The Wolt delivery service — six pages across three subdomains, 971 requests. The banner is fair: refusal sits on the first screen, all non-essential categories are off by default, and Google Analytics runs in denied mode. But refusal only stops third-party tags. After 'Use only necessary' is clicked, Wolt's own telemetry keeps sending page views and session events together with a browser fingerprint, a device identifier, and a user identifier. The fingerprint is the same across subdomains. The policy classifies this analytics as a legitimate interest and does not mention browser fingerprinting.
Request timeline
Declared versus actual
Transfer timings
DoorDash experimentation system, persistent visitor_id.
GA4, gcs=G100; the identifier is not kept between pages.
log-cookie-consents-interaction, action: Decline.
Event packet with browser_fingerprint, device_id, wolt_uid.
Description of a page-view event with session identifiers.
The same visitor_id as before any choice.
life.wolt.com: the same browser fingerprint as on explore.wolt.com.
Detected trackers
- Wolt's own telemetry (gatekeeper.wolt.com/v1/consumer) — event packets carrying a browser fingerprint (browser_fingerprint), a device identifier (device_id), and wolt_uid; six submissions after a recorded refusal
- Avo Inspector (api.avo.app) — an analytics event-schema monitoring service; receives event and property names along with session identifiers; after refusal. Not named in the policy
- DoorDash experimentation system (unified-gateway.dashapi.com) — receives a persistent visitor_id before any choice and after refusal
- Google Analytics 4 (G-CP7Z2F7NFM) via region1.google-analytics.com and Wolt's own gateway wolt.com/gtag-gw — all requests with gcs=G100, the identifier changes between pages. The denial is respected
- AppsFlyer (websdk.appsflyer.com) — smart-banner script on every page; no data-bearing requests
- Datadog RUM (www.datadoghq-browser-agent.com) — script on explore and life pages; no data submissions in the capture. Not named in the policy
- hCaptcha, Google Sign-In (accounts.google.com), Sign in with Apple (appleid.cdn-apple.com) — bot protection and sign-in
- First party and infrastructure: wolt.com, explore.wolt.com, life.wolt.com, restaurant-api and consumer-api.wolt.com, Wolt and DoorDash image CDNs (img.cdn4dd.com), Contentful (images.ctfassets.net)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — telemetry with a browser fingerprint after refusalAt +68 s, the visitor clicked 'Use only necessary': the site recorded a Decline action, and the saved consent state (enrolled: false) is then passed between subdomains. After that, Wolt's own telemetry on gatekeeper.wolt.com sends event packets six times — session start and end, page views with their addresses. Every packet contains a browser fingerprint (browser_fingerprint), a device identifier (device_id), a user identifier (wolt_uid), the device model, and the language. The fingerprint is identical on explore.wolt.com and life.wolt.com, meaning the visitor is recognised across subdomains even after refusal. At the same time, the Avo Inspector service receives descriptions of the same events along with session identifiers. Wolt's own banner describes the 'Analytics' category as technologies that help understand how the platforms are used. That is exactly what the visitor declined. After refusal, the visitor's persistent identifier is also sent to DoorDash's experimentation system — the same visitor_id that was sent before any choice was made.
- GDPR Art. 13(1)(c), 13(1)(e) / Art. 5(1)(a) — the policy and the banner describe analytics differently, and some recipients are not namedThe banner offers analytics as a separate category, switched off by default, i.e. based on consent. The privacy policy classifies analysis of service usage as a legitimate interest and says nothing at all about browser fingerprinting — only about 'pseudonymized identifiers'. A visitor who declined analytics in the banner cannot learn from the policy that their refusal does not stop Wolt's own telemetry. The vendor table in the policy lists 24 services, from Google Analytics to Reddit Pixel. But it includes neither Avo, which receives event data in the capture, nor Datadog, whose script loads on the explore and life pages.
Context
wolt.com is the Wolt food and goods delivery service. For users in Estonia, the joint controllers are Wolt Oy and Wolt Eesti OÜ (Maakri tn 23a, Tallinn). Wolt is part of the DoorDash, Inc. group. The site is split across several subdomains: wolt.com is the ordering service itself, explore.wolt.com hosts legal and reference pages, and life.wolt.com hosts articles. Consent is managed by Wolt’s own platform, which stores the decision on the server and passes it between subdomains.
The measurement: 971 requests to 22 hosts. No response sets Set-Cookie. The main site does not offer a Russian version for Estonia: the address wolt.com/ru redirects to the Kazakhstan market, which is why pages 4–6 opened in the Kazakhstan section. The refusal state recorded on the Estonian page remained in effect there.
Processing is described by Wolt’s privacy policy in its Russian and English versions, with a vendor table.
Who receives data directly
Before any choice — DoorDash (experimentation system), Google (Analytics in denied mode, Tag Manager, Sign-In), AppsFlyer, hCaptcha, Apple. After refusal — Wolt’s own telemetry, Avo, and DoorDash again.
Declared versus actual
Wolt’s consent setup is fairer than many. Refusal sits on the first screen, the “Functional”, “Marketing”, and “Analytics” categories are off by default, and the decision is recorded and applies across all subdomains. Google Analytics runs in denied mode throughout the capture: every request carries gcs=G100, and the identifier is not kept between pages. None of the advertising pixels from the vendor table — Meta, Adform, Taboola, Reddit, and others — appears in the capture. The discrepancy lies not in third-party tags but in Wolt’s own analytics.
First — refusal does not stop Wolt’s telemetry. At +68 s on the policy page, the visitor clicks “Use only necessary”. The site records a Decline action, and the saved enrolled: false state is then passed between subdomains. A minute later, gatekeeper.wolt.com goes to work. This is Wolt’s own event collector, and over the capture it receives six packets. They contain session start and end events and page views, indicating the page and section. Every packet transmits a browser fingerprint (browser_fingerprint), a device identifier (device_id), a user identifier (wolt_uid), the device model, and the language.
The browser fingerprint is the key detail. It is calculated from the device’s characteristics and makes it possible to recognise a visitor without cookies. Here it is identical on explore.wolt.com and on life.wolt.com: the visitor is recognised across subdomains after refusal. Fingerprinting constitutes access to information on the device within the meaning of Article 5(3) of the ePrivacy Directive. A strict-necessity defence is hard to make here: the packets contain page views and session events, i.e. usage analytics. That is exactly how Wolt’s banner describes the “Analytics” category, which the visitor declined.
Alongside the telemetry, Avo Inspector keeps working after refusal. It receives descriptions of the same events — event and property names with their types — along with session identifiers. And on the Russian homepage after refusal, DoorDash’s experimentation system again receives a persistent visitor_id — the same one that was sent there in the fourth second, before any choice was made.
Second — the policy and the banner say different things about analytics. The banner presents analytics as a category that can be enabled only through consent. The policy classifies analysis of service usage as a legitimate interest and describes “pseudonymized identifiers to track and predict your app and service usage”. It says nothing about browser fingerprinting. A visitor who read the banner believes they have refused analytics. A visitor who read the policy might guess that this is not so. But neither of them will learn that they are recognised by a browser fingerprint.
The vendor table in the policy is detailed: 24 services, each with a purpose and a link to its policy. Two of the services active in the capture are missing from it. Avo receives event data after refusal. The Datadog script loads on the explore and life pages, although no data submissions occurred in the capture.
Consent: what is proven and what is not
Proven: refusal is recorded and applies across all subdomains. The log-cookie-consents-interaction request with a Decline action at +68 s. Afterwards, wolt.com passes the enrolled: false state with the same timestamp.
Proven: after refusal, Wolt’s telemetry sends events with a browser fingerprint. Six packets to gatekeeper.wolt.com. Each contains browser_fingerprint, device_id, wolt_uid, and session or page-view events.
Proven: the browser fingerprint is the same across subdomains. Packets from explore.wolt.com and life.wolt.com carry one and the same value.
Proven: DoorDash receives the same visitor_id before any choice and after refusal. The value matches in the requests at +3.6 s and at +204.5 s.
Proven: Google Analytics respects the denial. Every request carries gcs=G100, and the client identifiers differ between pages.
Not established: how Wolt uses the fingerprint on its side. Some telemetry data may serve fraud prevention. But the packets in the capture contain session events and page views, not security checks.
Not established: the value of device_id. It was removed when the file was cleaned. The match is established by the browser fingerprint, not by this field.
Boundaries of this observation
The measurement covers public pages on three subdomains, without signing in to an account and without placing an order. The Wolt app was not examined. The observation records browser behavior, not server-side processing. What Wolt, DoorDash, and Avo do with the data they receive is not verified by a browser-based measurement.
Pages 4–6 opened in the Kazakhstan section of the site because the main site’s Russian version redirects there for Estonia. The refusal made on the Estonian page remained in effect there. The telemetry findings rely on packets from both sections, and the browser fingerprint in them is identical.
Wolt’s news site in the third screenshot is a separate resource with its own banner. It is not part of the HAR capture and is not assessed in this review.
The file has been published cleaned: Cookie headers and the values of device_id and session identifiers were removed. The browser fingerprint and visitor_id are not reproduced in full in this review. Their match across requests can be verified in the published file.
Legal assessment falls to the competent authority. The policy names the Finnish Data Protection Ombudsman or another competent local authority; for users in Estonia, that is the Andmekaitse Inspektsioon.
Conclusion
Wolt has set up the choice the way it should be set up: refusal on the first screen, categories off by default, a decision remembered across all subdomains, and Google Analytics in denied mode. But this choice applies only to third-party tags. After refusal, Wolt’s own telemetry keeps sending page views and session events together with a browser fingerprint, a device identifier, and a user identifier. The identical fingerprint makes it possible to recognise the visitor across subdomains. After refusal, data also goes to Avo, and a persistent visitor identifier goes to DoorDash’s experimentation system.
The policy classifies this analytics as a legitimate interest, the banner as consent-based, and neither of them mentions browser fingerprinting. Avo and Datadog are absent from the vendor table.
Remedy: make Wolt’s own telemetry subject to the banner decision — do not send page-view and session events after refusal of analytics; do not calculate or transmit a browser fingerprint without consent, or limit it strictly to security purposes and disclose that purpose; do not send a persistent visitor_id to the experimentation system before consent; align the policy and the banner on a single legal basis for analytics and describe browser fingerprinting explicitly; add Avo and Datadog to the vendor table.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
be11a9f0d8c462d7439b5497565802a8b7963fdd292fc5da2029b94802ce20bd
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — wolt.com Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта wolt.com. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На +68 с посетитель нажал «Используйте только необходимые»: сайт записал действие Decline, а сохранённое состояние согласия (enrolled: false) дальше передаётся между поддоменами. После этого собственная телеметрия Wolt на gatekeeper.wolt.com шесть раз отправляет пакеты событий — начало и конец сеанса, просмотры страниц с их адресами. В каждом пакете есть отпечаток браузера browser_fingerprint, идентификатор устройства device_id, пользовательский идентификатор wolt_uid, модель устройства и язык. Отпечаток один и тот же на explore.wolt.com и life.wolt.com, то есть посетитель узнаётся на разных поддоменах и после отказа. Одновременно сервис Avo Inspector получает описания тех же событий с идентификаторами сеанса. Собственный баннер Wolt описывает категорию «Аналитика» как технологии, позволяющие понять, как используются платформы. Именно её посетитель отклонил. Туда же после отказа уходит постоянный идентификатор посетителя в систему экспериментов DoorDash — тот же visitor_id, который был отправлен до какого-либо выбора. 2) Баннер предлагает аналитику как отдельную категорию, выключенную по умолчанию, то есть на основании согласия. Политика конфиденциальности относит анализ использования сервисов к законному интересу, а о снятии отпечатка браузера не говорит вовсе — только о «псевдонимизированных идентификаторах». Посетитель, отказавшийся от аналитики в баннере, не может узнать из политики, что его отказ собственную телеметрию Wolt не останавливает. Таблица поставщиков в политике перечисляет 24 сервиса — от Google Analytics до Reddit Pixel. Но в ней нет ни Avo, который в замере получает данные о событиях, ни Datadog, чей сценарий грузится на страницах explore и life. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-wolt-com/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — wolt.com To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website wolt.com. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) At +68 s, the visitor clicked 'Use only necessary': the site recorded a Decline action, and the saved consent state (enrolled: false) is then passed between subdomains. After that, Wolt's own telemetry on gatekeeper.wolt.com sends event packets six times — session start and end, page views with their addresses. Every packet contains a browser fingerprint (browser_fingerprint), a device identifier (device_id), a user identifier (wolt_uid), the device model, and the language. The fingerprint is identical on explore.wolt.com and life.wolt.com, meaning the visitor is recognised across subdomains even after refusal. At the same time, the Avo Inspector service receives descriptions of the same events along with session identifiers. Wolt's own banner describes the 'Analytics' category as technologies that help understand how the platforms are used. That is exactly what the visitor declined. After refusal, the visitor's persistent identifier is also sent to DoorDash's experimentation system — the same visitor_id that was sent before any choice was made. 2) The banner offers analytics as a separate category, switched off by default, i.e. based on consent. The privacy policy classifies analysis of service usage as a legitimate interest and says nothing at all about browser fingerprinting — only about 'pseudonymized identifiers'. A visitor who declined analytics in the banner cannot learn from the policy that their refusal does not stop Wolt's own telemetry. The vendor table in the policy lists 24 services, from Google Analytics to Reddit Pixel. But it includes neither Avo, which receives event data in the capture, nor Datadog, whose script loads on the explore and life pages. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-wolt-com/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — wolt.com Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi wolt.com kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) +68 s juures vajutas külastaja „Kasuta ainult vajalikke“: veebileht salvestas toimingu Decline ning salvestatud nõusoleku olek (enrolled: false) edastatakse edasi alamdomeenide vahel. Pärast seda saadab Wolti enda telemeetria aadressile gatekeeper.wolt.com kuus korda sündmuste pakette – seansi algus ja lõpp, lehevaatamised koos lehtede aadressidega. Igas paketis on brauseri sõrmejälg browser_fingerprint, seadme identifikaator device_id, kasutaja identifikaator wolt_uid, seadme mudel ja keel. Sõrmejälg on sama nii explore.wolt.com-is kui ka life.wolt.com-is, st külastaja tuvastatakse eri alamdomeenidel ka pärast keeldumist. Samal ajal saab teenus Avo Inspector samade sündmuste kirjeldused koos seansi identifikaatoritega. Wolti enda bänner kirjeldab kategooriat „Analüütika“ kui tehnoloogiaid, mis aitavad mõista, kuidas platvorme kasutatakse. Just sellest keeldus külastaja. Pärast keeldumist saadetakse ka DoorDashi eksperimendisüsteemi külastaja püsiv identifikaator – sama visitor_id, mis saadeti enne mis tahes valikut. 2) Bänner pakub analüütikat eraldi kategooriana, mis on vaikimisi välja lülitatud, st nõusoleku alusel. Privaatsusteade liigitab teenuste kasutamise analüüsi õigustatud huvi alla ega räägi brauseri sõrmejälje võtmisest üldse – üksnes „pseudonüümitud identifikaatoritest“. Bänneris analüütikast keeldunud külastaja ei saa privaatsusteatest teada, et tema keeldumine Wolti enda telemeetriat ei peata. Privaatsusteate teenusepakkujate tabel loetleb 24 teenust – Google Analyticsist Reddit Pixelini. Kuid selles ei ole ei Avot, kes mõõtmise käigus saab andmeid sündmuste kohta, ega Datadogi, mille skript laaditakse explore ja life lehtedel. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-wolt-com/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — wolt.com 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом wolt.com. 2. Обстоятельства Я посетил сайт wolt.com и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 27.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На +68 с посетитель нажал «Используйте только необходимые»: сайт записал действие Decline, а сохранённое состояние согласия (enrolled: false) дальше передаётся между поддоменами. После этого собственная телеметрия Wolt на gatekeeper.wolt.com шесть раз отправляет пакеты событий — начало и конец сеанса, просмотры страниц с их адресами. В каждом пакете есть отпечаток браузера browser_fingerprint, идентификатор устройства device_id, пользовательский идентификатор wolt_uid, модель устройства и язык. Отпечаток один и тот же на explore.wolt.com и life.wolt.com, то есть посетитель узнаётся на разных поддоменах и после отказа. Одновременно сервис Avo Inspector получает описания тех же событий с идентификаторами сеанса. Собственный баннер Wolt описывает категорию «Аналитика» как технологии, позволяющие понять, как используются платформы. Именно её посетитель отклонил. Туда же после отказа уходит постоянный идентификатор посетителя в систему экспериментов DoorDash — тот же visitor_id, который был отправлен до какого-либо выбора. 2) Баннер предлагает аналитику как отдельную категорию, выключенную по умолчанию, то есть на основании согласия. Политика конфиденциальности относит анализ использования сервисов к законному интересу, а о снятии отпечатка браузера не говорит вовсе — только о «псевдонимизированных идентификаторах». Посетитель, отказавшийся от аналитики в баннере, не может узнать из политики, что его отказ собственную телеметрию Wolt не останавливает. Таблица поставщиков в политике перечисляет 24 сервиса — от Google Analytics до Reddit Pixel. Но в ней нет ни Avo, который в замере получает данные о событиях, ни Datadog, чей сценарий грузится на страницах explore и life. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-wolt-com/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — телеметрия с отпечатком браузера после отказа; GDPR Art. 13(1)(c), 13(1)(e) / Art. 5(1)(a) — политика и баннер описывают аналитику по-разному, часть получателей не названа 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — wolt.com 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website wolt.com. 2. Circumstances I visited the website wolt.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 27 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) At +68 s, the visitor clicked 'Use only necessary': the site recorded a Decline action, and the saved consent state (enrolled: false) is then passed between subdomains. After that, Wolt's own telemetry on gatekeeper.wolt.com sends event packets six times — session start and end, page views with their addresses. Every packet contains a browser fingerprint (browser_fingerprint), a device identifier (device_id), a user identifier (wolt_uid), the device model, and the language. The fingerprint is identical on explore.wolt.com and life.wolt.com, meaning the visitor is recognised across subdomains even after refusal. At the same time, the Avo Inspector service receives descriptions of the same events along with session identifiers. Wolt's own banner describes the 'Analytics' category as technologies that help understand how the platforms are used. That is exactly what the visitor declined. After refusal, the visitor's persistent identifier is also sent to DoorDash's experimentation system — the same visitor_id that was sent before any choice was made. 2) The banner offers analytics as a separate category, switched off by default, i.e. based on consent. The privacy policy classifies analysis of service usage as a legitimate interest and says nothing at all about browser fingerprinting — only about 'pseudonymized identifiers'. A visitor who declined analytics in the banner cannot learn from the policy that their refusal does not stop Wolt's own telemetry. The vendor table in the policy lists 24 services, from Google Analytics to Reddit Pixel. But it includes neither Avo, which receives event data in the capture, nor Datadog, whose script loads on the explore and life pages. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-wolt-com/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — telemetry with a browser fingerprint after refusal; GDPR Art. 13(1)(c), 13(1)(e) / Art. 5(1)(a) — the policy and the banner describe analytics differently, and some recipients are not named 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil wolt.com. 2. Asjaolud Külastasin veebisaiti wolt.com ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 27.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) +68 s juures vajutas külastaja „Kasuta ainult vajalikke“: veebileht salvestas toimingu Decline ning salvestatud nõusoleku olek (enrolled: false) edastatakse edasi alamdomeenide vahel. Pärast seda saadab Wolti enda telemeetria aadressile gatekeeper.wolt.com kuus korda sündmuste pakette – seansi algus ja lõpp, lehevaatamised koos lehtede aadressidega. Igas paketis on brauseri sõrmejälg browser_fingerprint, seadme identifikaator device_id, kasutaja identifikaator wolt_uid, seadme mudel ja keel. Sõrmejälg on sama nii explore.wolt.com-is kui ka life.wolt.com-is, st külastaja tuvastatakse eri alamdomeenidel ka pärast keeldumist. Samal ajal saab teenus Avo Inspector samade sündmuste kirjeldused koos seansi identifikaatoritega. Wolti enda bänner kirjeldab kategooriat „Analüütika“ kui tehnoloogiaid, mis aitavad mõista, kuidas platvorme kasutatakse. Just sellest keeldus külastaja. Pärast keeldumist saadetakse ka DoorDashi eksperimendisüsteemi külastaja püsiv identifikaator – sama visitor_id, mis saadeti enne mis tahes valikut. 2) Bänner pakub analüütikat eraldi kategooriana, mis on vaikimisi välja lülitatud, st nõusoleku alusel. Privaatsusteade liigitab teenuste kasutamise analüüsi õigustatud huvi alla ega räägi brauseri sõrmejälje võtmisest üldse – üksnes „pseudonüümitud identifikaatoritest“. Bänneris analüütikast keeldunud külastaja ei saa privaatsusteatest teada, et tema keeldumine Wolti enda telemeetriat ei peata. Privaatsusteate teenusepakkujate tabel loetleb 24 teenust – Google Analyticsist Reddit Pixelini. Kuid selles ei ole ei Avot, kes mõõtmise käigus saab andmeid sündmuste kohta, ega Datadogi, mille skript laaditakse explore ja life lehtedel. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-wolt-com/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — telemeetria koos brauseri sõrmejäljega pärast keeldumist; IKÜM art 13 lg 1 p c ja e / art 5 lg 1 p a — privaatsusteade ja bänner kirjeldavad analüütikat erinevalt, osa vastuvõtjaid on nimetamata 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]