Technical audit · 28.09.2026

sudalinnateater.ee

Website of the Südalinna Teater (formerly the Russian Theatre) in Tallinn

The website of the Südalinna Teater, formerly the Russian Theatre — five pages, 303 requests. The banner states that the visitor's browser 'agrees by default' to cookies, and both of its buttons begin with the words 'I agree'. While the banner is still on screen, Google Analytics already receives a page view, and the same visitor identifier goes to Google's advertising infrastructure. The cookie policy page the banner links to is empty: a heading and three dashes.

Request timeline

+0 s · entering
Redirect from the Russian Theatre's old address to sudalinnateater.ee.
+0.7 s · scripts before any choice
Google tag G-T5QF67ZZKC, reCAPTCHA, Reachmill, libraries from unpkg.com, cdn.jsdelivr.net, and code.jquery.com.
+1.7 s · Google, while the banner is on screen
region1.analytics.google.com — page_view. In the same millisecond — stats.g.doubleclick.net and www.google.ee/ads/ga-audiences with the same client identifier.
+33…+240 s · every subsequent page
The cookie policy page twice, the homepage twice: page views and scrolling go to Google with the same identifier.

Declared versus actual

✓ Controller — SA Südalinna Teater, Vabaduse väljak 5, Tallinn; info@sudalinnateater.ee (site footer) — declared
✓ Banner: cookies are used to provide the best website visit; by default, the browser agrees to them — declared
✓ Banner: technical cookies — mandatory; statistics cookies — tracking traffic; 'redirection' cookies — personalised advertising content — declared
✓ The 'Meie küpsisepoliitika' page: only a heading and '---' — declared
+ Google Analytics and Google advertising features before any choice — not declared
+ Transmission of the identifier to Google's advertising infrastructure — not declared
+ Reachmill, reCAPTCHA, external libraries and fonts — not declared
+ Which cookies are used, recipients, retention periods — the cookie policy page is empty — not declared

Transfer timings

+0.7 s www.googletagmanager.com

gtag.js for G-T5QF67ZZKC.

+1.7 s region1.analytics.google.com

page_view, client identifier.

+1.7 s stats.g.doubleclick.net

Google advertising endpoint, the same client identifier.

+1.7 s www.google.ee

ads/ga-audiences — advertising audiences.

+188.8 s region1.analytics.google.com

A scroll event on the homepage.

Detected trackers

Indicators of GDPR non-compliance

Context

sudalinnateater.ee is the website of the Südalinna Teater in Tallinn, formerly the Russian Theatre: the old address veneteater.ee redirects here. According to the site footer, the controller is SA Südalinna Teater, Vabaduse väljak 5, Tallinn. The site is available in Estonian, Russian, and English.

The measurement is a single capture of five page loads: the homepage via the old address, the cookie policy page twice, and the homepage twice. In total, 303 requests. Two requests to edge.microsoft.com are the browser’s built-in translator. Two requests to video.bunnycdn.com came from the previous site’s tab. Both are excluded from the review.

Who receives data directly

Google — Analytics, advertising features, reCAPTCHA, fonts. Reachmill — social media feed. Third-party library delivery networks: unpkg, jsDelivr, jQuery CDN.

What the capture shows

A banner where consent is the only option. The “Küpsiste eelistused” window opens with a statement that itself contradicts the rules: by default, your browser agrees to cookies. Then come three lines: technical cookies (ticked and cannot be switched off), statistics cookies, and “redirection” cookies for personalised advertising (unticked). There are two buttons, and both mean consent: “Olen nõus ja salvestan” and “Olen nõus kõigiga ja salvestan”. The only way to refuse is to press “I agree” with the checkboxes unticked. There is no “refuse” button in either the Estonian or the Russian version.

Google does not even wait for this choice. At +1.7 s, while the banner is still on screen, a page view goes to Google Analytics. In the same millisecond, the same client identifier is sent to stats.g.doubleclick.net and www.google.ee/ads/ga-audiences — Google’s advertising features, collecting data for advertising audiences. In other words, before the visitor decides, exactly what the banner describes as “redirection cookies for personalised advertising” — and offers to enable with a separate checkbox — is already running. The client identifier is the same across all pages in the capture.

The cookie policy is empty. Both links in the banner point to documents. The “Meie küpsisepoliitika” page was opened twice in the capture and looks the same in both versions of the site: a heading, three dashes, and the footer. What these cookies are, who receives them, and how long they last is stated nowhere on the site.

Proven: the banner declares consent by default and offers no refusal. The banner text and buttons are in the saved capture and in screenshots 1 and 2.

Proven: Google Analytics and Google’s advertising features run before any choice. Requests at +1.7 s, consent mode not configured, no decision made in the capture.

Proven: the cookie policy page is empty. Screenshots 3 and 4 and the page content in the capture.

Not verified: the privacy policy. A link to it appears in the banner and in the newsletter form, but it was not opened during the capture.

Boundaries of this observation

The measurement covers the homepage and the cookie policy page. Ticket purchasing was not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and script bodies were removed. The Google client identifier is not reproduced in this review.

Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.

Conclusion

The theatre declares the visitor’s consent as given in advance, “by the browser by default”, and provides no refuse button. Google, meanwhile, waits for no choice at all: analytics and advertising features receive the visitor’s identifier from the first second. The document that should explain all of this is empty.

Remedy: remove the consent-by-default wording from the banner and add an equally prominent refuse button; do not load Google Analytics before consent to statistics, or the advertising features before consent to advertising; disable Google signals if advertising is not used; fill the cookie policy page with a list of cookies, purposes, recipients, and retention periods.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/sudalinnateater-ee-2026-09-28.har
SHA-256: 61a998b41428dceec2d6728337ed45780a26e85fd6bd0b452ffb604b3ed022f1
Screenshot
Скриншот интерфейса
The 'Küpsiste eelistused' banner: 'by default, your browser agrees to them'; both buttons read 'Olen nõus…', no refuse button · 28.09.2026
Скриншот интерфейса
The same banner on the Russian version of the site: 'I agree and save' and 'I agree to all and save' · 28.09.2026
Скриншот интерфейса
The 'Meie küpsisepoliitika' page: a heading and three dashes, nothing else · 28.09.2026
Скриншот интерфейса
The same empty cookie policy page in a full window · 28.09.2026
Скриншот интерфейса
The newsletter sign-up form with a link to the privacy terms · 28.09.2026
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.