RU EN
www.
Technical audit · 06.06.2026

transport.tallinn.ee

Tallinn city public transport
EE

Tallinn public transport website — schedules, routes, tickets. Google Analytics and Cloudflare Insights fire within the first 100 milliseconds. No consent banner at all. The privacy policy describes city institutions — not this website.

Request timeline

+103 ms · before consent
Google Fonts (fonts.googleapis.com) — Open Sans, Cyrillic. IP sent to Google, USA.
+105 ms · before consent
jQuery UI CDN (code.jquery.com/ui/1.11.4) — library from an external CDN. USA.
+106 ms · before consent
Cloudflare Insights (static.cloudflareinsights.com) — status 200. Analytics beacon, data sent to USA.
+123 ms · before consent
GTM (GTM-N7B2Q9M) — status 200. Google Tag Manager loads and activates.
Consent banner
Entirely absent. Zero consent requests, zero Set-Cookie headers.
+722 ms
GA4 (G-2FDPPH1HHD) collect — status 204. Data sent to Google, USA.
+1100 ms
OpenStreetMap (a/b/c.tile.openstreetmap.org) — map tiles. Servers in the EU.
+5731 ms
Second GA4 collect — engagement data on time spent on the site.

Declared versus actual

+ Google Analytics GA4 (G-2FDPPH1HHD) — not declared
+ Google Tag Manager (GTM-N7B2Q9M) — not declared
+ Google Fonts — not declared
+ Cloudflare Insights — not declared
+ jQuery CDN (code.jquery.com) — not declared

Transfer timings

+103 ms fonts.googleapis.com

Open Sans, Cyrillic. IP sent to Google, USA.

+105 ms code.jquery.com

jQuery UI 1.11.4. USA.

+106 ms static.cloudflareinsights.com

Beacon status 200. Data sent to USA.

+123 ms www.googletagmanager.com

GTM-N7B2Q9M status 200.

+722 ms region1.analytics.google.com

GA4 G-2FDPPH1HHD collect, status 204.

+1100 ms *.tile.openstreetmap.org

Route map. EU servers.

Detected trackers

Indicators of GDPR non-compliance

Context

transport.tallinn.ee is the official website of Tallinn city public transport: bus, tram, and trolleybus schedules, routes, and ticketing information. Operated by the municipal body Tallinna Linnatransport. HAR: 121 requests, 10 domains.

All external services fire within the first 130 milliseconds — well before any user interaction. No consent banner exists at all.

Google Fonts (+103 ms) — Open Sans with Cyrillic support. IP sent to Google, USA. It is worth noting that the font loads with Cyrillic support — the site serves Russian-speaking residents of Tallinn, and every visit by them is likewise transmitted to Google.

jQuery UI CDN (+105 ms) — version 1.11.4 from 2014 loads from code.jquery.com. An outdated library served from an external CDN — data goes to jQuery Foundation/Fastly (USA).

Cloudflare Insights (+106 ms) — analytics beacon, status 200, data transmitted. Not blocked — unlike a number of other Estonian sites where it receives status 0.

GTM (+123 ms, GTM-N7B2Q9M) — loads and activates GA4. Collect request leaves at +722 ms.

OpenStreetMap — the only external service without a violation: servers in the EU, map functions without user identification.

Privacy policy — not about this website

The privacy policy is written in English and describes data processing by Tallinn city institutions in general: legal bases, data subject rights, retention periods. It is a generic city-level policy, not specific to transport.tallinn.ee. Google Analytics, GTM, Cloudflare Insights, Google Fonts, and jQuery CDN are not mentioned anywhere. The policy states that data is not disclosed without a legal basis — but does not describe what happens every time a visitor opens the schedule page.

jQuery 1.11.4 — an additional risk

jQuery UI version 1.11.4 was released in 2014 and has long been unsupported. Loading an outdated library from an external CDN is simultaneously a GDPR issue (data transfer to the USA) and a security issue (known vulnerabilities in unsupported versions). Both are resolved by hosting the library on the site’s own server.

Conclusion

The Tallinn public transport website has no consent banner and transmits every visitor’s data to Google and Cloudflare the moment a schedule page is opened. The privacy policy does not describe the actual recipients. The route map correctly uses OpenStreetMap instead of Google Maps — a deliberate choice. That same level of deliberateness has not extended to analytics and fonts.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/transport-tallinn-ee-2026-06-06.har
SHA-256: 1315808185fbe202f27d6eabeafd19603f6fa28f2a92b863029ff6042488fede
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — transport.tallinn.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website transport.tallinn.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google Fonts (+103 ms), jQuery CDN (+105 ms), Cloudflare Insights (+106 ms), and GTM (+123 ms) fire immediately on page load. The GA collect request leaves at +722 ms. No consent banner exists.

2) No consent mechanism exists. Zero consent requests, zero Set-Cookie responses. Google Analytics and Cloudflare Insights collect data without any user consent.

3) The privacy policy describes data processing by Tallinn city institutions in general terms. Google Analytics, GTM, Cloudflare Insights, Google Fonts, and jQuery CDN are not mentioned as data recipients.

4) Google Analytics (G-2FDPPH1HHD) transmits data to the USA. Cloudflare Insights — USA. jQuery CDN (code.jquery.com) — USA. No transfer mechanism is stated.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-transport-tallinn-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — transport.tallinn.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website transport.tallinn.ee.

2. Circumstances
I visited the website transport.tallinn.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Fonts (+103 ms), jQuery CDN (+105 ms), Cloudflare Insights (+106 ms), and GTM (+123 ms) fire immediately on page load. The GA collect request leaves at +722 ms. No consent banner exists.

2) No consent mechanism exists. Zero consent requests, zero Set-Cookie responses. Google Analytics and Cloudflare Insights collect data without any user consent.

3) The privacy policy describes data processing by Tallinn city institutions in general terms. Google Analytics, GTM, Cloudflare Insights, Google Fonts, and jQuery CDN are not mentioned as data recipients.

4) Google Analytics (G-2FDPPH1HHD) transmits data to the USA. Cloudflare Insights — USA. jQuery CDN (code.jquery.com) — USA. No transfer mechanism is stated.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-transport-tallinn-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]