RU EN
www.
Technical audit · 01.09.2026

transpordiamet.ee

Website of the Estonian Transport Administration (Transpordiamet)
EE

Website of the Estonian Transport Administration — one recording, 308 requests, sixteen nodes. On opening the recruitment section page, a page_view event goes to Google: to Google Analytics 4 and to Google Ads, carrying the client identifier, the screen resolution, the full set of browser client hints, the language and the referrer. Yet the agency's own data-processing terms state plainly that when visiting the site personal data is not processed and the IP is not linked to identifying information. There is no working consent mechanism on the page: Google Consent Mode sits in a denied state, but the page_view requests go out regardless. During capture the browser sent a DNT: 1 header.

Request timeline

+0 ms · navigation
Opening of the recruitment section page "Tule meile tööle või praktikale!". Delivery via Cloudflare (cf-ray …-TLL, Tallinn), a Drupal application. Security headers are strong: HSTS, an extensive Content-Security-Policy with an allow-list of sources, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy origin-when-cross-origin. The browser sent a DNT: 1 header.
+1403 ms · tag container
www.googletagmanager.com/gtag/js?id=G-MH1BGZZTKV — the Google Tag Manager container, injected into the page markup by the Drupal google_tag module. There is no condition of any kind before it loads.
session state — no working consent mechanism
Across 308 requests, not a single call to a consent-management platform, not a single script with banner signatures. Google Consent Mode is configured and sits in its default denied state (gcs=G100). The GA4 client identifier was created at 22:22:53 UTC — during this recording, as the page loaded, not beforehand.
+3171 ms · transmission to Google Analytics 4
region1.google-analytics.com/g/collect — page_view of property G-MH1BGZZTKV. Transmitted: the client identifier, the title "Tule meile tööle või praktikale! | Transpordiamet", the address /tookuulutused, the referrer /ru, screen resolution 1536x864, Windows platform, x86/64 architecture, the list of Microsoft Edge 147 versions, language ru, first-visit and session-start flags. Consent status gcs=G100, npa=1.
+3179 ms · transmission to Google Ads
pagead2.googlesyndication.com/ccm/collect — a page_view event of the conversion tag AW-16880467770, loaded by the same GTM container. The same status gcs=G100. This is a stand-alone advertising chain of the site, not part of the embedded player.
+7099…+8047 ms · embedded video
Eight YouTube videos on the page. The player infrastructure (googleads.g.doubleclick.net/pagead/id, static.doubleclick.net/instream/ad_status.js) is initiated by the ytembeds embed itself — this is a functional part of the embedded player, separable from the site's analytics and advertising.

Declared versus actual

✓ When visiting the site, personal data is not processed and the IP address is not linked to identifying information (main terms, section on the website) — declared
✓ More on cookies — on a separate page /kupsised — declared
✓ Cookies are placed to analyse use of the site and for the best usability (cookie page, opening paragraph) — declared
✓ Analytics cookies _ga (2 years), _gid (1 day), _gat (1 day) — source given as www.transpordiamet.ee, what is collected described as anonymous information (visitor counts, entry page) — declared
✓ Marketing cookies — __atuvc (13 months), __atuvs (1 day), AddThis service — declared
✓ The site may use content from third-party sites; the placement of their cookies is not controlled by the agency (links to the terms of Google, Facebook, LinkedIn, Twitter) — declared
✓ Social networks pass the agency visitor statistics in anonymised form — declared
✓ Data exchange is encrypted over HTTPS; access to site development is held by a partner, the IT Centre of the Ministry of Finance (RITA) — declared
✓ Supervisory authority — Andmekaitse Inspektsioon; data-protection contact info@transpordiamet.ee — declared
+ Google Analytics 4 — neither property G-MH1BGZZTKV nor the fact of data transmission to Google is named; analytics cookies are presented as first-party — not declared
+ Google Ads — conversion tag AW-16880467770 is mentioned neither in the main terms nor on the cookie page — not declared
+ Google Tag Manager — the container from which both tags start is not named — not declared
+ Transmission to Google of the client identifier, screen resolution and set of browser client hints — contrary to describing the collection as anonymous — not declared
+ YouTube as a recipient of data when viewing the embedded videos is not disclosed in the documents — not declared
+ Absence of a working consent mechanism despite the use analysis declared on the cookie page — not declared

Transfer timings

+1403 ms www.googletagmanager.com

GTM container G-MH1BGZZTKV, injected into the page markup by the google_tag module.

+3171 ms region1.google-analytics.com

GA4 page_view (G-MH1BGZZTKV): client id, screen resolution, client hints, language, referrer /ru. gcs=G100.

+3179 ms pagead2.googlesyndication.com

Google Ads page_view (AW-16880467770), GTM container. gcs=G100.

+7099 ms googleads.g.doubleclick.net

pagead/id of the embedded YouTube player, initiator ytembeds. Separated from site tracking.

+7106 ms static.doubleclick.net

instream/ad_status.js of the embedded YouTube player, initiator ytembeds.

Detected trackers

Indicators of GDPR non-compliance

Context

transpordiamet.ee is the website of the Estonian Transport Administration (Transpordiamet), a state agency, at Valge 4, 11413 Tallinn. Personal-data processing is described by two of the agency’s documents: the main personal-data processing terms (Isikuandmete töötlemine) and a separate cookie page (/kupsised, revision of 24 October 2025). The data-protection specialist’s contact is info@transpordiamet.ee. Supervision is named directly in the terms themselves — Andmekaitse Inspektsioon. The site is built on Drupal and delivered via Cloudflare (cf-ray with the TLL label — Tallinn); its own security headers are set out fully: HSTS, an extensive Content-Security-Policy with an explicit allow-list of sources, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy origin-when-cross-origin.

The measurement consists of one recording: the Russian version of the recruitment section page (/tookuulutused, “Tule meile tööle või praktikale!”), referrer — the Russian home page /ru. Three hundred and eight requests, sixteen nodes. The page carries eight embedded YouTube videos, which accounts for a significant share of the requests. The recording was made on 17 August 2026 in the Microsoft Edge 147 browser on Windows.

Who data goes to directly

Google (Analytics 4, Google Ads, Tag Manager), YouTube; Cloudflare — as the delivery provider.

Declared versus actual

The agency’s documents say little about the website, but what they say is definite. The main terms, in the section on visiting the site, contain a plain statement: when visiting the Transport Administration site, personal data is not processed, i.e. the IP address is not linked to information identifying the visitor, and for details on cookies they refer to a separate page. The cookie page, in turn, states in its opening paragraph that cookies are placed to analyse use of the site, and divides them into strictly necessary, analytics and marketing.

The measurement yields three discrepancies.

First — the declared “we do not process” against actual transmission to Google. At +3171 ms from the start of the page load, a page_view event goes to Google Analytics 4 (property G-MH1BGZZTKV, node region1.google-analytics.com), and at +3179 ms a page_view event goes to Google Ads (conversion tag AW-16880467770, node pagead2.googlesyndication.com/ccm/collect). Both requests carry: the client identifier, the page title, its address, the referrer /ru, the screen resolution, the Windows platform, x86/64 architecture, the list of Microsoft Edge 147 browser versions, the interface language, and first-visit and session-start flags. This is processing of personal data occurring precisely on visiting the site — exactly what the document denies.

Second — analytics presented as first-party and as anonymous. The cookie page lists _ga, _gid, _gat with the source given as www.transpordiamet.ee, i.e. as first-party cookies, and describes what is collected as anonymous information — visitor counts and the entry page. In fact the data goes not to the site but to Google, and carries a persistent client identifier together with a set of browser client hints. An identifier tying the requests to a specific device, and a detailed browser fingerprint, are neither first-party nor anonymous data. The Google Ads conversion tag AW-16880467770 is not mentioned on the cookie page at all: the marketing section names only the cookies of the AddThis service (__atuvc, __atuvs), which do not appear in the recording.

Third — recipients are not named. Neither Google nor YouTube is named in the agency’s documents as a recipient of web data. The list of third-party services on the cookie page (Google, Facebook, LinkedIn, Twitter) is reduced to links to their own cookie terms — this is a referral, not disclosure of the recipient and purpose within the meaning of Article 13. The YouTube embeds load the googleads.g.doubleclick.net and static.doubleclick.net infrastructure; these requests are initiated by the player itself (ytembeds) and relate to the functioning of the embedded video, but the very fact of data transmission to Google/YouTube when viewing the page is not disclosed in the documents.

Separately, note that part of the infrastructure in the recording is functional and does not relate to tracking: browser-update.org — an outdated-browser notification; static.cloudflareinsights.com and /cdn-cgi/rum — RUM analytics of the delivery provider at a first-party address; statistics.php — an internal Drupal counter. Facebook is permitted in the markup by the CSP header (connect.facebook.net, fbevents.js), but in this recording not a single request to Facebook fired — as a transmission this is not recorded.

Proven: there is no working consent mechanism on the observed page. Across 308 requests there is not a single call to a consent-management platform and not a single script with the corresponding signatures. The names of known platforms and general banner signatures in the addresses were checked — zero matches. The tag container is injected directly into the markup by the Drupal google_tag module and starts at +1403 ms with no preceding condition of any kind.

Proven: Google Consent Mode is configured and sits in a denied state. The requests to Google carry gcs=G100 — both ad_storage and analytics_storage in their default “denied” state — as well as npa=1. Despite this status, the cookieless page_view requests go out anyway, to both Google Analytics 4 and Google Ads.

Proven: the transmission does not depend on the user’s choice. Between the loading of the container (+1403 ms) and the first transmission (+3171 ms) there is not a single step that would require an action by the visitor. No banner, response to a banner, or change of consent status is observed in the recording.

Proven: the identifier was created during the recording. By the timestamp within the client identifier, it was created at 22:22:53 UTC — as this page loaded, not beforehand. This distinguishes the observed case from stitching to a pre-existing profile: here the identifier is new.

Not proven and not asserted: the content of the cookie page as a separate consent. The opening paragraph of the /kupsised page presupposes that cookies are placed to analyse use, i.e. it implies some mechanism; but the mechanism itself — a banner or consent-management platform — is absent on the observed page in the recording. Whether it ever operated on other pages is not established by a browser measurement of a single page.

Separately: during capture the browser sent a DNT: 1 header. This had no effect on the composition or volume of the transmissions to Google.

Bounds of observation

The measurement covers a single page — the Russian version of the recruitment section. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing, contractual relationships with recipients and their own settings are not verified by a browser measurement. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon, whose supervision is named directly in the agency’s own terms.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped, response bodies and static resources cut. Therefore the injection of the container, the composition of the fields transmitted to Google and the consent status are verified from the parameters of the requests themselves in the recording; the presence or absence of Set-Cookie is not assessed from this file. The full client identifier is not reproduced in the analysis; only the fact of its presence, the time of creation and that it is transmitted to both Google services are established.

The identification of services relies on domains and address patterns: Google — by google-analytics.com, googletagmanager.com and googlesyndication.com with the property numbers G-MH1BGZZTKV and AW-16880467770; YouTube — by youtube.com, ytimg.com and the player infrastructure ytembeds. The requests to doubleclick.net initiated by the embedded player are assigned to the functioning of the video, not to tracking of the site itself. The G-ZK fragment inside internal Drupal files is part of randomised script names, not a measurement property; it is not part of the analysis.

Conclusion

A state agency, on a visit to its own site, transmits a page_view event to Google — to Google Analytics 4 and to Google Ads — carrying the client identifier, the screen resolution, the set of browser client hints, the language and the referrer. This directly contradicts the agency’s own data-processing terms, which state that on visiting the site personal data is not processed and the IP is not linked to identifying information. The cookie page, meanwhile, describes that same analytics as first-party and as anonymous, and does not mention the Google Ads conversion tag at all. There is no working consent mechanism on the observed page: Google Consent Mode sits in a denied state, but the page_view requests go out independently of it, and independently of the DNT: 1 signal the browser sent.

Remediation: bring the wording of the main terms into line with the fact of processing on visiting the site, or stop transmission to Google until consent is obtained; name the actual recipients of web data by name — Google Analytics, Google Ads, YouTube — with their purposes stated, and on the cookie page stop presenting Google analytics as first-party cookies and as anonymous data; deploy a working consent mechanism under which the tag container and both Google tags do not load and do not transmit data before the visitor’s explicit consent, and under which the Consent Mode denied signal actually blocks the sending of page_view.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/transpordiamet-ee-2026-08-17.har
SHA-256: 7ab49c7d661840381aae6183bf74d24baf2f02c9ab780323280fafe9e8f5b196
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — transpordiamet.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website transpordiamet.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The Transpordiamet personal-data processing terms, in the section on the website, state plainly: "when visiting the Transport Administration website we do not process your personal data, i.e. the IP address is not linked to information that identifies you." In fact, on opening the recruitment section page, a page_view event goes to Google: at +3171 ms to Google Analytics 4 (property G-MH1BGZZTKV, node region1.google-analytics.com), at +3179 ms to Google Ads (conversion tag AW-16880467770, node pagead2.googlesyndication.com). Both requests carry the client identifier, the screen resolution (sr=1536x864), the full set of browser client hints (Windows platform, x86/64 architecture, the list of Microsoft Edge 147 versions), the interface language, the page address and title, and the referrer — the previous page /ru. This is processing of personal data on visiting the site, which the document denies.

2) There is no working consent mechanism on the observed page: across 308 requests there is not a single call to a consent-management platform, nor a single script with banner signatures. Google Consent Mode is nonetheless configured and sits in its default denied state — the requests to Google carry gcs=G100 (both ad_storage and analytics_storage denied) and npa=1. Despite the denied status, the cookieless page_view requests go out to both GA4 and Google Ads anyway. Meanwhile the site's cookie page (/kupsised, revision of 24 October 2025) states in its opening paragraph that cookies are placed "to analyse use of this website," which presupposes consent — yet the corresponding mechanism is absent on the observed page. The GTM tag is injected directly into the markup by the google_tag module and starts at +1403 ms with no preceding condition.

3) None of the actual recipients of web data is named in the agency's documents as a recipient. The main processing terms do not mention Google, Google Ads or YouTube at all. The cookie page lists the analytics cookies _ga, _gid, _gat with the source given as "www.transpordiamet.ee" — i.e. as first-party cookies — and describes what is collected as "anonymous information"; in fact this data is transmitted to Google with a persistent client identifier and a set of client hints, which is neither first-party nor anonymous data. The Google Ads conversion tag AW-16880467770 is not mentioned on the cookie page in any form — the marketing section names only the cookies of the AddThis service (__atuvc, __atuvs), which do not appear in the recording. The list of third-party services (Google, Facebook, LinkedIn, Twitter) is given merely as links to their own terms, which does not disclose the recipient within the meaning of Article 13.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-transpordiamet-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — transpordiamet.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website transpordiamet.ee.

2. Circumstances
I visited the website transpordiamet.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 1 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The Transpordiamet personal-data processing terms, in the section on the website, state plainly: "when visiting the Transport Administration website we do not process your personal data, i.e. the IP address is not linked to information that identifies you." In fact, on opening the recruitment section page, a page_view event goes to Google: at +3171 ms to Google Analytics 4 (property G-MH1BGZZTKV, node region1.google-analytics.com), at +3179 ms to Google Ads (conversion tag AW-16880467770, node pagead2.googlesyndication.com). Both requests carry the client identifier, the screen resolution (sr=1536x864), the full set of browser client hints (Windows platform, x86/64 architecture, the list of Microsoft Edge 147 versions), the interface language, the page address and title, and the referrer — the previous page /ru. This is processing of personal data on visiting the site, which the document denies.

2) There is no working consent mechanism on the observed page: across 308 requests there is not a single call to a consent-management platform, nor a single script with banner signatures. Google Consent Mode is nonetheless configured and sits in its default denied state — the requests to Google carry gcs=G100 (both ad_storage and analytics_storage denied) and npa=1. Despite the denied status, the cookieless page_view requests go out to both GA4 and Google Ads anyway. Meanwhile the site's cookie page (/kupsised, revision of 24 October 2025) states in its opening paragraph that cookies are placed "to analyse use of this website," which presupposes consent — yet the corresponding mechanism is absent on the observed page. The GTM tag is injected directly into the markup by the google_tag module and starts at +1403 ms with no preceding condition.

3) None of the actual recipients of web data is named in the agency's documents as a recipient. The main processing terms do not mention Google, Google Ads or YouTube at all. The cookie page lists the analytics cookies _ga, _gid, _gat with the source given as "www.transpordiamet.ee" — i.e. as first-party cookies — and describes what is collected as "anonymous information"; in fact this data is transmitted to Google with a persistent client identifier and a set of client hints, which is neither first-party nor anonymous data. The Google Ads conversion tag AW-16880467770 is not mentioned on the cookie page in any form — the marketing section names only the cookies of the AddThis service (__atuvc, __atuvs), which do not appear in the recording. The list of third-party services (Google, Facebook, LinkedIn, Twitter) is given merely as links to their own terms, which does not disclose the recipient within the meaning of Article 13.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-transpordiamet-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 5(1)(a) — transparency: the declared directly contradicts the actual; ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 13(1)(e) — disclosure of recipients

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]