RU EN
www.
Technical audit · 2026-06-15

investlithuania.com

Investment promotion agency
LT

Policy changed — see what exactly · 2026-07-11 →

Lithuania's investment promotion agency — 205 requests, 35 domains. The Cookiebot consent manager exists only in configuration and does not actually fire; before consent, roughly sixteen services launch — advertising from Google, Bing, Meta, LinkedIn, Twitter, session recording via Clarity and Hotjar, and visitor identification via Leadfeeder, Koala, and Pardot. Some of these services aren't even named in the extensive policy.

Timeline of the leak

+199 ms · mailing and maps
static.mailerlite.com (mailing form) and maps.googleapis.com (Google Maps) — the first external requests.
+372–430 ms · A/B, Bing, GTM
api.nelioabtesting.com (A/B), bat.bing.com (Microsoft Bing Ads), www.googletagmanager.com (GTM).
session state — no consent given
Cookiebot exists only in configuration; there is no actual request to it. Zero Set-Cookie headers for the entire session, and no user choice was made.
+1120–1167 ms · analytics, advertising, session recording
GA4, Meta Pixel, LinkedIn Ads, Twitter/X Ads, Hotjar, Microsoft Clarity, Leadfeeder, Koala — a cluster of advertising, behavioral, and identification services.
+1809–4203 ms · reCAPTCHA, Google Ads, Pardot
Google reCAPTCHA, pagead2.googlesyndication (Google Ads/AdSense), pi.pardot.com (Salesforce Pardot).

Declared versus actual

✓ The extensive policy (consent-based model, sutikimas appears 129 times) names Google, Meta, LinkedIn, Twitter, Hotjar, Leadfeeder, reCAPTCHA — заявлен
✓ Cookiebot is indicated as the consent manager — заявлен
+ The entire advertising/analytics stack fires before consent — не заявлен
+ Microsoft Clarity, Koala, Salesforce Pardot, Nelio A/B, Nrich, MailerLite — not named in the policy — не заявлен
+ Cookiebot does not fire in the scan (present only in configuration) — не заявлен

Transfer timings

+379 ms bat.bing.com

Microsoft Bing Ads UET. US.

+1120 ms www.google-analytics.com

Google Analytics 4. US.

+1125 ms connect.facebook.net

Meta/Facebook Pixel. US.

+1156 ms lftracker.leadfeeder.com

Leadfeeder — B2B visitor identification.

+1167 ms www.clarity.ms

Microsoft Clarity — session recording. Not named in the policy.

+4203 ms pi.pardot.com

Salesforce Pardot — B2B automation. Not named in the policy.

Detected trackers

Indicators of GDPR non-compliance

Context

investlithuania.com is the site of Invest Lithuania (VšĮ “Investuok Lietuvoje”), the state agency for attracting foreign investment. The data controller is Investuok Lietuvoje. An extensive privacy policy was provided (approximately 47,700 characters). Scan: 205 requests, 35 domains, captured in a clean browser.

Google, Microsoft, Meta, LinkedIn, Twitter/X, Hotjar (all US) — advertising, analytics, and session recording; Leadfeeder, Koala, Salesforce Pardot — visitor identification.

Declared versus actual

Invest Lithuania’s policy is built on consent — the Lithuanian term sutikimas appears in it 129 times — and, unlike many audits, it is detailed: it explicitly names Google, Meta, LinkedIn, Twitter, Hotjar, Leadfeeder, and reCAPTCHA. Cookiebot is named as the consent manager.

The scan, however, shows that the consent mechanism does not work in this session: there is no actual request to Cookiebot, it exists only in the page’s configuration, and no consent is recorded (zero Set-Cookie headers). Meanwhile, before any choice, roughly sixteen third-party services launch. Advertising: Google Ads/AdSense, Microsoft Bing Ads, Meta Pixel, LinkedIn Ads, Twitter/X Ads. Analytics: Google Analytics 4, Google Maps, reCAPTCHA. Session and behavior recording: Microsoft Clarity and Hotjar. Corporate-visitor identification: Leadfeeder, Koala, and Salesforce Pardot. Plus the Nelio A/B tool, the Nrich service, and MailerLite mailing. All of them fire within the +199…+4203 ms window, before consent.

The discrepancy is twofold. First, this entire set activates contrary to the declared consent model. Second, some of the services actually in operation aren’t even named in the extensive policy: Microsoft Clarity, Koala, Salesforce Pardot, Nelio A/B, Nrich, and MailerLite. The simultaneous operation of three visitor de-anonymization services (Leadfeeder, Koala, Pardot) before consent stands out in particular.

The first external requests occur as early as +199 ms; the main cluster of advertising, session recording, and identification fires at +1120…+1167 ms; individual services (Pardot) fire as late as +4203 ms. The consent manager does not fire in the scan, and consent was not given (zero Set-Cookie headers) — the entire stack operates before the user’s choice.

What cannot be claimed from this scan

The scan covers the homepage. Visitor identifiers are not published. The absence of a request to Cookiebot in this session may indicate a loading failure, a block, or a different configuration; the fact recorded by the scan is that no consent result was requested, yet the stack fired. The role of individual services (Nrich) as tracking tools was assessed based on domain. Recipients may use edge nodes within the EU, so the conclusion regarding their affiliation is based on company origin. Server-side processing is not visible in a browser-based scan.

Conclusion

The state investment-promotion agency’s site launches an exceptionally extensive stack before consent — advertising from five networks (Google, Bing, Meta, LinkedIn, Twitter/X), analytics, session recording (Clarity, Hotjar), and simultaneously three corporate-visitor de-anonymization services (Leadfeeder, Koala, Pardot). The Cookiebot consent manager does not fire in the scan, no consent is recorded, and some services are undisclosed even in the detailed policy. The combination of advertising, behavioral, and identification services firing before consent, mass transfer of data to recipients in the US, and incomplete disclosure constitutes a violation of the requirements on prior consent, disclosure of recipients, and cross-border transfer. Remediation: ensure the consent manager actually works, with real blocking of all non-technical services until consent; prevent advertising, session recording, and visitor identification from firing before the choice is made; supplement the policy with the undisclosed services (Microsoft Clarity, Koala, Salesforce Pardot, Nelio, Nrich, MailerLite).

Evidence
Original (audit)
HAR file: lt/investlithuania-com-2026-06-15.har
SHA-256: 95ebc4ccc5f2102a617dda55c11ed2eac602d439af225afb177193bf84fdb25c
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: State Data Protection Inspectorate (ADA) — ada.lt

To: State Data Protection Inspectorate (ADA)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website investlithuania.com.

2. Circumstances
I visited the website investlithuania.com and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) In the scan, the Cookiebot consent manager is present only in the page's configuration, but there is no actual request to it, and no consent is recorded (zero Set-Cookie headers). Before consent, the entire advertising/analytics stack fires: Google Ads/AdSense, GA4, Bing Ads, Meta Pixel, LinkedIn Ads, Twitter/X Ads (advertising and analytics), Microsoft Clarity and Hotjar (session recording), Leadfeeder, Koala, and Salesforce Pardot (visitor identification), Nelio (A/B), MailerLite. The policy is built on consent (the term sutikimas appears 129 times), but in practice the services activate before the choice.

2) The extensive policy names some of the services (Google, Meta, LinkedIn, Twitter, Hotjar, Leadfeeder, reCAPTCHA), but a number of services actually in operation are not mentioned in it: Microsoft Clarity, Koala, Salesforce Pardot, Nelio A/B, Nrich, MailerLite.

3) Before consent, data is transmitted to numerous recipients in the US: Google, Microsoft (Bing Ads and Clarity), Meta, LinkedIn, Twitter/X, Hotjar, and others. The transfer occurs without consent.

4) Before consent, three corporate-visitor de-anonymization services operate simultaneously, based on IP and behavior — Leadfeeder, Koala, and Salesforce Pardot. On the site of an agency courting foreign investors, this makes it possible to link visits to specific companies before consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/lt-investlithuania-com/

3. Provisions violated
ePrivacy (Lithuanian implementation) + GDPR Art. 6(1) — trackers before consent; GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Chapter V — cross-border transfer; Visitor identification — Leadfeeder, Koala, Pardot

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]