the visit to Google. The requests to pagead2.googlesyndication.com/pagead/conversion/1020561179 are the conversion tracking of Google Ads advertising campaigns. The site tells Google’s advertising infrastructure that the visitor has entered the loan-application page (/sms-laen, /ru/sms-kredit). For a consumer-lending service — an area with a vulnerable audience — transmitting information about the intention to take out a loan to an advertising platform before consent is especially sensitive.

Security headers are set in part. The site sets strict transport, the frame-embedding ban SAMEORIGIN and the referrer policy no-referrer — the latter limits the leakage of page addresses into external requests. But there is no content-security-policy and no permissions policy. On a site loading third-party advertising and analytics code, the absence of a content-security-policy means that the list of trusted script sources is in no way restricted.

Proven: there is no consent-obtaining mechanism on the site. Across 428 requests there is not a single request to a consent-management platform and not a single script bearing the marks of a banner. The names of known platforms and general markers in addresses and initiators were checked; zero matches.

Proven: the advertising and analytics tracking starts before the user’s choice. Google Tag Manager (+983 ms), the Google Ads conversions (+1603 ms) and Google Analytics (+1614 ms) are initiated by the markup of the loan-application page and run when the browser parses it.

Proven: data goes out with a granted-consent marker. The Google Analytics requests carry gcs=G100 and the client identifier; the Google Ads conversions transmit the fact of a visit to the loan page.

Not proven and not unambiguously established: the origin of the consent marker. The gcs=G100 marker could have been set either as a default value in the consent-mode configuration or as a saved choice from an earlier visit. Response bodies and cookie headers were removed from the published file during sanitisation, so the source of the marker cannot be reconstructed from the recording. What is recorded is that, in the observed session, the data went out with a granted-consent marker, whereas there is no mechanism for obtaining this consent on the site.

Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation.

Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.

Boundaries of observation

The recording covers the loan-application pages and the site’s sections. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

The request to browser.events.data.msn.com relates to the telemetry of the start page of the Microsoft Edge browser (origin ntp.msn.com), not to the smsraha.ee site, and does not enter the analysis of the site’s behaviour; it is listed only for the completeness of the recording. The authorised processors from the attached list (Aktiva Finants, Creditinfo Eesti, DPD, Eesti Post and others) relate to the contractual processing of client data in issuing and servicing loans and do not appear in the browser recording; they have nothing to do with web tracking.

The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that there is no consent mechanism rests on the absence of requests to consent platforms and of scripts bearing their marks. The full client identifier is not reproduced in the analysis.

The identification of services rests on domains and address patterns: Google Ads conversions — by googlesyndication.com/pagead/conversion and the identifier AW-1020561179; Google Analytics 4 — by google-analytics.com/g/collect and the property G-97RX*; Google Tag Manager — by googletagmanager.com; the serving provider — by the server: nginx header.

Conclusion

The site of the Placet Group consumer-loan service under the SMS Raha brand starts the Google Ads conversion tracking and Google Analytics automatically, in the second second of the visit, without any consent mechanism. The site transmits to Google’s advertising infrastructure the fact of a visit to the loan-application pages with a granted-consent marker gcs=G100, whereas the user’s choice is nowhere recorded and there is no way to give or withdraw consent on the site.

At the same time, the cookie policy discloses Google Analytics, Google Ads, AdSense and Facebook/Meta with specific cookies and durations, and states outright that marketing is carried out “with your consent”. It is precisely this that makes the discrepancy distinct: the declared consent condition is not fulfilled in practice. For a consumer-lending service working with a vulnerable audience and financial data, transmitting information about the intention to take out a loan to an advertising platform before consent carries particular weight. Of the security headers, a content-security-policy and a permissions policy are absent.

Remediation: introduce a consent-management mechanism that actually blocks the Google Ads conversion tracking, Google Analytics and other marketing scripts until explicit consent is obtained, with the consent-mode state set to “denied” by default; bring the actual behaviour into line with the cookie policy’s declared condition of “with your consent”; provide a way to give and withdraw consent on the site itself, not only through contacting the company; set a content-security-policy and a permissions policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/smsraha-ee-2026-08-29.har
SHA-256: 17194d0cb041fba6d11da9046f77274496828b2554869b04f29c20069503336a
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — smsraha.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website smsraha.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) There is no consent-obtaining mechanism on the consumer-loan site: across 428 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. Meanwhile Google Tag Manager starts at +983 ms, the Google Ads conversion tracking (AW-1020561179) at +1603 ms, and Google Analytics 4 sends a page_view with the client identifier and the consent-mode marker gcs=G100 at +1614 ms — that is, with a 'consent granted' state without any user choice. The cookie policy states outright that marketing processing is carried out 'with your consent', but there is no actual mechanism for obtaining it on the site.

2) The service belongs to consumer lending — an area with heightened data sensitivity and a vulnerable audience. The Google Ads conversion tracking transmits to Google's advertising infrastructure the fact of a visit to the loan-application pages (/sms-laen, /ru/sms-kredit) before any consent. Transmitting information about the intention to take out a loan to an advertising platform without valid consent is disproportionate and does not match the policy's declared condition of 'with your consent'.

3) Of the security headers the site sets strict transport, the frame-embedding ban SAMEORIGIN and the referrer policy no-referrer, but there is no content-security-policy and no permissions policy. For a site processing loan applications and loading third-party advertising and analytics code, the absence of a content-security-policy means that the list of trusted script sources is in no way restricted.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-smsraha-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — smsraha.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website smsraha.ee.

2. Circumstances
I visited the website smsraha.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 August 2026 (open methodology, reproducible measurements) documents the following indications:

1) There is no consent-obtaining mechanism on the consumer-loan site: across 428 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. Meanwhile Google Tag Manager starts at +983 ms, the Google Ads conversion tracking (AW-1020561179) at +1603 ms, and Google Analytics 4 sends a page_view with the client identifier and the consent-mode marker gcs=G100 at +1614 ms — that is, with a 'consent granted' state without any user choice. The cookie policy states outright that marketing processing is carried out 'with your consent', but there is no actual mechanism for obtaining it on the site.

2) The service belongs to consumer lending — an area with heightened data sensitivity and a vulnerable audience. The Google Ads conversion tracking transmits to Google's advertising infrastructure the fact of a visit to the loan-application pages (/sms-laen, /ru/sms-kredit) before any consent. Transmitting information about the intention to take out a loan to an advertising platform without valid consent is disproportionate and does not match the policy's declared condition of 'with your consent'.

3) Of the security headers the site sets strict transport, the frame-embedding ban SAMEORIGIN and the referrer policy no-referrer, but there is no content-security-policy and no permissions policy. For a site processing loan applications and loading third-party advertising and analytics code, the absence of a content-security-policy means that the list of trusted script sources is in no way restricted.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-smsraha-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 5(1)(a), 6, 7 — lawfulness and consent for advertising tracking on a financial service; GDPR Art. 32 — security measures

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]