RU EN
www.
Technical audit · 09.09.2026

tv3.ee

TV3 broadcaster news portal
EE

The TV3 broadcaster's news portal — a single capture of the privacy-principles page, 72 requests, 23 nodes, about eleven seconds. The partners are disclosed in full: the InMobi / Quantcast consent platform under the IAB TCF standard lists 282 partners. But the disclosure does not protect the user's choice. The consent banner is shown, no choice is made — there is no consent string at all — and the full stack is already running: the Google ad server loads before the banner itself, the Facebook pixel sends ViewContent and PageView, the Hotjar session-recording tool loads, the Drip email automation and OneSignal push fire, and GA4 runs across three properties, one with no consent signal. Disclosing 282 partners is not the same as respecting consent.

Request timeline

+496…+786 ms · the ad server before the CMP
securepubads.g.doubleclick.net/tag/js/gpt.js and the pagead2.googlesyndication.com/gampad/ads ad requests — the Google Ad Manager ad server loads and requests ads straight from the markup, before the InMobi consent platform starts at +900 ms.
+938…+962 ms · session recording, push, email
static.hotjar.com/c/hotjar-3699767.js — the Hotjar session-recording tool; cdn.onesignal.com — the OneSignal push SDK; tag.getdrip.com/9268725.js — the Drip email automation. All before consent.
+900…+1264 ms · the CMP loads, no choice made
cmp.inmobi.com/choice, tcfv2/cmp2.js, geoip, GVL-v3/vendor-list — the InMobi consent platform under the IAB TCF standard and the list of 282 partners. In all requests the consent string is absent: gdpr_consent=-. The 'Me hindame teie privaatsust' banner is shown, the 'Nõustun' / 'Rohkem võimalusi' buttons are not clicked.
+1154…+1258 ms · Facebook / Meta Pixel
connect.facebook.net/signals/config/326271550136971, then www.facebook.com/tr — the ViewContent and PageView events of pixel 326271550136971 (response 200).
+1280…+1796 ms · Drip and Quantcast
api.getdrip.com/client/events/visit and client/track — Drip events; pixel.quantcount.com/pixel — the Quantcast audience-measurement pixel. All with the consent string gdpr_consent=-.
+6067…+9217 ms · GA4
region1.analytics.google.com/g/collect — page_view (G-3P7DRZ6V6W, gcs=-); region1.google-analytics.com/g/collect — scroll events (G-1WK2LVCE2W and G-QDJWYFR5ND, gcs=G100).

Declared versus actual

✓ Controller — All Media (TV3 Grupp Eesti); the InMobi / Quantcast consent platform under the IAB TCF standard — declared
✓ The partner panel discloses 282 partners with processing purposes (advertising, measurement, geolocation and others) — declared
✓ Categories: statistics (statistika), marketing (turundus), necessary — with consent configuration — declared
✓ Among those disclosed — Quantcast, InMobi, Google, Meta and hundreds of other TCF vendors — declared
✓ Supervisory authority — Andmekaitse Inspektsioon — declared
+ That the Google ad server, the Facebook pixel, Hotjar, Drip, Quantcast, OneSignal and GA4 fire before a choice is made in the banner (the consent string is absent) — not declared
+ Hotjar (session recording), Drip (email automation), OneSignal (push) — not TCF vendors, absent from the partner list — not declared
+ That one of the GA4 properties (G-3P7DRZ6V6W) runs with no consent signal (gcs=-) — not declared

Transfer timings

+496 ms securepubads.g.doubleclick.net

Google Ad Manager (gpt.js) from the markup, before the InMobi consent platform.

+900 ms cmp.inmobi.com

IAB TCF, 282 partners. gdpr_consent=- — no consent string.

+938 ms static.hotjar.com

Hotjar, site 3699767. Absent from the TCF list.

+1258 ms www.facebook.com

ViewContent and PageView, pixel 326271550136971. Response 200.

+1280 ms api.getdrip.com

The Drip email-automation visit event. Absent from the TCF list.

+1715 ms pixel.quantcount.com

The Quantcast audience-measurement pixel, gdpr_consent=-.

+6067 ms region1.analytics.google.com

GA4 page_view, G-3P7DRZ6V6W, gcs=- (consent mode not configured).

Detected trackers

Indicators of GDPR non-compliance

Context

tv3.ee is the news portal of the Estonian broadcaster TV3; the controller is All Media (TV3 Grupp Eesti). Consent is managed by the InMobi / Quantcast platform under the IAB TCF standard. The site is served via Cloudflare and sets some of the protective headers: Content-Security-Policy, HSTS, X-Content-Type-Options nosniff, Referrer-Policy no-referrer-when-downgrade; X-Frame-Options and Permissions-Policy are absent.

The capture is a single recording of the privacy-principles page (/privaatsuspohimotted/): 72 requests, 23 nodes, about eleven seconds, recorded on 9 September 2026. Processing is described by the ‘Partners and Policy’ document — the InMobi consent panel with an exhaustive partner list.

Who receives data directly

Before consent — Google (Ad Manager, Analytics), Meta (Facebook Pixel), Hotjar (session recording), Drip (email automation), Quantcast (measurement), OneSignal (push). All while the consent banner is shown but not clicked.

Declared vs. actual

The discrepancy here is essentially the same as at the large publishers: the disclosure is exemplary, but the processing gets ahead of consent.

The disclosure. The InMobi panel under the IAB TCF standard lists 282 partners — Quantcast, InMobi, Google, Meta and hundreds of others — with their processing purposes. As for who was named among the advertising vendors, there is no complaint against the site.

But the processing runs before the choice. The ‘Me hindame teie privaatsust’ consent banner is shown at the time of the capture, but no choice has been made in it: in all requests to the platform the consent string is absent (gdpr_consent=-), no TCF string is formed. Nevertheless, the full stack is already running. The Google Ad Manager ad server loads and requests ads at +496 ms — before the consent platform itself starts at +900 ms. The Facebook / Meta Pixel (326271550136971) sends ViewContent and PageView events. GA4 runs across three properties, one of which (G-3P7DRZ6V6W) with no consent signal at all.

And some of the trackers are outside the TCF scope. The exhaustive list of 282 partners covers the advertising vendors, but does not cover three services that, in this same capture, fire before consent and are not TCF vendors: the Hotjar session-recording tool (site 3699767), the Drip marketing email automation (account 9268725) and the OneSignal push service. That is, precisely the services that perform session recording, profiling for mailings and push lie outside the disclosed vendor list — and still run before the choice.

Proven: no choice was made in the banner. The consent banner is shown, and in all requests to the InMobi platform the consent string is absent (gdpr_consent=-) — no TCF string is formed.

Proven: the ad server gets ahead of the consent platform. gpt.js and the ad requests go out at +496…+786 ms, whereas the InMobi platform loads at +900 ms.

Proven: the trackers transmit data before the choice. Facebook /tr — ViewContent and PageView at +1258 ms (response 200); Drip client/events/visit — at +1280 ms; Quantcast pixel — at +1715 ms; Hotjar and OneSignal load at +938…+962 ms.

Proven: one GA4 property runs with no consent signal. G-3P7DRZ6V6W carries gcs=-; two other properties — gcs=G100.

Proven: Hotjar, Drip, OneSignal are outside the TCF list. These three services do not appear in the InMobi partner panel.

Not proven, and not reproduced: the content of the recorded sessions and profiles. What exactly Hotjar and Drip captured is not reproduced in the audit; the conclusion rests on the fact of loading and of transmitting events before the choice.

Observation boundaries

The capture covers the privacy-principles page and records browser behaviour, not the services’ internal workings: server-side processing, the configuration of the tag container and contracts with recipients are not verified by a browser-level capture. The absence of a consent string is established from the gdpr_consent=- parameter in the requests to the InMobi platform; the banner, shown but not clicked, is visible in the recording itself. Cookie values in the published file were removed during redaction. The session-recording tool is identified by the Hotjar domain, the email automation by getdrip.com, the push by onesignal.com.

The file is published redacted of personal data. Response headers, statuses, the load order and initiators are preserved, so the load order of the ad server relative to the CMP, the absence of a consent string and the transfers by the Facebook pixel, Drip and Quantcast are verified directly against the published file.

The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

Conclusion

The broadcaster’s news portal disclosed its advertising partners exemplarily — the InMobi panel under the IAB TCF standard lists 282 partners. But the user’s decision is not protected by this disclosure. The consent banner is shown, no choice is made, there is no consent string at all — and the full stack is already running: the Google ad server loads before the banner itself, the Facebook pixel sends ViewContent and PageView, GA4 runs across three properties, one with no consent signal.

Separately, outside the exhaustive vendor list lie three services that fire before the choice and are not TCF vendors: the Hotjar session recording, the Drip email automation and the OneSignal push. Disclosing 282 partners is necessary but not sufficient: it replaces neither holding processing back until the choice nor disclosing the services outside TCF.

Remediation: condition the entire stack on actual consent — the Google Ad Manager ad server, the Facebook pixel, GA4, and also Hotjar, Drip, Quantcast and OneSignal — so that before the choice in the banner none of these requests goes out and no session recording is performed; configure Google’s consent mode so that all GA4 properties pass a consent signal (currently one runs with gcs=-); and disclose the services outside the TCF scope — Hotjar, Drip, OneSignal — in the policy as recipients with the purpose stated.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/tv3-ee-2026-09-09.har
SHA-256: 5bf2bd7366618c227e34bfa99e744c3b09256ebc942eb42901cdf6aca9106c93
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — tv3.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website tv3.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The portal has the InMobi / Quantcast consent management platform installed under the IAB TCF standard, and the partner list is disclosed exhaustively — the panel lists 282 partners. The 'Me hindame teie privaatsust' consent banner is shown at the time of the capture, but no choice has been made in it: in all requests to the platform the consent string is absent (gdpr_consent=-), meaning no TCF string is formed. Nevertheless, the full stack of trackers fires before any consent. The Google Ad Manager ad server (securepubads.g.doubleclick.net/gpt.js) loads and requests ads at +496…+786 ms — before the consent platform itself loads at +900 ms. The Facebook / Meta Pixel (ID 326271550136971) sends ViewContent and PageView events to facebook.com/tr at +1258 ms (response 200). The Hotjar session-recording tool (site 3699767) loads at +938 ms. The Drip marketing email automation sends visit and track events. The Quantcast audience-measurement pixel and the OneSignal push SDK also fire. GA4 analytics runs across three properties, one of which (G-3P7DRZ6V6W) with no consent signal at all (gcs=-).

2) TV3's disclosure of advertising partners is done at the level of the IAB TCF standard — the InMobi panel lists 282 partners. But this disclosure, first, is not accompanied by holding processing back until consent (the whole stack fires before the choice), and second, does not cover trackers outside the TCF scope: the Hotjar session-recording tool, the Drip email automation and the OneSignal push service are not TCF vendors and do not appear in the partner list, yet all three fire before consent. That is, outside the exhaustive vendor list lie precisely the services that perform session recording, profiling for mailings and push. The completeness of the TCF list replaces neither holding processing back until the choice nor disclosing the services outside TCF.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-tv3-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — tv3.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website tv3.ee.

2. Circumstances
I visited the website tv3.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 9 September 2026 (open methodology, reproducible measurements) documents the following indications:

1) The portal has the InMobi / Quantcast consent management platform installed under the IAB TCF standard, and the partner list is disclosed exhaustively — the panel lists 282 partners. The 'Me hindame teie privaatsust' consent banner is shown at the time of the capture, but no choice has been made in it: in all requests to the platform the consent string is absent (gdpr_consent=-), meaning no TCF string is formed. Nevertheless, the full stack of trackers fires before any consent. The Google Ad Manager ad server (securepubads.g.doubleclick.net/gpt.js) loads and requests ads at +496…+786 ms — before the consent platform itself loads at +900 ms. The Facebook / Meta Pixel (ID 326271550136971) sends ViewContent and PageView events to facebook.com/tr at +1258 ms (response 200). The Hotjar session-recording tool (site 3699767) loads at +938 ms. The Drip marketing email automation sends visit and track events. The Quantcast audience-measurement pixel and the OneSignal push SDK also fire. GA4 analytics runs across three properties, one of which (G-3P7DRZ6V6W) with no consent signal at all (gcs=-).

2) TV3's disclosure of advertising partners is done at the level of the IAB TCF standard — the InMobi panel lists 282 partners. But this disclosure, first, is not accompanied by holding processing back until consent (the whole stack fires before the choice), and second, does not cover trackers outside the TCF scope: the Hotjar session-recording tool, the Drip email automation and the OneSignal push service are not TCF vendors and do not appear in the partner list, yet all three fire before consent. That is, outside the exhaustive vendor list lie precisely the services that perform session recording, profiling for mailings and push. The completeness of the TCF list replaces neither holding processing back until the choice nor disclosing the services outside TCF.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-tv3-ee/

3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — tracking before consent, despite the TCF platform; GDPR Art. 5(1)(a) / Art. 13(1)(e) — disclosure through TCF and trackers outside its scope

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]