The site of the CookieScript consent management platform — a single capture of a blog page, 93 requests, 16 nodes. What is notable is that this is the site of the CMP's own developer (Objectis, UAB), with its own product installed on it. Google analytics and advertising respect the denial — GA4 and Google Ads carry status gcs=G100, cookieless. But two advertising pixels actually send events around the in-house consent mechanism: the Facebook pixel sends /tr, and LinkedIn Ads sends wa/ and collect. Both do not know consent mode. And LinkedIn is not named in the policy by name, although Google, Meta and Customerly are named.
Request timeline
+668…+1265 ms · container before the in-house CMP
www.googletagmanager.com/gtm.js (+668 ms) — before the in-house CookieScript (cdn.cookie-script.com, +1265 ms). The tag manager initialises before the same vendor's consent platform.
+1265 ms · in-house CookieScript CMP
cdn.cookie-script.com/s/…js — the consent platform (the in-house product). No consent decision is recorded in the capture; GA's status is gcs=G100.
+1273…+1712 ms · advertising pixels send events
connect.facebook.net/fbevents.js (+1273 ms), signals/config/241710402319437 (+1396 ms), www.facebook.com/tr POST (+1478 ms — event sent); snap.licdn.com/insight.min.js (+1276 ms), px.ads.linkedin.com/wa/ POST and /collect (+1692…+1712 ms — LinkedIn Ads sends). GA4 and Google Ads — gcs=G100, cookieless.
+5119…+5241 ms · Customerly
chat.customerly.io/v3/ping and v3/analytics/collect — the Customerly chat/CRM sends analytics.
Declared versus actual
✓Controller — Objectis, UAB (reg. 304037472, Laisves 60, Vilnius, Lithuania) — the developer of CookieScript — declared
+The LinkedIn Ads advertising pixel (actively sends wa/, collect) is not named in the policy by name — not declared
+The Facebook and LinkedIn Ads pixels send events around the in-house consent mechanism — not declared
+The GTM container loads before the in-house CMP — not declared
Transfer timings
+668 mswww.googletagmanager.com
GTM before the cookie-script.com CMP (+1265 ms).
+1478 mswww.facebook.com
/tr POST, id 241710402319437; content in the body (redacted).
+1692 mspx.ads.linkedin.com
wa/ (POST) and collect; not named in the policy.
+1340 msregion1.google-analytics.com
GA4 page_view, gcs=G100.
Detected trackers
CookieScript (cdn.cookie-script.com — the company's own product) — consent management platform; the in-house script loads at +1265 ms. Controller — Objectis, UAB (the developer of CookieScript)
Facebook / Meta (connect.facebook.net, www.facebook.com — pixel id 241710402319437) — advertising pixel; a /tr POST event was actually sent at +1478 ms (the content is in the body, redacted). Meta is named in the policy
LinkedIn Ads (snap.licdn.com, px.ads.linkedin.com) — LinkedIn advertising pixel; insight.min.js at +1276 ms, then POST px.ads.linkedin.com/wa/ and /collect (+1692…+1712 ms) — an actual send. NOT named in the policy by name
Google Analytics 4 (region1.google-analytics.com) — analytics; page_view, scroll with status gcs=G100 (both storages denied), cookieless. The denial is respected
Google Ads / Conversion (pagead2.googlesyndication.com/ccm/collect) — measurement; +1280 ms, gcs=G100. The denial is respected
Google Tag Manager (www.googletagmanager.com) — tag container; +668 ms, before the in-house CMP
Customerly (messenger/chat/pictures/blackhole.customerly.io) — chat and CRM; sends analytics/collect (+5241 ms). Named in the policy
First party and infrastructure: cookie-script.com, Google fonts
Indicators of GDPR non-compliance
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Facebook and LinkedIn advertising pixels send events around the in-house consent mechanism
The site belongs to the developer of the CookieScript consent management platform (Objectis, UAB), and its own product is installed on it (cdn.cookie-script.com, +1265 ms). Google analytics and advertising meanwhile respect the denial: GA4 and Google Ads carry status gcs=G100 (both storages denied), cookieless. However, two advertising pixels actually send events without being held back by gating: the Facebook pixel (id 241710402319437) sends a /tr POST at +1478 ms (the content is in the request body, redacted during cleaning), and the LinkedIn Ads pixel sends px.ads.linkedin.com/wa/ (POST) and /collect at +1692…+1712 ms. Both do not know Google's consent mode and operate independently; the GTM container meanwhile loads at +668 ms — before the in-house CMP. That is, on the site of the very maker of the consent mechanism the Facebook and LinkedIn advertising pixels transfer data around that mechanism.
GDPR Art. 13(1)(e) — LinkedIn not disclosed
The privacy policy (Objectis, UAB) names recipients: Google, Meta, Stripe, Customerly. However, the LinkedIn Ads pixel (snap.licdn.com, px.ads.linkedin.com), which actively sends events in the capture (wa/, collect), is not named in the policy by name. Facebook is disclosed as Meta, Customerly and Google are named, but LinkedIn is not.
Context
cookie-script.com is the site of the CookieScript consent management platform. The controller is Objectis, UAB (reg. code 304037472, Laisves str. 60, Vilnius, Lithuania) — that is, the developer of the product itself. What is notable about the case is that this is the site of the vendor of the consent mechanism, with its own product installed on it. The processing is described by a privacy policy.
The capture is a single recording of a blog page (/blog/cookieinformation-alternative-cookiescript): 93 requests, 16 nodes.
Who data goes to directly
The Facebook and LinkedIn Ads advertising pixels (both actually send events). Google Analytics and Google Ads (under denial, gcs=G100, cookieless). The in-house CookieScript CMP. The Customerly chat/CRM. Functionally — fonts. The requests to edge.microsoft.com/translate are a capture-tool artefact (translation in the browser).
Declared versus actual
The discrepancy here is all the more noticeable because this is the site of the maker of the consent mechanism itself.
Google analytics respect the denial. The GA4 events (page_view, scroll) and Google Ads (ccm/collect) carry status gcs=G100 — both storages denied, cookieless. This is correct behaviour when consent has not been given.
But the Facebook and LinkedIn advertising pixels send events. The Facebook pixel (id 241710402319437) sends a /tr POST at +1478 ms — the event was actually sent (the content is in the request body, redacted during cleaning, so the specifics cannot be read). The LinkedIn Ads pixel sends px.ads.linkedin.com/wa/ (POST) and /collect at +1692…+1712 ms. Both pixels do not know Google’s consent mode and operate independently of it; the in-house CookieScript CMP (cdn.cookie-script.com) loads at +1265 ms, and the GTM container earlier, at +668 ms. That is, on the site of the consent-platform vendor the Facebook and LinkedIn advertising pixels transfer data without being held back by gating on the decision.
And LinkedIn is not disclosed. The privacy policy names Google, Meta, Stripe, Customerly. Facebook is present as Meta, Customerly and Google are named. But LinkedIn Ads, which actively sends events in the capture, is not mentioned in the policy by name.
Consent: what is proven and what is not
Proven: Google analytics respect the denial. All GA4 and Google Ads requests carry gcs=G100, cookielessly.
Proven: the Facebook pixel sent an event.www.facebook.com/tr POST at +1478 ms, pixel id 241710402319437.
Proven: LinkedIn Ads sent events.px.ads.linkedin.com/wa/ (POST) and /collect at +1692…+1712 ms.
Proven: GTM loads before the in-house CMP. GTM — +668 ms, CookieScript — +1265 ms.
Proven: LinkedIn is not named in the policy. A search of the document finds Google, Meta, Customerly, but not LinkedIn.
Not established: the consent decision. The choice is not recorded in the capture; gcs=G100 indicates a denied state. The Facebook and LinkedIn sends meanwhile took place independently of the Google consent-mode status.
Not proven: the content of the Facebook and LinkedIn events. The bodies of the POST requests in the published file are redacted; the endpoints and the pixel id are readable, not the values.
Observation boundaries
The capture covers a single blog page and records browser behaviour, not server-side processing: what Meta and LinkedIn do with the received data and how CookieScript’s gating is configured on the site’s side is not verified by a browser capture. What is established: the Facebook pixel and the LinkedIn Ads pixel send events; GA/Ads run under denial. The requests to edge.microsoft.com are attributed to capture-tool artefacts. Customerly is attributed to the chat/CRM.
The file is published cleaned of personal data (178 redactions, self-check clean); the sending of Facebook /tr and LinkedIn wa//collect, the gcs=G100 status of GA/Ads and the loading of the in-house CMP can be verified directly against the published file. There are no banner screenshots in the set — the state of the banner UI in this capture is not recorded.
The legal assessment is made by the competent authority — the Lithuanian supervisory authority (VDAI).
Conclusion
The site belongs to the developer of the consent management platform, and its own product is installed on it. This mechanism holds Google analytics correctly — GA4 and Google Ads run under denial (gcs=G100, cookieless). But two advertising pixels bypass this frame: the Facebook pixel sends /tr, and LinkedIn Ads sends wa/ and collect, both actually transferring events and not knowing Google’s consent mode. The GTM container meanwhile loads before the in-house CMP.
Separately: LinkedIn Ads, actively sending events, is not named in the policy — even though Google, Meta and Customerly are. The observation does not qualify intent and does not compare the site with others — it merely records that on the site of the consent-mechanism vendor too, the Facebook and LinkedIn advertising pixels transfer data around that mechanism, and one of the recipients is not disclosed.
Remediation: condition the firing of the Facebook and LinkedIn Ads pixels on actual consent, so that they do not send events before the choice and outside consent mode; gate the GTM container and the advertising pixels through the in-house CMP; name LinkedIn Ads in the policy as a recipient with its purpose stated; preserve the correct consent mode of the Google stack and extend the gating principle to the advertising pixels.
Evidence
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
Step 1. Data access request (GDPR Art. 15)
Save PDF — then sign it:DigiDoc4 — computer · Smart-ID / Mobile-ID RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — cookie-script.com
Кому: [укажите адрес компании — DPO / поддержка / юридический отдел]
От: [Ваше имя], [контактный email]
Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта cookie-script.com.
1. Категории данных и цели обработки (ст. 15(1)(a)-(c))
На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки:
1) Сайт принадлежит разработчику платформы управления согласием CookieScript (Objectis, UAB), и на нём стоит его же продукт (cdn.cookie-script.com, +1265 мс). Аналитика и реклама Google при этом запрет соблюдают: GA4 и Google Ads идут со статусом gcs=G100 (оба хранилища запрещены), бескуково. Однако два рекламных пикселя фактически отправляют события, не будучи удержаны гейтингом: Facebook-пиксель (id 241710402319437) отправляет /tr POST на +1478 мс (содержимое в теле запроса, вычищено при очистке), а рекламный пиксель LinkedIn Ads отправляет px.ads.linkedin.com/wa/ (POST) и /collect на +1692…+1712 мс. Оба режима согласия Google не знают и работают независимо; контейнер GTM при этом грузится на +668 мс — раньше собственного CMP. То есть на сайте самого производителя механизма согласия рекламные пиксели Facebook и LinkedIn передают данные вокруг этого механизма.
2) Политика конфиденциальности (Objectis, UAB) называет получателей: Google, Meta, Stripe, Customerly. Однако рекламный пиксель LinkedIn Ads (snap.licdn.com, px.ads.linkedin.com), который в замере активно отправляет события (wa/, collect), в политике по имени не назван. Facebook раскрыт как Meta, Customerly и Google названы, но LinkedIn — нет.
2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46)
Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/global-cookie-script-com/
3. Автоматизированная обработка и профилирование (ст. 15(1)(h))
Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки.
С уважением,
[Ваше имя]
[контактный email]
[Страна]
[Дата]
Subject: Data access request (GDPR Art. 15) — cookie-script.com
To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]
I request access to my personal data processed in connection with the website cookie-script.com.
1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:
1) The site belongs to the developer of the CookieScript consent management platform (Objectis, UAB), and its own product is installed on it (cdn.cookie-script.com, +1265 ms). Google analytics and advertising meanwhile respect the denial: GA4 and Google Ads carry status gcs=G100 (both storages denied), cookieless. However, two advertising pixels actually send events without being held back by gating: the Facebook pixel (id 241710402319437) sends a /tr POST at +1478 ms (the content is in the request body, redacted during cleaning), and the LinkedIn Ads pixel sends px.ads.linkedin.com/wa/ (POST) and /collect at +1692…+1712 ms. Both do not know Google's consent mode and operate independently; the GTM container meanwhile loads at +668 ms — before the in-house CMP. That is, on the site of the very maker of the consent mechanism the Facebook and LinkedIn advertising pixels transfer data around that mechanism.
2) The privacy policy (Objectis, UAB) names recipients: Google, Meta, Stripe, Customerly. However, the LinkedIn Ads pixel (snap.licdn.com, px.ads.linkedin.com), which actively sends events in the capture (wa/, collect), is not named in the policy by name. Facebook is disclosed as Meta, Customerly and Google are named, but LinkedIn is not.
2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/global-cookie-script-com/
3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the
Methodology.
Ready-to-send complaint letter
Save PDF — then sign it:DigiDoc4 — computer · Smart-ID / Mobile-ID RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Jurisdiction determined under Art. 3(2) GDPR —
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — cookie-script.com
1. Предмет жалобы
Я подаю жалобу в отношении обработки моих персональных данных сайтом cookie-script.com.
2. Обстоятельства
Я посетил сайт cookie-script.com и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 13.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки:
1) Сайт принадлежит разработчику платформы управления согласием CookieScript (Objectis, UAB), и на нём стоит его же продукт (cdn.cookie-script.com, +1265 мс). Аналитика и реклама Google при этом запрет соблюдают: GA4 и Google Ads идут со статусом gcs=G100 (оба хранилища запрещены), бескуково. Однако два рекламных пикселя фактически отправляют события, не будучи удержаны гейтингом: Facebook-пиксель (id 241710402319437) отправляет /tr POST на +1478 мс (содержимое в теле запроса, вычищено при очистке), а рекламный пиксель LinkedIn Ads отправляет px.ads.linkedin.com/wa/ (POST) и /collect на +1692…+1712 мс. Оба режима согласия Google не знают и работают независимо; контейнер GTM при этом грузится на +668 мс — раньше собственного CMP. То есть на сайте самого производителя механизма согласия рекламные пиксели Facebook и LinkedIn передают данные вокруг этого механизма.
2) Политика конфиденциальности (Objectis, UAB) называет получателей: Google, Meta, Stripe, Customerly. Однако рекламный пиксель LinkedIn Ads (snap.licdn.com, px.ads.linkedin.com), который в замере активно отправляет события (wa/, collect), в политике по имени не назван. Facebook раскрыт как Meta, Customerly и Google названы, но LinkedIn — нет.
Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/global-cookie-script-com/
3. Положения GDPR, соблюдение которых прошу проверить
ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — рекламные пиксели Facebook и LinkedIn отправляют события вокруг собственного механизма согласия; GDPR Art. 13(1)(e) — LinkedIn не раскрыт
4. Требование
Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR.
5. Приложения
Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше.
С уважением,
[Ваше имя]
[контактный email]
[Страна]
[Дата]
Subject: Complaint regarding personal data processing — cookie-script.com
1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website cookie-script.com.
2. Circumstances
I visited the website cookie-script.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 September 2026 (open methodology, reproducible measurements) documents the following indications:
1) The site belongs to the developer of the CookieScript consent management platform (Objectis, UAB), and its own product is installed on it (cdn.cookie-script.com, +1265 ms). Google analytics and advertising meanwhile respect the denial: GA4 and Google Ads carry status gcs=G100 (both storages denied), cookieless. However, two advertising pixels actually send events without being held back by gating: the Facebook pixel (id 241710402319437) sends a /tr POST at +1478 ms (the content is in the request body, redacted during cleaning), and the LinkedIn Ads pixel sends px.ads.linkedin.com/wa/ (POST) and /collect at +1692…+1712 ms. Both do not know Google's consent mode and operate independently; the GTM container meanwhile loads at +668 ms — before the in-house CMP. That is, on the site of the very maker of the consent mechanism the Facebook and LinkedIn advertising pixels transfer data around that mechanism.
2) The privacy policy (Objectis, UAB) names recipients: Google, Meta, Stripe, Customerly. However, the LinkedIn Ads pixel (snap.licdn.com, px.ads.linkedin.com), which actively sends events in the capture (wa/, collect), is not named in the policy by name. Facebook is disclosed as Meta, Customerly and Google are named, but LinkedIn is not.
Full technical documentation is published at: https://gdpru.eu/en/audits/global-cookie-script-com/
3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Facebook and LinkedIn advertising pixels send events around the in-house consent mechanism; GDPR Art. 13(1)(e) — LinkedIn not disclosed
4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.
5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]
