The website of the coach operator Tulisilm — one page, 104 requests. The CookieScript banner is fair: refusal on the first layer, boxes unticked. But one of the two Google Analytics properties does not wait for the choice and three seconds in sends the visitor's identifier to Google's advertising nodes, and after refusal keeps working with the same identifier. There is no privacy policy on the site, although the banner refers to one.
Request timeline
Declared versus actual
Transfer timings
GA4 G-17H5683F5N, page_view without a consent state.
ads/ga-audiences with a client identifier.
GA4 G-0GRZ9KWEKN, gcs=G100.
G-17H5683F5N, scroll, gcs=G100, an identifier created before the choice.
Detected trackers
- Google Analytics 4 (G-17H5683F5N) via region1.analytics.google.com, stats.g.doubleclick.net, www.google.ee/ads/ga-audiences — before any choice without consent mode, with a client identifier; after refusal — gcs=G100 with the same identifier
- Google Analytics 4 (G-0GRZ9KWEKN) — gcs=G100, denied by default. The denial is respected
- Google Universal Analytics (UA-35566908-41, analytics.js) — the script loads, no data collection requests
- Plausible (plausible.io) — cookieless analytics, six events during the capture
- CookieScript (cdn.cookie-script.com) — consent platform; refusal on the first layer exists, the decision is not sent to a server
- Google Fonts; first party: tulisilm.eu (WordPress)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — Google Analytics with advertising features before any choiceThe CookieScript banner offers equivalent 'Nõustu kõigiga' and 'Keeldu kõigist' buttons, but one of the two Google properties does not wait for it. At +3.0 s Google Analytics 4 G-17H5683F5N sends page_view with a client identifier, and the same identifier goes to Google's advertising nodes stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. At the moment of sending, this property has no consent mode: the gcd parameter contains no set state, and there is no gcs parameter. After refusal, the property switches to denied mode but continues to work with the identifier created before the choice. The second property, G-0GRZ9KWEKN, runs in denied mode from the start.
- GDPR Art. 13(1)(c), 13(1)(e), 13(1)(f), 13(2)(a), 13(2)(b), 13(2)(d) / Art. 12(1) — no privacy policyThe banner refers to a privacy policy page, but no such page exists on the site. The only text on data processing is two sentences in the Tulisilm OÜ terms of sale: buyer data is used to process the order and is passed to carriers. The purposes and legal bases of processing on the site, Google Analytics and Plausible as recipients, data transfers to the US, retention periods, data subject rights and the right to lodge a complaint with a supervisory authority are described nowhere. Meanwhile, the cookie declaration in the banner claims that analytics cookies 'cannot be used to directly identify a visitor', while describing _ga as a cookie that distinguishes unique users by a client identifier.
Context
tulisilm.eu is the website of the coach operator Tulisilm: charter transport, tickets and coach rental. The owner is Tulisilm OÜ (registration code 10180026, Tallinna tn 14, Loksa). Consent is managed by CookieScript.
The measurement is a single capture of one homepage load. In total, 104 requests.
Data processing on the site is described only by the terms of sale; there is no separate privacy policy.
Who receives data directly
Google — Analytics with the DoubleClick and ga-audiences advertising nodes. Plausible — cookieless analytics. CookieScript — as the consent platform. Google Fonts.
Declared versus actual
First — one Google property does not wait for a choice. Three seconds after entry, Google Analytics G-17H5683F5N sends a page view with a client identifier and passes the same identifier to Google’s advertising nodes. At that moment it has no consent mode. After refusal it switches to denied mode, but the identifier stays the same — the one created before the choice. The second property, G-0GRZ9KWEKN, runs in denied mode throughout, as it should.
Second — there is no policy. The banner suggests changing consent on the privacy policy page, but no such page exists. The terms of sale contain two sentences on data processing — about orders and delivery. Nothing is said about cookies, Google, Plausible, rights or the right to complain. The terms themselves are built from someone else’s template: a return request is to be sent to info@bpilet.ee, and the right of withdrawal applies “until 1 hour before the bus departs”.
Third — the declaration contradicts itself. It calls analytics cookies unsuitable for identification, while describing _ga in the same place as a cookie that distinguishes unique users.
Consent: what is proven and what is not
Proven: there is a refusal on the first layer. The “Keeldu kõigist” button on screenshot 1.
Proven: G-17H5683F5N sends data before any choice. page_view, stats.g.doubleclick.net and ga-audiences at +3.0 s without a gcs parameter, gcd with no set states.
Proven: a refusal took place. At +112.4 s Google consent mode transmits a denial updated by the decision.
Proven: there is no privacy policy. The banner links to one, the site has none; data processing is mentioned only in the terms of sale.
Not established: the exact moment of refusal. CookieScript does not send the decision to a server.
Boundaries of this observation
The measurement covers one homepage load. Ticket sales and charter bookings were not examined. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers were removed. The Google client identifier is not reproduced in full in this review.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon.
Conclusion
Tulisilm has installed a proper banner but has not brought one of its Google properties under it: it goes to the advertising nodes before the choice and keeps the identifier created then after refusal. The privacy policy the banner refers to does not exist on the site at all.
Remedy: enable Google consent mode with a denied default for G-17H5683F5N or remove this property; remove the outdated Universal Analytics script; publish a privacy policy with the Article 13 information — purposes and legal bases, Google and Plausible as recipients, transfers to the US, retention periods, rights and the right to lodge a complaint with the Andmekaitse Inspektsioon; correct the description of analytics cookies in the declaration and remove the foreign template text from the terms of sale.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
a5ceedb545f2dc26d8725427367ab11d4fa7432f817cf5a8a4ab24c15f5f0206
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — tulisilm.eu Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта tulisilm.eu. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Баннер CookieScript предлагает равнозначные «Nõustu kõigiga» и «Keeldu kõigist», но один из двух счётчиков Google его не ждёт. На +3,0 с Google Analytics 4 G-17H5683F5N отправляет page_view с идентификатором клиента, и тот же идентификатор уходит на рекламные узлы Google stats.g.doubleclick.net и www.google.ee/ads/ga-audiences. Режима согласия у этого счётчика в момент отправки нет: параметр gcd не содержит ни одного заданного состояния, параметра gcs нет. После отказа счётчик переходит в режим запрета, но продолжает работать с идентификатором, созданным до выбора. Второй счётчик G-0GRZ9KWEKN с самого начала работает в режиме запрета. 2) Баннер отсылает к странице политики конфиденциальности, но такой страницы на сайте нет. Единственный текст об обработке данных — два предложения в условиях продажи Tulisilm OÜ: данные покупателя используются для обработки заказа и передаются перевозчикам. Цели и основания обработки на сайте, Google Analytics и Plausible как получатели, передача данных в США, сроки хранения, права субъекта данных и право на жалобу в надзорный орган не описаны нигде. Декларация cookie в баннере при этом утверждает, что аналитические cookie «не могут использоваться для прямой идентификации посетителя», хотя тут же описывает _ga как cookie, который распознаёт уникальных пользователей по идентификатору клиента. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-tulisilm-eu/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — tulisilm.eu To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website tulisilm.eu. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The CookieScript banner offers equivalent 'Nõustu kõigiga' and 'Keeldu kõigist' buttons, but one of the two Google properties does not wait for it. At +3.0 s Google Analytics 4 G-17H5683F5N sends page_view with a client identifier, and the same identifier goes to Google's advertising nodes stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. At the moment of sending, this property has no consent mode: the gcd parameter contains no set state, and there is no gcs parameter. After refusal, the property switches to denied mode but continues to work with the identifier created before the choice. The second property, G-0GRZ9KWEKN, runs in denied mode from the start. 2) The banner refers to a privacy policy page, but no such page exists on the site. The only text on data processing is two sentences in the Tulisilm OÜ terms of sale: buyer data is used to process the order and is passed to carriers. The purposes and legal bases of processing on the site, Google Analytics and Plausible as recipients, data transfers to the US, retention periods, data subject rights and the right to lodge a complaint with a supervisory authority are described nowhere. Meanwhile, the cookie declaration in the banner claims that analytics cookies 'cannot be used to directly identify a visitor', while describing _ga as a cookie that distinguishes unique users by a client identifier. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-tulisilm-eu/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — tulisilm.eu Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi tulisilm.eu kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) CookieScripti bänner pakub võrdväärseid nuppe „Nõustu kõigiga“ ja „Keeldu kõigist“, kuid üks Google'i kahest loendurist seda ei oota. +3,0 s juures saadab Google Analytics 4 G-17H5683F5N page_view sündmuse koos kliendiidentifikaatoriga ning sama identifikaator saadetakse Google'i reklaamisõlmedele stats.g.doubleclick.net ja www.google.ee/ads/ga-audiences. Saatmise hetkel puudub sellel loenduril nõusolekurežiim: parameeter gcd ei sisalda ühtegi määratud olekut ja parameeter gcs puudub. Pärast keeldumist läheb loendur keelurežiimi, kuid jätkab tööd enne valikut loodud identifikaatoriga. Teine loendur G-0GRZ9KWEKN töötab algusest peale keelurežiimis. 2) Bänner viitab privaatsuspoliitika lehele, kuid sellist lehte veebilehel ei ole. Ainus tekst andmete töötlemise kohta on kaks lauset Tulisilm OÜ müügitingimustes: ostja andmeid kasutatakse tellimuse töötlemiseks ja edastatakse vedajatele. Veebilehel toimuva töötlemise eesmärke ja aluseid, Google Analyticsit ja Plausible'it kui vastuvõtjaid, andmete edastamist USAsse, säilitamistähtaegu, andmesubjekti õigusi ega õigust esitada kaebus järelevalveasutusele ei ole kusagil kirjeldatud. Samal ajal väidab bänneri küpsiste deklaratsioon, et analüütilisi küpsiseid „ei saa kasutada konkreetse külastaja otseseks tuvastamiseks“, kuigi kirjeldab samas _ga küpsist kui küpsist, mis eristab unikaalseid kasutajaid kliendiidentifikaatori abil. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-tulisilm-eu/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — tulisilm.eu 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом tulisilm.eu. 2. Обстоятельства Я посетил сайт tulisilm.eu и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 08.10.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Баннер CookieScript предлагает равнозначные «Nõustu kõigiga» и «Keeldu kõigist», но один из двух счётчиков Google его не ждёт. На +3,0 с Google Analytics 4 G-17H5683F5N отправляет page_view с идентификатором клиента, и тот же идентификатор уходит на рекламные узлы Google stats.g.doubleclick.net и www.google.ee/ads/ga-audiences. Режима согласия у этого счётчика в момент отправки нет: параметр gcd не содержит ни одного заданного состояния, параметра gcs нет. После отказа счётчик переходит в режим запрета, но продолжает работать с идентификатором, созданным до выбора. Второй счётчик G-0GRZ9KWEKN с самого начала работает в режиме запрета. 2) Баннер отсылает к странице политики конфиденциальности, но такой страницы на сайте нет. Единственный текст об обработке данных — два предложения в условиях продажи Tulisilm OÜ: данные покупателя используются для обработки заказа и передаются перевозчикам. Цели и основания обработки на сайте, Google Analytics и Plausible как получатели, передача данных в США, сроки хранения, права субъекта данных и право на жалобу в надзорный орган не описаны нигде. Декларация cookie в баннере при этом утверждает, что аналитические cookie «не могут использоваться для прямой идентификации посетителя», хотя тут же описывает _ga как cookie, который распознаёт уникальных пользователей по идентификатору клиента. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-tulisilm-eu/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — Google Analytics с рекламными функциями до выбора; GDPR Art. 13(1)(c), 13(1)(e), 13(1)(f), 13(2)(a), 13(2)(b), 13(2)(d) / Art. 12(1) — политики конфиденциальности нет 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — tulisilm.eu 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website tulisilm.eu. 2. Circumstances I visited the website tulisilm.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 8 October 2026 (open methodology, reproducible measurements) documents the following indications: 1) The CookieScript banner offers equivalent 'Nõustu kõigiga' and 'Keeldu kõigist' buttons, but one of the two Google properties does not wait for it. At +3.0 s Google Analytics 4 G-17H5683F5N sends page_view with a client identifier, and the same identifier goes to Google's advertising nodes stats.g.doubleclick.net and www.google.ee/ads/ga-audiences. At the moment of sending, this property has no consent mode: the gcd parameter contains no set state, and there is no gcs parameter. After refusal, the property switches to denied mode but continues to work with the identifier created before the choice. The second property, G-0GRZ9KWEKN, runs in denied mode from the start. 2) The banner refers to a privacy policy page, but no such page exists on the site. The only text on data processing is two sentences in the Tulisilm OÜ terms of sale: buyer data is used to process the order and is passed to carriers. The purposes and legal bases of processing on the site, Google Analytics and Plausible as recipients, data transfers to the US, retention periods, data subject rights and the right to lodge a complaint with a supervisory authority are described nowhere. Meanwhile, the cookie declaration in the banner claims that analytics cookies 'cannot be used to directly identify a visitor', while describing _ga as a cookie that distinguishes unique users by a client identifier. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-tulisilm-eu/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — Google Analytics with advertising features before any choice; GDPR Art. 13(1)(c), 13(1)(e), 13(1)(f), 13(2)(a), 13(2)(b), 13(2)(d) / Art. 12(1) — no privacy policy 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil tulisilm.eu. 2. Asjaolud Külastasin veebisaiti tulisilm.eu ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 08.10.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) CookieScripti bänner pakub võrdväärseid nuppe „Nõustu kõigiga“ ja „Keeldu kõigist“, kuid üks Google'i kahest loendurist seda ei oota. +3,0 s juures saadab Google Analytics 4 G-17H5683F5N page_view sündmuse koos kliendiidentifikaatoriga ning sama identifikaator saadetakse Google'i reklaamisõlmedele stats.g.doubleclick.net ja www.google.ee/ads/ga-audiences. Saatmise hetkel puudub sellel loenduril nõusolekurežiim: parameeter gcd ei sisalda ühtegi määratud olekut ja parameeter gcs puudub. Pärast keeldumist läheb loendur keelurežiimi, kuid jätkab tööd enne valikut loodud identifikaatoriga. Teine loendur G-0GRZ9KWEKN töötab algusest peale keelurežiimis. 2) Bänner viitab privaatsuspoliitika lehele, kuid sellist lehte veebilehel ei ole. Ainus tekst andmete töötlemise kohta on kaks lauset Tulisilm OÜ müügitingimustes: ostja andmeid kasutatakse tellimuse töötlemiseks ja edastatakse vedajatele. Veebilehel toimuva töötlemise eesmärke ja aluseid, Google Analyticsit ja Plausible'it kui vastuvõtjaid, andmete edastamist USAsse, säilitamistähtaegu, andmesubjekti õigusi ega õigust esitada kaebus järelevalveasutusele ei ole kusagil kirjeldatud. Samal ajal väidab bänneri küpsiste deklaratsioon, et analüütilisi küpsiseid „ei saa kasutada konkreetse külastaja otseseks tuvastamiseks“, kuigi kirjeldab samas _ga küpsist kui küpsist, mis eristab unikaalseid kasutajaid kliendiidentifikaatori abil. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-tulisilm-eu/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — Google Analytics koos reklaamifunktsioonidega enne valikut; IKÜM art 13 lg 1 p c, e, f, art 13 lg 2 p a, b, d / art 12 lg 1 — privaatsuspoliitika puudub 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]