The site of the professional-tools and equipment chain Stokker — a single capture of the homepage, 71 requests, 11 nodes. The cookie banner offers no direct refusal on the first screen: only «Customise» and «Agree», with refusal offered via browser settings. In the settings panel all categories are pre-ticked as on — including advertising with remarketing and the transfer of personal data. Meanwhile the GA4 and Google Ads requests in the capture carry status gcs=G100 (denial respected technically) — that is, the UI shows «on», while consent mode keeps the denial until «Agree» is pressed. Google Ads and the Salesforce platform (chat) are not named in the policy.
Request timeline
Declared versus actual
Transfer timings
ccm/collect, gcs=G100; not named in the policy.
GA4 page_view, gcs=G100.
Salesforce Embedded Service; functional, not named in the policy.
Detected trackers
- Google Analytics 4 (region1.google-analytics.com) — analytics; the page_view and scroll events carry status gcs=G100 (both storages denied), cookieless. Run throughout the session (until +254845 ms). Named in the policy (_ga)
- Google Ads / Conversion (pagead2.googlesyndication.com/ccm/collect) — advertising and conversion measurement; requests at +802…+1250 ms with status gcs=G100. NOT named in the policy by name (only Facebook and Google Analytics are mentioned)
- Google Tag Manager (www.googletagmanager.com) — tag container; +390 ms
- Salesforce Embedded Service (stokker.my.site.com, stokker.my.salesforce-scrt.com, api.stokker.com) — support chat/service; loads actively (17 requests, embeddedservice, businesshours). Functional, but not named in the policy
- First party and infrastructure: stokker.ee, media.stokker.com (images), fonts.googleapis.com
- Capture-tool artefact: edge.microsoft.com/translate — the browser translation feature, not a site component
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — no direct refusal, categories pre-ticked, consent by continued browsingThe cookie banner offers no direct refusal on the first screen: only «Kohanda» (customise) and «Nõustun» (agree), and the text offers refusal only via browser settings («Küpsistest loobumiseks muutke oma seadme veebilehitseja seadistusi») and treats continuation as consent («Jätkamisega nõustute»). This is an implied-consent model without an equivalent refusal button. Worse, in the «Küpsiste eelistused» settings panel all categories are PRE-SET to on (boxes ticked): Analüütika (analytics), Reklaami/Personaliseerimine (advertising — with an explicit mention of remarketing and isikuandmete saatmine, «transfer of personal data»), Funktsionaalsus. Pre-ticked consent to advertising does not constitute valid consent under the GDPR (the Planet49 ruling). Separately noted is a technical discrepancy: despite the pre-ticked boxes in the UI, the GA4 and Google Ads requests in this capture carry status gcs=G100 (both storages denied) — that is, before «Nõustun» is pressed consent mode keeps the denial, and the pre-ticking in the UI has not yet led to a granted state. But the pre-ticking of the advertising category itself and the absence of a direct refusal button is a violation at the level of the consent mechanism.
- GDPR Art. 13(1)(e) — some recipients not disclosed (Google Ads, Salesforce)The privacy policy (Stokker AS, reg. 10165452) names Google Analytics (_ga) and Facebook (for showing advertising). However, Google Ads/DoubleClick (pagead2.googlesyndication.com/ccm/collect), which loads actively in the capture as an advertising component, is not named by name; only a general «advertising on Facebook» is named. The Salesforce platform (support chat, stokker.my.site.com), which loads actively, is also not named. The visitor sees Google Analytics and Facebook in the policy, but not Google Ads and not Salesforce.
Context
stokker.ee is the site of Stokker AS (reg. code 10165452, Peterburi tee 44/4, Tallinn), a chain of professional tools, machinery and equipment (construction, agriculture; 35 years on the Baltic market). The processing is described by a privacy policy; there is no separate consent-management platform (CMP) in the capture — the banner is implemented by an in-house script.
The capture is a single recording of the homepage: 71 requests, 11 nodes.
Who data goes to directly
Google Analytics 4 and Google Ads (both under denial, gcs=G100, cookieless). Salesforce Embedded Service (support chat, loads actively). Functionally — images, fonts. The first party is Stokker’s infrastructure. The requests to edge.microsoft.com/translate are a capture-tool artefact (translation in the browser).
Declared versus actual
The discrepancy here is at the level of the consent mechanism, and it is twofold — plus a partial non-disclosure.
No direct refusal, consent by continued browsing. The banner «Stokkeri veebilehel kasutatakse küpsiseid. Jätkamisega nõustute küpsiste kasutamisega» offers only two buttons — «Kohanda» (customise) and «Nõustun» (agree). There is no direct «reject» button on the first screen; refusal is offered only via browser settings. This is an implied-consent model without an equivalent refusal, which the EDPB does not consider valid consent.
Categories are pre-ticked. In the «Küpsiste eelistused» panel all categories are PRE-SET to on (boxes ticked): Analüütika (analytics), Reklaami/Personaliseerimine (advertising and personalisation — with an explicit mention of remarketing and isikuandmete saatmine, the transfer of personal data), Funktsionaalsus. Pre-ticked consent to advertising does not constitute valid consent under the Planet49 ruling — the boxes should be unticked by default, and the user ticks them themselves.
But the technology and the UI diverge. Here is an important nuance: despite the pre-ticked boxes in the interface, the GA4 and Google Ads requests in this capture carry status gcs=G100 — both storages denied, cookieless. That is, before «Nõustun» is pressed Google’s consent mode keeps the denial, and the pre-ticking in the UI has not yet led to a granted state. This is to the site’s credit at the technical level (the data is under denial), but it does not cancel the violation at the level of the mechanism: the user is shown pre-ticked advertising boxes and given no direct refusal button.
And some recipients are not disclosed. The policy names Google Analytics (_ga) and Facebook (for showing advertising). But Google Ads/DoubleClick (pagead2.googlesyndication.com/ccm/collect), the advertising component active in the capture, is not named by name; only a general «advertising on Facebook» is named. The Salesforce platform (support chat, stokker.my.site.com), which loads actively, is also not named. The visitor sees Analytics and Facebook in the policy, but not Google Ads and not Salesforce.
Consent: what is proven and what is not
Proven: there is no direct refusal on the first screen. The screenshot records only «Kohanda» and «Nõustun»; the text refers to browser settings.
Proven: the categories are pre-ticked. The settings-panel screenshot shows ticked boxes on analytics, advertising (with remarketing) and functionality.
Proven: GA4 and Google Ads carry gcs=G100. All requests carry the denied state of the storages, cookielessly; consent mode is configured (gcd is present).
Proven: Google Ads and Salesforce are not named in the policy. A search of the document finds Analytics and Facebook, but not Google Ads/DoubleClick and not Salesforce.
Not established: the consent decision. Pressing «Nõustun» is not recorded in the capture; the pre-ticking in the UI meanwhile did not lead to granted (gcs remains G100).
Not proven: the content of the requests. The GA/Ads bodies in the published file are redacted; gcs, gcd, en are readable.
Observation boundaries
The capture covers the homepage and records browser behaviour, not server-side processing: what Google does with the received (storage-denied) signals and how the pre-ticking is configured in the CMP on the site’s side is not verified by a browser capture. The pre-ticking of categories is established from the settings screenshots (live UI); the gcs=G100 status — from the HAR. Salesforce is attributed to the functional part (support chat), but is not named in the policy. The requests to edge.microsoft.com are attributed to capture-tool artefacts.
Separately: the self-check of the file cleaning finished with the status WARN (not OK) — the redactor flagged a potential marker during cleaning that was not unambiguously removed. This is noted for transparency; it does not affect the analysis’s conclusions (load order, gcs statuses, UI pre-ticking), but before publication the file should be additionally checked by eye.
The file is published cleaned of personal data (71 redactions); the load order, the gcs=G100 status of GA/Ads and the activity of Salesforce can be verified directly against the published file and the screenshots. The banner and the pre-ticking of categories are from the screenshots (live UI).
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The professional-tools chain keeps a cookie banner, but the consent mechanism is built with two flaws. On the first screen there is no direct refusal button — only «customise» and «agree», and refusal is offered via browser settings, while continued browsing is treated as consent. And in the settings panel all categories — including advertising with remarketing and the transfer of personal data — are pre-ticked as on, which under the Planet49 ruling does not constitute valid consent.
In fairness, at the technical level the site behaves more restrainedly than its own interface: the GA4 and Google Ads requests in the capture carry status gcs=G100 — under denial, cookieless — that is, before «Nõustun» is pressed no data is written to the storages, despite the pre-ticked boxes. But the contradiction between «on» in the UI and «denied» in consent mode is itself telling: the user is presented with a pre-ticked consent that technically does not yet exist. Separately, the policy names Google Analytics and Facebook, but not Google Ads and not Salesforce.
Remediation: add a direct refusal button to the first screen of the banner, equivalent to «Nõustun» (do not refer to browser settings); remove the pre-ticking from all optional categories in the settings panel — analytics, advertising and functionality should be off by default; bring the UI into line with the actual state of consent mode; name Google Ads/DoubleClick and the Salesforce platform in the policy as recipients with their purposes stated; preserve the correct denied state of GA/Ads until actual consent.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
0577f166f1bcacf1f29e3f7ef562977c33e258ac6520d784651b9a47e3ba4d1a
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — stokker.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта stokker.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Баннер cookie не даёт прямого отказа на первом экране: только «Kohanda» (настроить) и «Nõustun» (согласен), а текст предлагает отказ лишь через настройки браузера («Küpsistest loobumiseks muutke oma seadme veebilehitseja seadistusi») и трактует продолжение как согласие («Jätkamisega nõustute»). Это модель implied consent без равнозначной кнопки отказа. Хуже того, в панели настроек «Küpsiste eelistused» все категории ПРЕДВЫСТАВЛЕНЫ как включённые (галочки стоят): Analüütika (аналитика), Reklaami/Personaliseerimine (реклама — с прямым упоминанием remarketing и isikuandmete saatmine, «отправка персональных данных»), Funktsionaalsus. Предвыбранное согласие на рекламу по GDPR (решение Planet49) действительного согласия не образует. Отдельно отмечается техническое расхождение: несмотря на предвыбранные галочки в UI, обращения GA4 и Google Ads в этом замере идут со статусом gcs=G100 (оба хранилища запрещены) — то есть до нажатия «Nõustun» consent mode держит запрет, и предвыбор в UI пока не привёл к granted-состоянию. Но сам предвыбор рекламной категории и отсутствие прямой кнопки отказа — нарушение на уровне механизма согласия. 2) Политика конфиденциальности (Stokker AS, рег. 10165452) называет Google Analytics (_ga) и Facebook (для показа рекламы). Однако Google Ads/DoubleClick (pagead2.googlesyndication.com/ccm/collect), который активно грузится в замере как рекламный компонент, по имени не назван; названа лишь общая «реклама в Facebook». Также не названа платформа Salesforce (чат поддержки, stokker.my.site.com), которая активно грузится. Посетитель видит в политике Google Analytics и Facebook, но не Google Ads и не Salesforce. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-stokker-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — stokker.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website stokker.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The cookie banner offers no direct refusal on the first screen: only «Kohanda» (customise) and «Nõustun» (agree), and the text offers refusal only via browser settings («Küpsistest loobumiseks muutke oma seadme veebilehitseja seadistusi») and treats continuation as consent («Jätkamisega nõustute»). This is an implied-consent model without an equivalent refusal button. Worse, in the «Küpsiste eelistused» settings panel all categories are PRE-SET to on (boxes ticked): Analüütika (analytics), Reklaami/Personaliseerimine (advertising — with an explicit mention of remarketing and isikuandmete saatmine, «transfer of personal data»), Funktsionaalsus. Pre-ticked consent to advertising does not constitute valid consent under the GDPR (the Planet49 ruling). Separately noted is a technical discrepancy: despite the pre-ticked boxes in the UI, the GA4 and Google Ads requests in this capture carry status gcs=G100 (both storages denied) — that is, before «Nõustun» is pressed consent mode keeps the denial, and the pre-ticking in the UI has not yet led to a granted state. But the pre-ticking of the advertising category itself and the absence of a direct refusal button is a violation at the level of the consent mechanism. 2) The privacy policy (Stokker AS, reg. 10165452) names Google Analytics (_ga) and Facebook (for showing advertising). However, Google Ads/DoubleClick (pagead2.googlesyndication.com/ccm/collect), which loads actively in the capture as an advertising component, is not named by name; only a general «advertising on Facebook» is named. The Salesforce platform (support chat, stokker.my.site.com), which loads actively, is also not named. The visitor sees Google Analytics and Facebook in the policy, but not Google Ads and not Salesforce. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-stokker-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — stokker.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi stokker.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Küpsiste bänner ei keeldu esimesel ekraanil otseselt: ainult «Kohanda» (konfigure) ja «Nõustun» (nõus) ning tekst pakub keeldumist ainult brauseri seadete kaudu („Küpsistest loobumiseks muutke oma veebilehitseja seadistusi) ja käsitleb jätkamist nõusolekuna («Jätkamisega nõustute»). Tegemist on kaudse nõusoleku mudeliga, millel puudub samaväärne loobumisnupp. Veelgi hullem on see, et «Küpsiste eelistused» seadete paneelis on kõik kategooriad EELNEVALt kaasatud (puugi stend): Analüütika (analüütika), Reklaami/Personaliseerimine (reklaam – otsese viitega uuesti turundamisele ja isikuandmete saatmisele, „isikuandmete saatmine), Funktsionaalsus. Eelvalitud nõusolek reklaamimiseks vastavalt GDPR-ile (Planet49) ei ole kehtiv nõusolek. Eraldi on tehniline lahknevus: hoolimata kasutajaliidese eelvalitud märkidest on GA4 ja Google Adsi aadressid selles mõõtmises staatusega gcs=G100 (mõlemad salvestused on keelatud) - see tähendab, et enne «Nõustun» nõusoleku režiimi vajutamist on keeld ja kasutajaliidese eelvalik ei ole veel andnud riiki. Kuid reklaamikategooria eelvalik ja otsese loobumisnupu puudumine on nõusoleku mehhanismi tasandil rikkumine. 2) Privaatsuspoliitika (Stokker AS, reg. 10165452) viitab Google Analyticsile (ga) ja Facebookile (reklaamide kuvamiseks). Kuid Google Ads/DoubleClick (pagead2.googlesyndication.com/ccm/collect), mis on mõõtmisel aktiivselt laaditud reklaamikomponendina, ei nimetata nime järgi; nimetatakse ainult üldist „Facebooki reklaami. Samuti ei nimetata Salesforce'i platvormi (toevestlus, stokker.my). site.com, mis on aktiivselt laetud. Külastaja näeb Google Analyticsi ja Facebooki eeskirju, kuid mitte Google Adsi ega Salesforce'i. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-stokker-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — stokker.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом stokker.ee. 2. Обстоятельства Я посетил сайт stokker.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 13.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Баннер cookie не даёт прямого отказа на первом экране: только «Kohanda» (настроить) и «Nõustun» (согласен), а текст предлагает отказ лишь через настройки браузера («Küpsistest loobumiseks muutke oma seadme veebilehitseja seadistusi») и трактует продолжение как согласие («Jätkamisega nõustute»). Это модель implied consent без равнозначной кнопки отказа. Хуже того, в панели настроек «Küpsiste eelistused» все категории ПРЕДВЫСТАВЛЕНЫ как включённые (галочки стоят): Analüütika (аналитика), Reklaami/Personaliseerimine (реклама — с прямым упоминанием remarketing и isikuandmete saatmine, «отправка персональных данных»), Funktsionaalsus. Предвыбранное согласие на рекламу по GDPR (решение Planet49) действительного согласия не образует. Отдельно отмечается техническое расхождение: несмотря на предвыбранные галочки в UI, обращения GA4 и Google Ads в этом замере идут со статусом gcs=G100 (оба хранилища запрещены) — то есть до нажатия «Nõustun» consent mode держит запрет, и предвыбор в UI пока не привёл к granted-состоянию. Но сам предвыбор рекламной категории и отсутствие прямой кнопки отказа — нарушение на уровне механизма согласия. 2) Политика конфиденциальности (Stokker AS, рег. 10165452) называет Google Analytics (_ga) и Facebook (для показа рекламы). Однако Google Ads/DoubleClick (pagead2.googlesyndication.com/ccm/collect), который активно грузится в замере как рекламный компонент, по имени не назван; названа лишь общая «реклама в Facebook». Также не названа платформа Salesforce (чат поддержки, stokker.my.site.com), которая активно грузится. Посетитель видит в политике Google Analytics и Facebook, но не Google Ads и не Salesforce. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-stokker-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — нет прямого отказа, категории предвыбраны, согласие через продолжение просмотра; GDPR Art. 13(1)(e) — часть получателей не раскрыта (Google Ads, Salesforce) 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — stokker.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website stokker.ee. 2. Circumstances I visited the website stokker.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The cookie banner offers no direct refusal on the first screen: only «Kohanda» (customise) and «Nõustun» (agree), and the text offers refusal only via browser settings («Küpsistest loobumiseks muutke oma seadme veebilehitseja seadistusi») and treats continuation as consent («Jätkamisega nõustute»). This is an implied-consent model without an equivalent refusal button. Worse, in the «Küpsiste eelistused» settings panel all categories are PRE-SET to on (boxes ticked): Analüütika (analytics), Reklaami/Personaliseerimine (advertising — with an explicit mention of remarketing and isikuandmete saatmine, «transfer of personal data»), Funktsionaalsus. Pre-ticked consent to advertising does not constitute valid consent under the GDPR (the Planet49 ruling). Separately noted is a technical discrepancy: despite the pre-ticked boxes in the UI, the GA4 and Google Ads requests in this capture carry status gcs=G100 (both storages denied) — that is, before «Nõustun» is pressed consent mode keeps the denial, and the pre-ticking in the UI has not yet led to a granted state. But the pre-ticking of the advertising category itself and the absence of a direct refusal button is a violation at the level of the consent mechanism. 2) The privacy policy (Stokker AS, reg. 10165452) names Google Analytics (_ga) and Facebook (for showing advertising). However, Google Ads/DoubleClick (pagead2.googlesyndication.com/ccm/collect), which loads actively in the capture as an advertising component, is not named by name; only a general «advertising on Facebook» is named. The Salesforce platform (support chat, stokker.my.site.com), which loads actively, is also not named. The visitor sees Google Analytics and Facebook in the policy, but not Google Ads and not Salesforce. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-stokker-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — no direct refusal, categories pre-ticked, consent by continued browsing; GDPR Art. 13(1)(e) — some recipients not disclosed (Google Ads, Salesforce) 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil stokker.ee. 2. Asjaolud Külastasin veebisaiti stokker.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 13.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Küpsiste bänner ei keeldu esimesel ekraanil otseselt: ainult «Kohanda» (konfigure) ja «Nõustun» (nõus) ning tekst pakub keeldumist ainult brauseri seadete kaudu („Küpsistest loobumiseks muutke oma veebilehitseja seadistusi) ja käsitleb jätkamist nõusolekuna («Jätkamisega nõustute»). Tegemist on kaudse nõusoleku mudeliga, millel puudub samaväärne loobumisnupp. Veelgi hullem on see, et «Küpsiste eelistused» seadete paneelis on kõik kategooriad EELNEVALt kaasatud (puugi stend): Analüütika (analüütika), Reklaami/Personaliseerimine (reklaam – otsese viitega uuesti turundamisele ja isikuandmete saatmisele, „isikuandmete saatmine), Funktsionaalsus. Eelvalitud nõusolek reklaamimiseks vastavalt GDPR-ile (Planet49) ei ole kehtiv nõusolek. Eraldi on tehniline lahknevus: hoolimata kasutajaliidese eelvalitud märkidest on GA4 ja Google Adsi aadressid selles mõõtmises staatusega gcs=G100 (mõlemad salvestused on keelatud) - see tähendab, et enne «Nõustun» nõusoleku režiimi vajutamist on keeld ja kasutajaliidese eelvalik ei ole veel andnud riiki. Kuid reklaamikategooria eelvalik ja otsese loobumisnupu puudumine on nõusoleku mehhanismi tasandil rikkumine. 2) Privaatsuspoliitika (Stokker AS, reg. 10165452) viitab Google Analyticsile (ga) ja Facebookile (reklaamide kuvamiseks). Kuid Google Ads/DoubleClick (pagead2.googlesyndication.com/ccm/collect), mis on mõõtmisel aktiivselt laaditud reklaamikomponendina, ei nimetata nime järgi; nimetatakse ainult üldist „Facebooki reklaami. Samuti ei nimetata Salesforce'i platvormi (toevestlus, stokker.my). site.com, mis on aktiivselt laetud. Külastaja näeb Google Analyticsi ja Facebooki eeskirju, kuid mitte Google Adsi ega Salesforce'i. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-stokker-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a) - selgesõnaline keeldumine, eelnevalt valitud kategooriad, nõusolek jätkuva sirvimise kaudu; GDPR artikli 13 lõike 1 punkt e – mõned saajad ei ole avalikustatud (Google Ads, Salesforce) 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]