tallinnavesi.ee

Context

tallinnavesi.ee is the website of the water and sewerage utility Aktsiaselts Tallinna Vesi (TVESI); the data-protection terms also apply to the subsidiary Watercom OÜ. Consent is managed by the CookieFirst platform. The site is built on Next.js, served via nginx, and keeps a strict header posture: Content-Security-Policy (default-src 'self' with a narrow allowlist), HSTS with preload for two years, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy, X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff.

The capture is a single recording of the homepage: 202 requests, 7 nodes, about six and a half minutes, recorded on the night of 8 September 2026. Processing is described by Tallinna Vesi’s data-protection terms and a declaration of cookie categories.

Who receives data directly

Only the consent and tag infrastructure: the CookieFirst platform (the consent mechanism itself) and the Google Tag Manager container, which launched no tag. There are no actual analytics or advertising recipients in this capture.

Declared vs. actual

Here the declared and the actual line up, and the actual turns out to be cleaner.

The data-protection terms and the declaration of cookie categories disclose the stack the company uses when consent is present: Google Analytics, Facebook / Meta, YouTube. In fact, in this capture none of them fired. Across 202 requests there is no request to google-analytics.com, to Facebook, to YouTube or to any other recipient from the terms; the Google Tag Manager container (GTM-TZN94K9V) loads but generates no downstream request to analytics or advertising. There is no first-party analytics collection on the site: the only external nodes are the CookieFirst consent platform and the tag container — that is, the consent and tag-management infrastructure itself, not trackers. The security headers are set strictly.

The single point worth noting — not as a violation but as a configuration caveat: the CookieFirst platform runs in no-auto-blocking mode (consentBanner.no-autoblock.js), and the Google Tag Manager container is loaded before the user makes a choice in the banner (the choice is recorded at +194201 ms). In this capture this led to nothing — the tag container deployed no counter — but such an arrangement means that protection against premature tracking rests not on the platform’s auto-blocking but on the tags inside the container being configured carefully. If a statistics or advertising tag is added to the container without its own consent condition, it will be able to fire before the choice. At the time of the capture this does not happen.

Consent: what is proven and what is not

Proven: the declared stack did not fire in this capture. No request to Google Analytics, Facebook / Meta, YouTube across 202 requests. The Google Tag Manager container launches no downstream tags.

Proven: the consent platform runs without auto-blocking. The consentBanner.no-autoblock.js script is loaded; the consent choice is recorded at +194201 ms by the api.cookiefirst.com/prod/consent request. Neither before nor after this moment do any trackers appear in the recording.

Proven: there is no first-party analytics. There is no request to a first-party analytics endpoint (Matomo, Piwik or first-party collection) in the recording; the substring matches fall on Next.js static files, not on data collection.

Not proven, and not required: the content of the consent choice. The body of the /prod/consent request is not analysed in the published file, so whether the user accepted statistics and marketing or refused is not established from the recording. For the conclusion this is immaterial: the declared stack does not fire in any case.

Observation boundaries

The capture covers one page — the homepage — and records browser behaviour, not the services’ internal workings: the configuration of the Google Tag Manager container, server-side processing and contracts with recipients are not verified by a browser-level capture. The GTM container body is redacted in the published file, so which tags are configured in it is not established from the recording — only the fact that no downstream requests to analytics and advertising occurred is recorded. The cms.tallinnavesi.ee content management system is classified as first party.

The file is published redacted of personal data: cookie values in requests have been removed. Response headers, the load order and initiators are preserved, so the composition of the requests and the absence of downstream tags are verified directly against the published file.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

Conclusion

The audit is clean. The water utility runs the CookieFirst consent management platform and discloses its analytics-and-advertising stack — Google Analytics, Facebook, YouTube — in its data-protection terms and cookie declaration, but launches none of it in this capture: the Google Tag Manager container loads but deploys no tags, there is no first-party analytics, and the security headers are set strictly. The declared lines up with the actual, and the actual turns out to be cleaner — on the company’s homepage there are no trackers at all.

The caveat concerns not the fact but the configuration: the consent platform runs without auto-blocking, and the tag container is loaded before the consent choice. At present this leads to nothing, but the protection against premature tracking is worth backing with more than careful tag configuration alone.

Remediation (as hardening, not as a fix for a violation): enable auto-blocking mode in CookieFirst, or ensure that every statistics and advertising tag in the Google Tag Manager container is conditioned on consent at the trigger level, so that adding a new tag cannot lead to it firing before the user’s choice.