trampolino.ee
The website of the Trampolino trampoline park — two pages, 318 requests. The CookieScript banner with a refuse button is in place, and Google Analytics respects it. The Meta pixel does not: in the fourth second it sends Meta a page view with a browser identifier, and after the visitor refuses, it loads again and sends another event. The banner itself, meanwhile, declares that using the site already means consent to all cookies.
Request timeline
Declared versus actual
Transfer timings
fbevents.js and the configuration of pixel 667420978407020.
page_view, gcs=G100.
PageView and ViewContent with the _fbp identifier.
gcs=G100, consent mode records the visitor's refusal.
A Meta pixel event on the privacy terms page.
Detected trackers
- Meta Pixel (667420978407020) — connect.facebook.net, www.facebook.com/tr; PageView and ViewContent with the _fbp identifier at +4.1 s, before any choice, and an event after refusal
- Google Analytics 4 (G-6CNK2GLRM3) via region1.google-analytics.com — gcs=G100; after refusal, consent mode records the denial. The denial is respected
- Google Tag Manager (GTM-K7WQ5PJH), pagead2.googlesyndication.com — service requests of the Google tag
- CookieScript (cdn.cookie-script.com) — consent platform; refusal available on the first layer
- First party: trampolino.ee (WordPress, WooCommerce)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel before any choice and after refusalThe CookieScript banner is in place, and Google obeys it: every request to Google Analytics carries gcs=G100. The Meta pixel (667420978407020) does not. Its script loads at +3.1 s, and at +4.1 s PageView and ViewContent events go to www.facebook.com/tr. Along with them, the browser identifier _fbp is transmitted — created 0.1 s earlier, before any choice in the banner. Five more events are then sent from the homepage. After the visitor refused (on the next page, Google consent mode records a denial updated by the visitor's decision), the pixel loads again and sends one more event at +148.7 s. The site's own cookie declaration classifies _fbp as an advertising cookie, i.e. one that requires consent.
- GDPR Art. 4(11) / Art. 7(1) / Art. 5(1)(a) — the banner declares mere use of the site to be consentThe banner's first layer has 'Nõustu kõigiga' and an equally weighted 'Keeldu kõigist', and non-essential categories are switched off. But the text above the buttons reads: 'Meie veebisaiti kasutades nõustute kooskõlas meie küpsisepoliitikaga kõikide küpsistega' — by using our website, you agree to all cookies. This contradicts the refuse button and misleads the visitor: consent does not arise from using a website; it is given by an active act. In this capture, moreover, the wording matches reality: the Meta pixel behaves as if consent had already been obtained.
Context
trampolino.ee is the website of the Trampolino trampoline park and entertainment centre in Tallinn. The controller is Reds OÜ (registration code 12106028, Pärnu mnt 139d, Tallinn). The site runs on WordPress with a WooCommerce shop, and consent is managed by CookieScript.
The measurement is a single capture of two pages: the homepage and the privacy terms page. In total, 318 requests. Processing is described by the “Privaatsustingimused” page together with the CookieScript cookie declaration.
Who receives data directly
Meta — through the pixel, before any choice and after refusal. Google — Analytics in denied mode, Tag Manager. CookieScript — as the consent platform.
Declared versus actual
At first glance, the banner is set up correctly: “Nõustu kõigiga” and “Keeldu kõigist” sit side by side and look the same, and categories are switched off. Google Analytics runs in denied mode throughout the capture, and after refusal, consent mode records that denial as updated by the visitor’s decision. The discrepancies lie in the Meta pixel and in the banner’s own text.
First — the Meta pixel does not wait for a choice. The pixel script loads alongside the consent platform, and at +4.1 s PageView and ViewContent go to www.facebook.com/tr with the page address and the browser identifier _fbp. The identifier was created a tenth of a second earlier — at the very moment the pixel loaded. While the visitor reads the banner, five more events are sent from the homepage. Then the visitor refuses. On the next page, Google sees this and complies. The Meta pixel loads again and sends one more event. The site’s own cookie declaration, meanwhile, classifies _fbp as an advertising cookie.
Second — the banner itself says consent has already been given. Above the buttons it reads: by using the website, you agree to all cookies. If that were true, the refuse button would mean nothing. If not, the text is misleading. In this capture, the Meta pixel behaves exactly as the text describes: as if consent had been obtained by the mere act of opening the site.
Consent: what is proven and what is not
Proven: the Meta pixel sends events before any choice. PageView and ViewContent at +4.1 s with the _fbp identifier.
Proven: a refusal took place. On the second page, Google consent mode transmits a denial updated by the visitor’s decision. On the first page, the denial was only the default.
Proven: the Meta pixel runs after refusal. The script loads again, with an event at +148.7 s.
Proven: the banner declares use of the site to be consent. The banner text in screenshots 2 and 3.
Not established: the exact moment of refusal. CookieScript does not send the decision to a server. The refusal is established from Google consent mode on the second page. The five Meta events on the homepage (+31…+106 s) are therefore classed as “before or during the choice”, not “after refusal”.
Not established: the content of the Meta events sent via POST. The bodies of these requests were removed during cleaning.
Boundaries of this observation
The measurement covers the homepage and the privacy terms page. Booking and purchasing were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and POST request bodies were removed. The parameters of Meta events transmitted in the request address are preserved.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the terms themselves.
Conclusion
Trampolino has installed a proper banner with a refuse button, and Google obeys it. The Meta pixel does not: it sends a page view with a browser identifier in the fourth second and keeps working after refusal. The banner text declaring mere use of the site to be consent describes, in this capture, not a breach of the rules on paper but the pixel’s actual behaviour.
Remedy: bring the Meta pixel under CookieScript — do not load it without consent to advertising cookies, and stop sending events after refusal; remove the sentence about consent through use of the site from the banner.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
da7762b4b4c96b6716751d74b34a15fd521d0b3d1df02026eb114122729e0108
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — trampolino.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта trampolino.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Баннер CookieScript на месте, и Google его слушается: все обращения к Google Analytics идут с gcs=G100. Пиксель Meta (667420978407020) — нет. Его сценарий грузится на +3,1 с, а на +4,1 с на www.facebook.com/tr уходят события PageView и ViewContent. Вместе с ними передаётся идентификатор браузера _fbp, созданный за 0,1 с до этого, — до какого-либо выбора в баннере. Затем на главной уходят ещё пять событий. После того как посетитель отказался (режим согласия Google на следующей странице фиксирует запрет, обновлённый решением посетителя), пиксель грузится заново и отправляет ещё одно событие на +148,7 с. Собственная декларация cookie сайта относит _fbp к рекламным cookie, то есть к требующим согласия. 2) На первом слое баннера есть «Nõustu kõigiga» и равнозначная «Keeldu kõigist», необязательные категории выключены. Но текст над кнопками гласит: «Meie veebisaiti kasutades nõustute kooskõlas meie küpsisepoliitikaga kõikide küpsistega» — пользуясь сайтом, вы соглашаетесь со всеми cookie. Это противоречит кнопке отказа и вводит посетителя в заблуждение: согласие не возникает из пользования сайтом, оно даётся активным действием. В этом замере формулировка к тому же совпадает с фактом: пиксель Meta работает так, будто согласие уже получено. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-trampolino-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — trampolino.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website trampolino.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The CookieScript banner is in place, and Google obeys it: every request to Google Analytics carries gcs=G100. The Meta pixel (667420978407020) does not. Its script loads at +3.1 s, and at +4.1 s PageView and ViewContent events go to www.facebook.com/tr. Along with them, the browser identifier _fbp is transmitted — created 0.1 s earlier, before any choice in the banner. Five more events are then sent from the homepage. After the visitor refused (on the next page, Google consent mode records a denial updated by the visitor's decision), the pixel loads again and sends one more event at +148.7 s. The site's own cookie declaration classifies _fbp as an advertising cookie, i.e. one that requires consent. 2) The banner's first layer has 'Nõustu kõigiga' and an equally weighted 'Keeldu kõigist', and non-essential categories are switched off. But the text above the buttons reads: 'Meie veebisaiti kasutades nõustute kooskõlas meie küpsisepoliitikaga kõikide küpsistega' — by using our website, you agree to all cookies. This contradicts the refuse button and misleads the visitor: consent does not arise from using a website; it is given by an active act. In this capture, moreover, the wording matches reality: the Meta pixel behaves as if consent had already been obtained. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-trampolino-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — trampolino.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi trampolino.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) CookieScripti bänner on olemas ja Google arvestab sellega: kõik päringud Google Analyticsile saadetakse väärtusega gcs=G100. Meta piksel (667420978407020) aga mitte. Selle skript laaditakse +3,1 s juures ja +4,1 s juures saadetakse aadressile www.facebook.com/tr sündmused PageView ja ViewContent. Koos nendega edastatakse brauseri identifikaator _fbp, mis loodi 0,1 s varem – enne mis tahes valikut bänneris. Seejärel saadetakse avalehel veel viis sündmust. Pärast seda, kui külastaja keeldus (järgmisel lehel fikseerib Google'i nõusolekurežiim külastaja otsusega uuendatud keelu), laaditakse piksel uuesti ja see saadab +148,7 s juures veel ühe sündmuse. Veebilehe enda küpsiste deklaratsioon liigitab _fbp reklaamiküpsiste hulka, st nõusolekut nõudvate küpsiste hulka. 2) Bänneri esimesel kihil on „Nõustu kõigiga“ ja võrdväärne „Keeldu kõigist“ ning mittevajalikud kategooriad on välja lülitatud. Kuid nuppude kohal olev tekst ütleb: „Meie veebisaiti kasutades nõustute kooskõlas meie küpsisepoliitikaga kõikide küpsistega.“ See on vastuolus keeldumisnupuga ja eksitab külastajat: nõusolek ei teki veebilehe kasutamisest, see antakse aktiivse tegevusega. Selles mõõtmises langeb sõnastus pealegi kokku tegelikkusega: Meta piksel töötab nii, nagu oleks nõusolek juba saadud. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-trampolino-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — trampolino.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом trampolino.ee. 2. Обстоятельства Я посетил сайт trampolino.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 28.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Баннер CookieScript на месте, и Google его слушается: все обращения к Google Analytics идут с gcs=G100. Пиксель Meta (667420978407020) — нет. Его сценарий грузится на +3,1 с, а на +4,1 с на www.facebook.com/tr уходят события PageView и ViewContent. Вместе с ними передаётся идентификатор браузера _fbp, созданный за 0,1 с до этого, — до какого-либо выбора в баннере. Затем на главной уходят ещё пять событий. После того как посетитель отказался (режим согласия Google на следующей странице фиксирует запрет, обновлённый решением посетителя), пиксель грузится заново и отправляет ещё одно событие на +148,7 с. Собственная декларация cookie сайта относит _fbp к рекламным cookie, то есть к требующим согласия. 2) На первом слое баннера есть «Nõustu kõigiga» и равнозначная «Keeldu kõigist», необязательные категории выключены. Но текст над кнопками гласит: «Meie veebisaiti kasutades nõustute kooskõlas meie küpsisepoliitikaga kõikide küpsistega» — пользуясь сайтом, вы соглашаетесь со всеми cookie. Это противоречит кнопке отказа и вводит посетителя в заблуждение: согласие не возникает из пользования сайтом, оно даётся активным действием. В этом замере формулировка к тому же совпадает с фактом: пиксель Meta работает так, будто согласие уже получено. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-trampolino-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — пиксель Meta до выбора и после отказа; GDPR Art. 4(11) / Art. 7(1) / Art. 5(1)(a) — баннер объявляет согласием само пользование сайтом 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — trampolino.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website trampolino.ee. 2. Circumstances I visited the website trampolino.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 28 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The CookieScript banner is in place, and Google obeys it: every request to Google Analytics carries gcs=G100. The Meta pixel (667420978407020) does not. Its script loads at +3.1 s, and at +4.1 s PageView and ViewContent events go to www.facebook.com/tr. Along with them, the browser identifier _fbp is transmitted — created 0.1 s earlier, before any choice in the banner. Five more events are then sent from the homepage. After the visitor refused (on the next page, Google consent mode records a denial updated by the visitor's decision), the pixel loads again and sends one more event at +148.7 s. The site's own cookie declaration classifies _fbp as an advertising cookie, i.e. one that requires consent. 2) The banner's first layer has 'Nõustu kõigiga' and an equally weighted 'Keeldu kõigist', and non-essential categories are switched off. But the text above the buttons reads: 'Meie veebisaiti kasutades nõustute kooskõlas meie küpsisepoliitikaga kõikide küpsistega' — by using our website, you agree to all cookies. This contradicts the refuse button and misleads the visitor: consent does not arise from using a website; it is given by an active act. In this capture, moreover, the wording matches reality: the Meta pixel behaves as if consent had already been obtained. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-trampolino-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel before any choice and after refusal; GDPR Art. 4(11) / Art. 7(1) / Art. 5(1)(a) — the banner declares mere use of the site to be consent 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil trampolino.ee. 2. Asjaolud Külastasin veebisaiti trampolino.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 28.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) CookieScripti bänner on olemas ja Google arvestab sellega: kõik päringud Google Analyticsile saadetakse väärtusega gcs=G100. Meta piksel (667420978407020) aga mitte. Selle skript laaditakse +3,1 s juures ja +4,1 s juures saadetakse aadressile www.facebook.com/tr sündmused PageView ja ViewContent. Koos nendega edastatakse brauseri identifikaator _fbp, mis loodi 0,1 s varem – enne mis tahes valikut bänneris. Seejärel saadetakse avalehel veel viis sündmust. Pärast seda, kui külastaja keeldus (järgmisel lehel fikseerib Google'i nõusolekurežiim külastaja otsusega uuendatud keelu), laaditakse piksel uuesti ja see saadab +148,7 s juures veel ühe sündmuse. Veebilehe enda küpsiste deklaratsioon liigitab _fbp reklaamiküpsiste hulka, st nõusolekut nõudvate küpsiste hulka. 2) Bänneri esimesel kihil on „Nõustu kõigiga“ ja võrdväärne „Keeldu kõigist“ ning mittevajalikud kategooriad on välja lülitatud. Kuid nuppude kohal olev tekst ütleb: „Meie veebisaiti kasutades nõustute kooskõlas meie küpsisepoliitikaga kõikide küpsistega.“ See on vastuolus keeldumisnupuga ja eksitab külastajat: nõusolek ei teki veebilehe kasutamisest, see antakse aktiivse tegevusega. Selles mõõtmises langeb sõnastus pealegi kokku tegelikkusega: Meta piksel töötab nii, nagu oleks nõusolek juba saadud. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-trampolino-ee/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — Meta piksel enne valikut ja pärast keeldumist; IKÜM art 4 p 11 / art 7 lg 1 / art 5 lg 1 p a — bänner käsitleb nõusolekuna juba veebilehe kasutamist 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]