tkmgrupp.ee

Context

tkmgrupp.ee is the corporate website of the TKM Grupp AS retail holding (Tallinna Kaubamaja Grupp; registration code 10223439, Kaubamaja tn 1, Tallinn), which brings together the Kaubamaja, Selver, Delice, ILU, L’Occitane chains and others. TKM Grupp is a public company listed on Nasdaq Baltic. The data-protection specialist is dpo@tkmgrupp.ee. The site is built on WordPress (WPML multilingual), Apache/ZoneOS server.

Processing is described by two documents: the personal-data processing terms (Isikuandmete töötlemise tingimused, in force from 1 July 2024) and a cookie document (an automatically generated Cookiebot table). Attached to the material are a PDF snapshot of the site and two screenshots: the consent banner and the consent state after refusal.

The measurement consists of one recording, four navigations: the home page, the news section and a press-release page. One hundred and sixteen requests, eight nodes. The recording was made on 20 September 2026.

Who data goes to directly

Cookiebot (the consent platform), Google (Fonts, jQuery CDN), Nasdaq Baltic (share-price widget). There is no analytics, advertising, social network or RTB in the recording.

Declared versus actual

The cookie document (the Cookiebot table) declares Google Analytics (_ga, _ga_#, _gat) in the statistics category and contains a Marketing category; the introductory text is Cookiebot’s standard template about ‘personalising ads and sharing with advertising and analytics partners’. The data-processing terms name the controller and the legal bases, including consent.

The measurement yields a discrepancy in the favourable direction: there is less actual than the configuration allows for.

The consent platform operates in prior-blocking mode. Cookiebot loads at +363 ms (initiated by the page markup). The banner, as seen in the screenshots, offers three buttons — ‘Deny’, ‘Allow selection’, ‘Allow all’, that is, refusal is available on equal footing with consent on the first screen; the Preferences, Statistics and Marketing categories are off by default. The Google tag (gtag/js, identifier UA-15062025-18) loads from the markup at +364 ms, but under the consent platform’s blocking.

The user refused, and the analytics did not fire. At +4610 ms a request to consent.cookiebot.com/logconsent.ashx?action=decline occurs — the platform records a refusal of all optional categories. This is confirmed by the ‘Your current state’ screenshot, where Preferences, Statistics and Marketing are shown as declined. As a result, across all 116 requests, not a single request to Google Analytics (no /g/collect or /collect), Facebook, advertising networks or RTB arises. The Google tag is loaded but transmits no data.

The actual third-party recipients are functional. Cookiebot — the consent platform itself. Google Fonts (fonts.gstatic.com) — the DM Serif Display font, on the loading of which the visitor’s IP address is visible to Google. The jQuery CDN (ajax.googleapis.com) — the jQuery 3.7.0 library, likewise making the IP address visible to Google. Nasdaq Baltic (www.nasdaqbaltic.com/market/ir.php) — a share-price widget for the investor-relations section, appropriate for a public company.

Consent: what is proven and what is not

Proven: the consent-management platform operates in prior-blocking mode. Cookiebot loads first, the statistics and marketing categories are off by default (screenshots), and the Google tag is held under blocking.

Proven: the user refused. The logconsent.ashx?action=decline request in the recording and the ‘Your current state’ screenshot consistently show a refusal of all optional categories.

Proven: the analytics and advertising did not fire. Across 116 requests there is not a single request to Google Analytics, Facebook, advertising networks or RTB; the Google tag transmits no data.

Not proven and not needed: the behaviour on consent. What would have happened on clicking ‘Allow all’ is not established by this recording: the user refused, and the observed behaviour corresponds to the refusal. The Google analytics declared in the configuration is not activated in this recording.

Separately: the browser did not send a DNT header in this recording.

Bounds of observation

The measurement covers four pages of the site. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Estonia, Andmekaitse Inspektsioon.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped; the redaction registry records 65 redactions and a checksum. The response bodies are largely preserved, but the body of the Google tag script (gtag/js) is replaced with a stub; the conclusion about the absence of transmissions to analytics rests on the absence of the corresponding network requests, not on parsing the script’s contents. The consent decision is read from the action=decline parameter of the logconsent request. No security headers are observed on the domain’s own responses.

The identification of services relies on domains and address patterns: the consent platform — by cookiebot.com and the identifier 9a714a82-05e6-4737-915b-b14407ba723e; the Google tag — by googletagmanager.com/gtag/js and the identifier UA-15062025-18; fonts and jQuery — by fonts.googleapis.com, fonts.gstatic.com, ajax.googleapis.com; the share-price widget — by nasdaqbaltic.com. The absence of analytics and advertising is established by the absence of /collect requests and of requests to the corresponding nodes.

Conclusion

The corporate website of the TKM Grupp retail holding transmits no data to analytics or advertising when browsed. A Cookiebot consent-management platform operates on the site in prior-blocking mode, with an equal-weight reject button on the first screen and categories off by default. During capture the user refused — and this is consistently confirmed by the recording (action=decline) and the screenshot (all optional categories declined) — as a result of which the Google tag, loaded from the markup, sent no data request at all across the whole recording. The cookie table declares Google Analytics in the statistics category, so the declared is broader than the actual, not the other way round. As a soft caveat it can be noted that the Google tag, the fonts and the jQuery library load from the markup (the fonts and the CDN see the visitor’s IP address), and that the domain itself sets no security headers; there are, in any case, no transmissions to analytics or advertising in the recording that these measures would protect.