The ferry operator's main site passed the audit without findings, so its pre-order shop was additionally captured. A single capture of the shop's homepage, 213 requests, 10 nodes, about forty seconds. The audit is clean: Tallink's consent management platform and tag container are first-party (consent.tallink.com, analytics.tallink.com), and the statistics-and-marketing stack declared in the cookie declaration — Google Analytics, Facebook — does not fire in this capture: the GTM container loads, but no analytics request follows it. Of the external nodes, the functional ones remain: the Cloudinary image network, reCAPTCHA, Google Fonts and a single metering pixel from the TrackJS error monitoring. No violations are recorded; the caveats are that the TrackJS pixel goes out before consent, and that not all of the protective headers are set.
Request timeline
Declared versus actual
Transfer timings
First-party GTM container (GTM-K85PJ8Q). No measurement requests.
Tallink's own consent platform.
The real GTM, pulled in by the first-party container. No downstream requests.
TrackJS error-monitoring usage.gif; token + correlationId, no behavioural payload. Not named in the policy.
Bot protection; IP address to Google.
Detected trackers
- consent.tallink.com — Tallink's own consent management platform (first-party); loads from the page markup
- Google Tag Manager — the container is served from the first-party domain analytics.tallink.com/gtm.js (id GTM-K85PJ8Q) and pulls in www.googletagmanager.com; no measurement request (GA collect) follows it in this capture
- TrackJS (usage.trackjs.com) — JavaScript error monitoring; in the recording, a single usage.gif request (a metering pixel with the site token and a correlationId), fired before consent; not named in the policy or the cookie declaration
- Google reCAPTCHA (www.google.com, www.gstatic.com) — bot protection, functional
- Google Fonts (fonts.gstatic.com) — web fonts, the IP address goes to Google
- Cloudinary (res.cloudinary.com) — the product-image delivery network, functional
- Declared but not fired stack: Google Analytics and Facebook / Meta — disclosed in the cookie declaration (statistics and marketing), but with no requests to them in this capture
Context
shopping.tallink.com is the ferry operator’s pre-order shop: passengers choose goods for their voyage. The shop was audited as a follow-up: the audit of Tallink’s main site turned up no problems, and it was decided to additionally capture its commercial part — the shop. The controller is AS Tallink Grupp (‘Tallink’) and its subsidiaries. Consent is managed by Tallink’s own platform at the domain consent.tallink.com, and the tag container is served from the first-party domain analytics.tallink.com — that is, the consent and tag infrastructure is hosted under the company’s own subdomains. The site is served by the Tallink server and sets HSTS and X-Frame-Options; Content-Security-Policy, Referrer-Policy, Permissions-Policy and X-Content-Type-Options are not set on the main document.
The capture is a single recording of the shop’s homepage: 213 requests, 10 nodes, about forty seconds, recorded on 8 September 2026. Processing is described by Tallink’s privacy policy and a cookie-use declaration.
Who receives data directly
Functionally — Cloudinary (product images), Google reCAPTCHA (form protection), Google Fonts, and a single metering pixel from the TrackJS error monitoring. There are no actual analytics or advertising recipients in this capture; the Google Tag Manager container generates no request to analytics.
Declared vs. actual
Here the declared and the actual line up, and the actual turns out to be cleaner.
The cookie-use declaration discloses the statistics-and-marketing stack the shop uses when consent is present: Google Analytics and Facebook / Meta. In fact, in this capture none of them fired. The Google Tag Manager container is served from the first-party domain analytics.tallink.com and pulls in the real googletagmanager.com, but no measurement request follows it — neither to google-analytics.com nor to the first-party endpoint analytics.tallink.com. The requests that look like ‘collect’ in the recording belong to the shop’s own API (/api/collection/... — product collections), not to analytics. The consent management platform, like the tag container, is hosted under Tallink’s own subdomains — a detail notably in favour of privacy.
A few caveats remain, not raised to the level of a violation. The TrackJS error monitoring sends a single metering pixel usage.gif (with the site token and a correlationId) at +2681 ms, before any consent choice; this request carries no behavioural payload — it is TrackJS’s own service counter — but the recipient is a third party (TrackJS) and it is not named in the policy. reCAPTCHA, Google Fonts and Cloudinary are functional third-party resources that send the IP address to Google and Cloudinary; they are not separately listed in the cookie declaration. And the security headers are not fully set: HSTS and X-Frame-Options are present, but Content-Security-Policy, Referrer-Policy, Permissions-Policy and X-Content-Type-Options are not.
Consent: what is proven and what is not
Proven: the declared stack did not fire in this capture. No request to Google Analytics, Facebook / Meta or any other recipient from the cookie declaration across 213 requests. The Google Tag Manager container (first-party and real) generates no downstream request to analytics.
Proven: the consent and tag infrastructure is first-party. The consent platform is served from consent.tallink.com, the tag container from analytics.tallink.com; both under Tallink’s own subdomains.
Proven: TrackJS sends a single metering pixel before consent. The usage.trackjs.com/usage.gif request goes out at +2681 ms; it carries the site token and a correlationId, but not behavioural data.
Not proven, and not required: the exact consent state. Since no tag with a consent signal fired, there is no machine flag of ‘given/refused’ in the recording. What matters is that the declared stack made no outward request.
Observation boundaries
The capture covers one page — the shop homepage shopping.tallink.com — and records browser behaviour, not the services’ internal workings. The main site tallink.com was audited separately and is not within the scope of this card; the conclusions below concern the shop. The configuration of the Google Tag Manager container (including the server side on analytics.tallink.com), server-side processing and contracts with recipients are not verified by a browser-level capture. The absence of measurement requests in the recording means that no analytics collection is observed in the browser in this capture; what the container would send under a different consent state or on the server side is not established from the recording. The GTM container body is redacted, so its configuration is not analysed. The SSO domain sso.tallink.com and the image network res.cloudinary.com are classified as the functional part.
The file is published redacted of personal data: cookie values in requests have been removed; the TrackJS token in the published request is scrubbed. Response headers, the load order and initiators are preserved, so the composition of the requests and the absence of downstream analytics are verified directly against the published file.
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
Conclusion
The audit is clean. The pre-order shop keeps its consent management platform and tag container under its own subdomains, discloses its statistics-and-marketing stack — Google Analytics, Facebook — in the cookie declaration, and launches none of it in this capture: the Google Tag Manager container loads, but generates no request to analytics. The declared lines up with the actual, and the actual turns out to be cleaner.
The caveats concern not advertising-and-analytics tracking but service and functional requests: the TrackJS error-monitoring metering pixel goes out before the consent choice and is not named in the policy; reCAPTCHA, Google Fonts and Cloudinary send the IP address to Google and Cloudinary; of the protective headers, HSTS and X-Frame-Options are set, but not CSP, Referrer-Policy, Permissions-Policy and X-Content-Type-Options.
Remediation (as hardening, not as a fix for a violation): condition the TrackJS metering pixel on consent, or name TrackJS in the policy and cookie declaration as a processor for error monitoring; consider self-hosting the fonts; and complete the set of protective headers — Content-Security-Policy, Referrer-Policy, Permissions-Policy and X-Content-Type-Options.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
5418241ce9a5fafe552aaad241f9e0a3dd840bdebde1e10f20a912cdcde07309Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — tallink.com Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта tallink.com. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) Прошу предоставить информацию по всем категориям, целям и получателям обработки моих данных на этом сайте — независимо от того, выявлены ли на сегодняшний день какие-либо несоответствия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-tallink-com/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — tallink.com To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website tallink.com. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-tallink-com/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — tallink.com Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi tallink.com kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Palun esitada teave kõigi minu andmete töötlemise kategooriate, eesmärkide ja vastuvõtjate kohta sellel veebisaidil — sõltumata sellest, kas praeguseks on tuvastatud mingeid mittevastavusi. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-tallink-com/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]