snabb.xyz
The website of Estonian parking and car-wash operator Snabb — one capture, four pages, 420 requests. There is no cookie banner, and Google consent mode is not configured. Google Analytics 4 creates an identifier on the very first visit and sends a page view 1.7 seconds later, while the same identifier simultaneously goes to Google's advertising endpoints. The policy, meanwhile, names two legal bases at once for cookies and analytics — consent and legitimate interest. It does not specify which one applies, and it offers no way to give or withdraw consent for cookies.
Request timeline
Declared versus actual
Transfer timings
gtag.js for G-KD6CRDCHX6; followed by the GTM-T44FH5ND container at +624 ms.
Google Maps for the parking map; 60 requests over the capture.
page_view, client identifier, first-visit markers; consent mode not set.
Google advertising endpoint, the same client identifier, npa=1.
ads/ga-audiences, the same client identifier; repeats on pages 2 and 4.
A scroll event on the parking page.
Detected trackers
- Google Analytics 4 (G-KD6CRDCHX6) via region1.analytics.google.com — page views and scroll events on all four pages; consent mode not configured
- Google Tag Manager (GTM-T44FH5ND, www.googletagmanager.com) — tag container, loaded on every page
- Google advertising endpoints (stats.g.doubleclick.net, www.google.ee/ads/ga-audiences) — receive the same client identifier alongside the analytics, with the npa=1 flag
- Google Maps (maps.googleapis.com — 60, maps.gstatic.com — 11) — the parking map on the homepage and the parking page
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) and Google Hosted Libraries (ajax.googleapis.com) — fonts and jQuery for the map
- BootstrapCDN (maxcdn.bootstrapcdn.com) — Bootstrap styles and scripts for the map
- First party and infrastructure: snabb.xyz (WordPress behind LiteSpeed), admin.barking.ee (the same company's former name — map and parking list), barking-public.ams3.digitaloceanspaces.com (DigitalOcean storage, parking icons)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — Google analytics before any consentThe site has no consent mechanism. There is no banner on the homepage's first screen. Across 420 requests, there is not a single request to a consent-management platform and not a single Set-Cookie header. Google consent mode is not configured: the gcd parameter in every request carries no set consent state. Meanwhile, Google Analytics 4 (G-KD6CRDCHX6) loads at +342 ms. The client identifier is created on the very first visit — two seconds after entry, with first-visit markers. At +1739 ms, a page_view fires. Simultaneously, at +1740 and +1743 ms, the same identifier goes to Google's advertising endpoints stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. The transmission repeats on all four pages viewed, including scroll events. The policy itself names consent as one of the legal bases for cookies and web analytics.
- GDPR Art. 13(1)(c) / Art. 5(1)(a) — an indeterminate legal basis and an incompletely described purpose for processing web dataThe table in section 3.1 lists two legal bases at once for the row 'cookies, web analytics and user-experience improvement' — consent (Art. 6(1)(a)) and legitimate interest (Art. 6(1)(f)). It does not say which basis applies to which part of the processing. A visitor cannot tell whether their consent is being sought or whether processing happens without it; in fact, consent is not requested at all. Section 3.3 describes withdrawal of consent only for direct marketing — via the contact address or an unsubscribe link; no such tool exists for cookies. Furthermore, the purpose is described as analytics and site improvement, yet requests also go to Google's advertising endpoints — stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. The policy says nothing about transmission to Google's advertising infrastructure. The npa=1 flag in these requests marks ad personalization as disallowed, but that does not undo the fact that the identifier is transmitted to advertising endpoints.
Context
snabb.xyz is the website of Snabb OÜ (registration code 12801774, Tallinn, Veerenni tn 40a). The company runs a mobile app for paying for parking, car washes, and vehicle charging, and operates its own network of car parks. The company was formerly called Barking OÜ, which is why part of the site’s infrastructure still runs on the barking.ee domain. That is the first party, not a third-party recipient. The site is built on WordPress with the Elementor page builder and the WPML multilingual module, and is served by LiteSpeed. The Content-Security-Policy header contains only the https-upgrade directive and reveals no hidden dependencies.
The measurement is a single capture of four consecutive pages: the homepage, the parking page, the terms-of-use section, and the privacy policy itself. In total, 420 requests to 14 hosts. Of these, 10 requests to edge.microsoft.com are the browser’s built-in translator (Estonian → Russian); they have nothing to do with the site and are excluded from the review. The homepage accounts for 161 requests to 13 hosts.
Processing is described by the Estonian-language document “Privaatsuspõhimõtted”, which was opened during the capture itself.
Who receives data directly
Google: Analytics and Tag Manager, the doubleclick and ga-audiences advertising endpoints, Maps, Fonts, Hosted Libraries. Also BootstrapCDN. First party — the site, the map host admin.barking.ee, and the icon storage on DigitalOcean (Amsterdam).
Declared versus actual
The policy is short and does mention Google Analytics honestly — in section 3.1, in the row on cookies, web analytics, and user-experience improvement. The same row states a retention period of up to six months for analytics data. The discrepancy is not that analytics is hidden, but in how it runs and on what basis.
First — analytics starts without any choice. There is no cookie banner on the site: the homepage’s first screen opens straight away, with no request for consent. Across the entire capture, there is not a single request to a consent-management platform. Google consent mode is not configured either: the gcd service parameter in every request shows that no consent state is set, and the gcs parameter is absent altogether. The Google tag loads at +342 ms, the Tag Manager container at +624 ms. At +1739 ms, the first page view fires, carrying the client identifier, the page address and title, the screen resolution, the platform, and the browser language. The identifier was created in this same session — two seconds after entry — and the requests carry first-visit markers. In other words, the visitor’s device is tagged on the very first opening of the site, before they have made any decision at all.
Second — along with the analytics, the identifier goes to Google’s advertising endpoints. One and four milliseconds after the first page view, the same client identifier is sent to stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. This is the infrastructure of Google’s advertising features: it is how Google Analytics collects data for audiences. The requests to ga-audiences repeat on the parking page and on the policy page. The requests carry the npa=1 flag, meaning ad personalization is marked as disallowed. But the policy describes the purpose of processing only as analytics and site improvement — it says nothing about transmission to advertising infrastructure.
Third — two legal bases at once and no consent tool. For cookies and analytics, the policy lists consent and legitimate interest simultaneously, without explaining which applies to what. As a result, a visitor cannot tell whether they are supposed to permit anything. In practice, nothing is asked at all. Section 3.3 describes withdrawal of consent — but only for direct marketing, by writing to the contact address or clicking an unsubscribe link. No such mechanism exists for cookies: the consent the policy refers to can be neither given nor withdrawn.
Separately, on the parking map. It is embedded in the homepage and the parking page, is built on Google Maps, and generates 71 requests to map hosts over the capture. Alongside it, Google fonts, jQuery from Google Hosted Libraries, and Bootstrap from BootstrapCDN are loaded. All of this loads without any choice by the visitor, and each of these hosts receives the visitor’s IP address. None of them is named in the policy. The recipient list in section 5.2 is given by category, and “IT support, hosting and software providers” formally covers them, so this is not recorded as a separate violation.
Consent: what is proven and what is not
Proven: the site has no consent mechanism. The screenshot of the homepage’s first screen shows no banner. The network requests contain no consent-management platform. No server response sets a Set-Cookie header.
Proven: Google consent mode is not configured. The gcd parameter in all ten requests to Google shows unset consent states, and there is no gcs parameter.
Proven: the identifier was created on the first visit. The timestamp within it is 18:46:26 UTC; entry to the site was at 18:46:24 UTC. The requests carry first-visit and first-session markers. The identifier is the same across all four pages.
Proven: the same identifier goes to Google’s advertising endpoints. stats.g.doubleclick.net — once, www.google.ee/ads/ga-audiences — three times, with the npa=1 and aip=1 flags.
Not proven: the analytics property’s settings. The bodies of Google’s scripts and the page markup were removed from the published file. So which advertising features are enabled in the property cannot be read from the file. The finding rests on the requests to the advertising endpoints themselves.
Not verified: cookie lifetime. Cookie headers in requests were removed during cleaning, so compliance with the stated six months cannot be established by a browser-based measurement.
Boundaries of this observation
The measurement covers four pages of the public website. The Snabb app and the driver’s personal account were not examined. The observation records browser behavior, not server-side processing: what Google does with the data it receives, and how the analytics property is configured, are not verified by a browser-based measurement.
The review rests on the Estonian document “Privaatsuspõhimõtted”, which was opened during the capture. The English version of the site hosts a separate document for the Snabb platform, listing a different company address. Automated reading of that page is blocked by the site’s rules, so it is not included in the comparison.
The host admin.barking.ee is classified as first party: it is the same company’s former name. The storage barking-public.ams3.digitaloceanspaces.com serves parking icons and is classified as hosting. Requests to edge.microsoft.com are the browser’s built-in translator, not part of the site.
The file has been published cleaned: Cookie headers, page markup, and script bodies were removed. The client identifier is not reproduced in this review. Its creation within the session and its consistency across pages are established from the requests to Google themselves.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in section 6.1.7 of the policy itself.
Conclusion
The parking operator’s website switches on Google Analytics on the very first visit, with no banner and no configured consent mode. The device is tagged with an identifier two seconds after entry, and the same identifier simultaneously goes to Google’s advertising endpoints. The transmission continues on every subsequent page, including scroll events.
The policy, meanwhile, does not hide Google Analytics, but it makes consent unattainable. It names consent as one of two bases for cookies, does not specify which basis applies, and provides no way to give or withdraw consent. From the policy, a visitor does not learn that their identifier is transmitted to Google’s advertising infrastructure.
Remedy: do not load Google Analytics and Tag Manager before the visitor’s consent; introduce a banner with an equally prominent refuse button and configure Google consent mode with a default of denied; choose a single basis for analytics — consent — and state it plainly in the policy; give visitors a tool to withdraw consent for cookies as easily as they gave it; disable the analytics property’s advertising features, or describe them in the policy as a separate purpose; name Google (Analytics, Tag Manager, Maps, Fonts) and BootstrapCDN.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
fb6520766a60fc27079c505725e27196761fc59d816c4c7fb7a4f91f5e4a1f04
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — snabb.xyz Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта snabb.xyz. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Механизма согласия на сайте нет. На первом экране главной баннера нет. За 420 запросов нет ни одного обращения к платформе управления согласием и ни одного заголовка Set-Cookie. Режим согласия Google не настроен: параметр gcd во всех обращениях не содержит ни одного заданного состояния согласия. При этом Google Analytics 4 (G-KD6CRDCHX6) грузится на +342 мс. Идентификатор клиента создаётся при первом же открытии — через две секунды после входа, с признаками первого визита. На +1739 мс уходит page_view. Одновременно, на +1740 и +1743 мс, тот же идентификатор уходит на рекламные узлы Google stats.g.doubleclick.net и www.google.ee/ads/ga-audiences. Передача повторяется на всех четырёх просмотренных страницах, включая события прокрутки. Сама политика называет согласие одним из оснований для cookie и веб-аналитики. 2) В таблице пункта 3.1 для строки «cookie, веб-аналитика и улучшение пользовательского опыта» указаны сразу два основания — согласие (ст. 6(1)(a)) и законный интерес (ст. 6(1)(f)). Какое из них к какой части обработки относится, не сказано. Посетитель не может понять, спрашивают ли его согласие или обработка идёт без него; фактически согласие не запрашивается вовсе. Способ отзыва согласия в пункте 3.3 описан только для прямого маркетинга — через контакт или ссылку отказа от рассылки; для cookie такого инструмента нет. Кроме того, цель описана как аналитика и улучшение сайта, а обращения уходят и на рекламные узлы Google — stats.g.doubleclick.net и www.google.ee/ads/ga-audiences. О передаче в рекламную инфраструктуру Google политика не сообщает. Флаг npa=1 в этих обращениях помечает запрет персонализации рекламы, но сам факт передачи идентификатора на рекламные узлы от этого не исчезает. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-snabb-xyz/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — snabb.xyz To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website snabb.xyz. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The site has no consent mechanism. There is no banner on the homepage's first screen. Across 420 requests, there is not a single request to a consent-management platform and not a single Set-Cookie header. Google consent mode is not configured: the gcd parameter in every request carries no set consent state. Meanwhile, Google Analytics 4 (G-KD6CRDCHX6) loads at +342 ms. The client identifier is created on the very first visit — two seconds after entry, with first-visit markers. At +1739 ms, a page_view fires. Simultaneously, at +1740 and +1743 ms, the same identifier goes to Google's advertising endpoints stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. The transmission repeats on all four pages viewed, including scroll events. The policy itself names consent as one of the legal bases for cookies and web analytics. 2) The table in section 3.1 lists two legal bases at once for the row 'cookies, web analytics and user-experience improvement' — consent (Art. 6(1)(a)) and legitimate interest (Art. 6(1)(f)). It does not say which basis applies to which part of the processing. A visitor cannot tell whether their consent is being sought or whether processing happens without it; in fact, consent is not requested at all. Section 3.3 describes withdrawal of consent only for direct marketing — via the contact address or an unsubscribe link; no such tool exists for cookies. Furthermore, the purpose is described as analytics and site improvement, yet requests also go to Google's advertising endpoints — stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. The policy says nothing about transmission to Google's advertising infrastructure. The npa=1 flag in these requests marks ad personalization as disallowed, but that does not undo the fact that the identifier is transmitted to advertising endpoints. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-snabb-xyz/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — snabb.xyz Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi snabb.xyz kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Veebilehel puudub nõusoleku mehhanism. Avalehe esimesel vaatel küpsisebännerit ei ole. 420 päringu hulgas ei ole ühtegi pöördumist nõusolekuhaldusplatvormi poole ega ühtegi Set-Cookie päist. Google'i nõusolekurežiim ei ole seadistatud: parameeter gcd ei sisalda üheski päringus ühtegi määratud nõusolekuolekut. Samal ajal laaditakse Google Analytics 4 (G-KD6CRDCHX6) +342 ms juures. Kliendi identifikaator luuakse kohe esimesel avamisel – kaks sekundit pärast lehele sisenemist, esmakülastuse tunnustega. +1739 ms juures saadetakse sündmus page_view. Samaaegselt, +1740 ja +1743 ms juures, saadetakse sama identifikaator Google'i reklaamiserveritele stats.g.doubleclick.net ja www.google.ee/ads/ga-audiences. Edastamine kordub kõigil neljal vaadatud lehel, sh kerimissündmustega. Privaatsuspõhimõtted ise nimetavad küpsiste ja veebianalüütika ühe õigusliku alusena nõusolekut. 2) Punkti 3.1 tabelis on real „Küpsised, veebianalüütika ja kasutajakogemuse parandamine“ märgitud korraga kaks õiguslikku alust – nõusolek (art 6 lg 1 p a) ja õigustatud huvi (art 6 lg 1 p f). Millise töötlemise osa suhtes kumba kohaldatakse, ei ole täpsustatud. Külastaja ei saa aru, kas temalt küsitakse nõusolekut või toimub töötlemine ilma selleta; tegelikkuses nõusolekut ei küsita üldse. Punkt 3.3 kirjeldab nõusoleku tagasivõtmise viisi üksnes otseturunduse puhul – kontaktaadressi või loobumislingi kaudu; küpsiste jaoks selline vahend puudub. Lisaks on eesmärk kirjeldatud kui analüütika ja veebilehe parandamine, kuid päringud saadetakse ka Google'i reklaamiserveritele stats.g.doubleclick.net ja www.google.ee/ads/ga-audiences. Andmete edastamisest Google'i reklaamitaristusse privaatsuspõhimõtted ei teavita. Nendes päringutes olev tunnus npa=1 märgib, et reklaami isikupärastamine ei ole lubatud, kuid identifikaatori edastamise fakt reklaamiserveritele sellest ei kao. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-snabb-xyz/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — snabb.xyz 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом snabb.xyz. 2. Обстоятельства Я посетил сайт snabb.xyz и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 27.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Механизма согласия на сайте нет. На первом экране главной баннера нет. За 420 запросов нет ни одного обращения к платформе управления согласием и ни одного заголовка Set-Cookie. Режим согласия Google не настроен: параметр gcd во всех обращениях не содержит ни одного заданного состояния согласия. При этом Google Analytics 4 (G-KD6CRDCHX6) грузится на +342 мс. Идентификатор клиента создаётся при первом же открытии — через две секунды после входа, с признаками первого визита. На +1739 мс уходит page_view. Одновременно, на +1740 и +1743 мс, тот же идентификатор уходит на рекламные узлы Google stats.g.doubleclick.net и www.google.ee/ads/ga-audiences. Передача повторяется на всех четырёх просмотренных страницах, включая события прокрутки. Сама политика называет согласие одним из оснований для cookie и веб-аналитики. 2) В таблице пункта 3.1 для строки «cookie, веб-аналитика и улучшение пользовательского опыта» указаны сразу два основания — согласие (ст. 6(1)(a)) и законный интерес (ст. 6(1)(f)). Какое из них к какой части обработки относится, не сказано. Посетитель не может понять, спрашивают ли его согласие или обработка идёт без него; фактически согласие не запрашивается вовсе. Способ отзыва согласия в пункте 3.3 описан только для прямого маркетинга — через контакт или ссылку отказа от рассылки; для cookie такого инструмента нет. Кроме того, цель описана как аналитика и улучшение сайта, а обращения уходят и на рекламные узлы Google — stats.g.doubleclick.net и www.google.ee/ads/ga-audiences. О передаче в рекламную инфраструктуру Google политика не сообщает. Флаг npa=1 в этих обращениях помечает запрет персонализации рекламы, но сам факт передачи идентификатора на рекламные узлы от этого не исчезает. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-snabb-xyz/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — аналитика Google до какого-либо согласия; GDPR Art. 13(1)(c) / Art. 5(1)(a) — неопределённое основание и неполно описанная цель обработки веб-данных 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — snabb.xyz 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website snabb.xyz. 2. Circumstances I visited the website snabb.xyz and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 27 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The site has no consent mechanism. There is no banner on the homepage's first screen. Across 420 requests, there is not a single request to a consent-management platform and not a single Set-Cookie header. Google consent mode is not configured: the gcd parameter in every request carries no set consent state. Meanwhile, Google Analytics 4 (G-KD6CRDCHX6) loads at +342 ms. The client identifier is created on the very first visit — two seconds after entry, with first-visit markers. At +1739 ms, a page_view fires. Simultaneously, at +1740 and +1743 ms, the same identifier goes to Google's advertising endpoints stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. The transmission repeats on all four pages viewed, including scroll events. The policy itself names consent as one of the legal bases for cookies and web analytics. 2) The table in section 3.1 lists two legal bases at once for the row 'cookies, web analytics and user-experience improvement' — consent (Art. 6(1)(a)) and legitimate interest (Art. 6(1)(f)). It does not say which basis applies to which part of the processing. A visitor cannot tell whether their consent is being sought or whether processing happens without it; in fact, consent is not requested at all. Section 3.3 describes withdrawal of consent only for direct marketing — via the contact address or an unsubscribe link; no such tool exists for cookies. Furthermore, the purpose is described as analytics and site improvement, yet requests also go to Google's advertising endpoints — stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. The policy says nothing about transmission to Google's advertising infrastructure. The npa=1 flag in these requests marks ad personalization as disallowed, but that does not undo the fact that the identifier is transmitted to advertising endpoints. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-snabb-xyz/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — Google analytics before any consent; GDPR Art. 13(1)(c) / Art. 5(1)(a) — an indeterminate legal basis and an incompletely described purpose for processing web data 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil snabb.xyz. 2. Asjaolud Külastasin veebisaiti snabb.xyz ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 27.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Veebilehel puudub nõusoleku mehhanism. Avalehe esimesel vaatel küpsisebännerit ei ole. 420 päringu hulgas ei ole ühtegi pöördumist nõusolekuhaldusplatvormi poole ega ühtegi Set-Cookie päist. Google'i nõusolekurežiim ei ole seadistatud: parameeter gcd ei sisalda üheski päringus ühtegi määratud nõusolekuolekut. Samal ajal laaditakse Google Analytics 4 (G-KD6CRDCHX6) +342 ms juures. Kliendi identifikaator luuakse kohe esimesel avamisel – kaks sekundit pärast lehele sisenemist, esmakülastuse tunnustega. +1739 ms juures saadetakse sündmus page_view. Samaaegselt, +1740 ja +1743 ms juures, saadetakse sama identifikaator Google'i reklaamiserveritele stats.g.doubleclick.net ja www.google.ee/ads/ga-audiences. Edastamine kordub kõigil neljal vaadatud lehel, sh kerimissündmustega. Privaatsuspõhimõtted ise nimetavad küpsiste ja veebianalüütika ühe õigusliku alusena nõusolekut. 2) Punkti 3.1 tabelis on real „Küpsised, veebianalüütika ja kasutajakogemuse parandamine“ märgitud korraga kaks õiguslikku alust – nõusolek (art 6 lg 1 p a) ja õigustatud huvi (art 6 lg 1 p f). Millise töötlemise osa suhtes kumba kohaldatakse, ei ole täpsustatud. Külastaja ei saa aru, kas temalt küsitakse nõusolekut või toimub töötlemine ilma selleta; tegelikkuses nõusolekut ei küsita üldse. Punkt 3.3 kirjeldab nõusoleku tagasivõtmise viisi üksnes otseturunduse puhul – kontaktaadressi või loobumislingi kaudu; küpsiste jaoks selline vahend puudub. Lisaks on eesmärk kirjeldatud kui analüütika ja veebilehe parandamine, kuid päringud saadetakse ka Google'i reklaamiserveritele stats.g.doubleclick.net ja www.google.ee/ads/ga-audiences. Andmete edastamisest Google'i reklaamitaristusse privaatsuspõhimõtted ei teavita. Nendes päringutes olev tunnus npa=1 märgib, et reklaami isikupärastamine ei ole lubatud, kuid identifikaatori edastamise fakt reklaamiserveritele sellest ei kao. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-snabb-xyz/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — Google'i analüütika enne mis tahes nõusolekut; IKÜM art 13 lg 1 p c / art 5 lg 1 p a — veebiandmete töötlemise ebamäärane õiguslik alus ja puudulikult kirjeldatud eesmärk 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]