RU EN
www.
Technical audit · 2026-06-05

zone.ee

Estonia's Largest Hosting Provider — Domains, Hosting, Servers
EE

Policy changed — see what exactly · 2026-08-22 →

Estonia's largest hosting provider holds data for thousands of clients — and launches Matomo with session recording, Zendesk, and Trustpilot before the consent banner appears. GTM activates 105 ms before Cookiebot. The Cookie Declaration is detailed — the privacy policy is silent about half the recipients.

Timeline of the leak

+87 ms · prior to consent
Trustpilot (widget.trustpilot.com) — a review widget, data transmitted to Denmark/USA.
+133 ms · prior to consent
Matomo (a.zone.eu) — a self-hosted server. Runs HeatmapSessionRecording — heatmap and session recording.
+206 ms · prior to consent
Zendesk (static.zdassets.com) — the support chat widget. Data transmitted to the USA.
+566 ms · prior to consent
zonehd.zendesk.com — frontendevents/pv — Zendesk records a pageview prior to consent.
+793 ms · prior to consent
Google Tag Manager (GTM-K8W4S8) — loads 105 ms before Cookiebot.
+898 ms · banner
Cookiebot loads. By this point, four external services are already active.
+984 ms · after the banner
Google Analytics (G-L9GLKJNJW7) via GTM — gtag/destination loads.
+1117 ms
Google Analytics collect — data is transmitted to the USA.

Declared versus actual

✓ Google Analytics — in the Cookie Declaration — заявлен
✓ Zendesk — in the Cookie Declaration — заявлен
✓ Matomo — in the Cookie Declaration (a.zone.eu) — заявлен
✓ Trustpilot — in the Cookie Declaration — заявлен
✓ Facebook — in the Cookie Declaration (not present in the HAR) — заявлен
✓ Hotjar — in the Cookie Declaration (not present in the HAR) — заявлен
✓ LinkedIn — in the Cookie Declaration (not present in the HAR) — заявлен
✓ YouTube — in the Cookie Declaration (not present in the HAR) — заявлен
✓ CrazyEgg — in the Cookie Declaration (not present in the HAR) — заявлен
✓ Google DoubleClick — in the Cookie Declaration (not present in the HAR) — заявлен
+ Trustpilot — not mentioned in the privacy policy — не заявлен
+ Matomo HeatmapSessionRecording — not mentioned in the policy — не заявлен
+ Zendesk — not mentioned in the privacy policy — не заявлен

Transfer timings

+87 ms widget.trustpilot.com

Trustpilot widget, data sent before the banner

+133 ms a.zone.eu

Matomo + HeatmapSessionRecording

+206 ms static.zdassets.com

Zendesk chat widget, USA

+566 ms zonehd.zendesk.com

Zendesk frontendevents pageview

+793 ms www.googletagmanager.com

GTM-K8W4S8, 105 ms before Cookiebot

+898 ms consent.cookiebot.com

Cookiebot appears

+1117 ms region1.google-analytics.com

GA4 G-L9GLKJNJW7 collect

Detected trackers

Indicators of GDPR non-compliance

Context

Zone Media OÜ is Estonia’s largest hosting provider: domains, web hosting, virtual servers, and cloud solutions. It holds data for thousands of Estonian companies and private clients — including website data, databases, and email. As an infrastructure company, it processes sensitive data both as a controller in its own right and as an authorized processor. HAR: 51 requests, 10 domains.

Two documents — different levels of detail

Zone has two documents: a privacy policy and a Cookie Declaration (Cookiebot). The Cookie Declaration is detailed and current — last updated 03.06.2026. It discloses Google Analytics, Zendesk, Matomo, Trustpilot, Facebook Pixel, Hotjar, LinkedIn, YouTube, CrazyEgg, and Google DoubleClick — 10 categories of recipients. The privacy policy, by contrast, is written in general terms: it mentions cookies and “tracking technologies” without listing specific recipients. Under GDPR Art. 13(1)(e), it is the privacy policy that must contain information about recipients — a Cookie Declaration does not substitute for it.

Cookiebot appears at +898 ms. By this point, four external services are already active:

Trustpilot (+87 ms) — the review widget loads first, 811 ms before the banner.

Matomo (+133 ms, a.zone.eu) — Zone’s own server, which is itself a point in its favor. But at the same time, HeatmapSessionRecording launches — a plugin that records heatmaps and user sessions. This is not basic analytics: the system captures every mouse movement and click on the page prior to consent.

Zendesk (+206 ms, static.zdassets.com) — the support chat widget, with servers in the USA. At +566 ms, zonehd.zendesk.com sends frontendevents/pv — a pageview event — also prior to the banner.

Google Tag Manager (+793 ms, GTM-K8W4S8) — loads 105 ms before Cookiebot. After the banner appears, Google Analytics (G-L9GLKJNJW7) activates via GTM, with the collect call going out at +1117 ms.

The Cookie Declaration discloses Facebook Pixel, Hotjar, LinkedIn, YouTube, CrazyEgg, and Google DoubleClick. None of these appeared in this session’s HAR. They may activate on other pages or after consent — but declaring services that were not actually observed warrants a separate check.

Sensitivity context

Zone is a hosting provider. Clients entrust it not merely with an email address but with the server infrastructure of their businesses. The compliance standard for a company that sells trust as a product should be above average. Session recording via HeatmapSessionRecording prior to consent, on a hosting provider’s own site, is not a technically difficult problem to fix. It is a question of priorities.

Conclusion

Zone’s Cookie Declaration is current and detailed — a rarity in this series. But a detailed declaration does not compensate for launching trackers prior to consent. Matomo with session recording, Zendesk, and Trustpilot activate hundreds of milliseconds before the banner appears. GTM activates 105 ms before Cookiebot. The privacy policy names none of these recipients. The gap between what is declared and what actually happens prior to consent is the core problem.

Evidence
Original (audit)
HAR file: ee/zone-ee-2026-06-05.har
SHA-256: b8d09f22f1d11ce0bdb9db15cc0535e6fe3ff902df1213a8b7273199fad74988
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website zone.ee.

2. Circumstances
I visited the website zone.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 5 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) Trustpilot (+87 ms), Zendesk (+206 ms), and Matomo with session recording (+133 ms) launch before the Cookiebot banner appears (+898 ms). Google Tag Manager loads at +793 ms — also before Cookiebot. The GA collect call goes out at +1117 ms.

2) The Cookiebot banner appears 898 ms after the session begins. By this point, Trustpilot, Zendesk, Matomo, and GTM are already active. There is no genuine mechanism blocking these prior to consent.

3) The privacy policy does not mention Trustpilot, Matomo (a.zone.eu with HeatmapSessionRecording), or Zendesk as data recipients. The Cookie Declaration discloses them; the privacy policy does not.

4) Zendesk (static.zdassets.com, zonehd.zendesk.com) — servers located in the USA. Trustpilot — Denmark/USA. No data-transfer mechanism is specified in the privacy policy.

5) Matomo runs HeatmapSessionRecording — recording heatmaps and user sessions. This goes beyond basic traffic analytics and requires a separate legal basis.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-zone-ee/

3. Provisions violated
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 5(1)(c)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]