RU EN
www.
Technical audit · 15.06.2026

varle.lt

Online electronics store
LT

The Varlė electronics online store, Lithuania — 166 requests, 32 domains. The Cookiebot consent manager loads at +10 seconds, while advertising, analytics, and session recording start at +3 seconds — before it. Before consent, GA4, Google Ads, Meta Pixel with server-side CAPI, Bing Ads, TikTok, Microsoft Clarity, and Hotjar all fire. Data goes out to recipients in the US.

Request timeline

+490 ms · fonts and libraries
fonts.gstatic.com (Google Fonts) and cdnjs.cloudflare.com.
+3035 ms · Google Tag Manager
www.googletagmanager.com — the tag container launches.
+3301–3327 ms · Meta, Bing, CAPI
connect.facebook.net (Meta Pixel), bat.bing.com (Bing Ads), and capig.datah04.com (server-side Conversions API) — advertising and server-side tracking.
+3457–3827 ms · GA4, DoubleClick, Clarity
region1.analytics.google.com (GA4 page_view), stats.g.doubleclick.net, www.facebook.com/tr (Meta PageView), www.clarity.ms (session recording).
+10322 ms · consent manager (severely delayed)
consent.cookiebot.com — Cookiebot loads seven seconds after trackers start and does not hold them back.
session state — no consent given
Zero Set-Cookie headers for the entire session, and no user choice was made.
+10333–13841 ms · TikTok, Omnisend, Octocom
analytics.tiktok.com (TikTok Pixel), omnisnippet1.com and forms.soundestlink.com (Omnisend), chat.octocom.ai (AI chat).

Declared versus actual

✓ A privacy policy was not provided as part of the package — declared
✓ The Cookiebot consent manager is present, but loads too late — declared
+ GA4, Google Ads, DoubleClick, Meta Pixel + server-side CAPI, Bing Ads, TikTok, Clarity, Hotjar, Omnisend, Octocom — before consent — not declared

Transfer timings

+3325 ms capig.datah04.com

Server-side Conversions API (Meta/TikTok). Bypasses client-side blocking.

+3457 ms region1.analytics.google.com

GA4 page_view (G-R9Y1176PTY). Google, US.

+3803 ms www.facebook.com

Meta Pixel PageView (474000569742910). US.

+3827 ms www.clarity.ms

Microsoft Clarity — session recording. US.

+10322 ms consent.cookiebot.com

Loads 7 seconds after trackers start.

Detected trackers

Indicators of GDPR non-compliance

Context

varle.lt is the site of Varlė, an online electronics and household-goods retailer and one of the major Lithuanian retail chains. The operator is UAB “Varlė.” A privacy policy was not provided as part of the package. Scan: 166 requests, 32 domains, captured in a clean browser.

Google (US) — GA4, Google Ads, DoubleClick; Meta (US) — Pixel and server-side CAPI; Microsoft (US) — Bing Ads and Clarity; TikTok — Pixel.

Declared versus actual

A privacy policy was not provided as part of this audit, so the assessment is based on the scan. The key fact is the loading order of the consent manager relative to the trackers.

Cookiebot, the consent mechanism, only loads at +10322 ms. By this point, the advertising/analytics stack has already run: Google Tag Manager launches at +3035 ms, the Meta Pixel, Microsoft Bing Ads, and the server-side Conversions API channel via capig.datah04.com at +3301–3327 ms, GA4 (identifier G-R9Y1176PTY) sends a page_view event at +3457 ms, the Meta Pixel (474000569742910) sends a PageView event at +3803 ms, and Microsoft Clarity begins recording user behavior at +3827 ms. Later, at +10–13 s, Hotjar, TikTok Pixel, the Omnisend email-marketing service, and the Octocom AI chat are added. All of this occurs in a no-consent state: not a single cookie was set during the entire session, and no user choice was made.

The server-side Conversions API channel (datah04.com) deserves particular attention: it transmits visitor data to the server bypassing browser-side blocking mechanisms, making such a transmission especially resistant to a refusal of consent. A consent manager is present on the site, but due to its late launch it effectively holds none of the listed services back.

Trackers start from +3035 ms, while the Cookiebot consent manager only starts from +10322 ms — seven seconds later. The loading order rules out the possibility of consent preceding the firing of advertising and analytics; consent was in fact not given in this session (zero Set-Cookie headers).

What cannot be claimed from this scan

The scan covers the homepage. Visitor identifiers are not published; service account identifiers relate to site configuration. The policy was not provided, so disclosure of recipients in the text was not checked; the violation finding rests on trackers firing before consent. Recipients may use edge nodes within the EU, so the conclusion regarding their affiliation is based on company origin (US companies). Server-side processing, beyond the explicitly observed CAPI channel, is not visible in a browser-based scan.

Conclusion

The Varlė online store deploys an extensive commercial stack before consent — GA4, Google Ads and DoubleClick, the Meta Pixel with an additional server-side Conversions API, Bing Ads, the TikTok Pixel, as well as the session-recording services Microsoft Clarity and Hotjar. The Cookiebot consent manager is present on the site, but loads seven seconds after trackers start and does not hold them back; the server-side CAPI channel additionally transmits data bypassing browser-side blocking. The firing of advertising, analytics, and session recording before consent, and the transmission of data to recipients in the US, indicate non-compliance with the requirements on prior consent and cross-border transfer. Remediation: reconfigure Cookiebot to load first and genuinely block all non-technical services until consent; disable the server-side CAPI until consent is obtained; prevent advertising pixels and session recording from firing before the user’s choice; publish a complete cookie policy with a list of recipients.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: lt/varle-lt-2026-06-15.har
SHA-256: 8fb0005b71fb38cc9de526ede7abedf59adf17932b42bfbc5b582e43dda3340b
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — varle.lt

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website varle.lt.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The Cookiebot consent manager only loads at +10322 ms, whereas the advertising/analytics stack already starts at +3301 ms — before the CMP has even loaded. Before consent, the following fire: GA4 (G-R9Y1176PTY, page_view event), Google Ads and DoubleClick, the Meta Pixel (474000569742910, PageView event) with an additional server-side Conversions API channel via capig.datah04.com, Microsoft Bing Ads, Microsoft Clarity (session recording), and Hotjar. Zero Set-Cookie headers for the entire session, and no user choice was made. TikTok Pixel, Omnisend, and the Octocom AI chat are added later (+10–13 s).

2) Before consent, data (page_view, URL, identifiers) is transmitted to recipients in the US: Google, Meta (client-side Pixel and server-side CAPI), Microsoft (Bing Ads and Clarity), TikTok. The server-side Conversions API channel (datah04.com) transmits data bypassing browser-side blocking.

3) A privacy policy was not provided as part of the package. Given the volume of actual processing (at least ten third-party services), the disclosure assessment is based on the scan; the actual recipients are numerous and include advertising networks and session-recording services.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/lt-varle-lt/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: State Data Protection Inspectorate (ADA) — ada.lt

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — varle.lt

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website varle.lt.

2. Circumstances
I visited the website varle.lt and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The Cookiebot consent manager only loads at +10322 ms, whereas the advertising/analytics stack already starts at +3301 ms — before the CMP has even loaded. Before consent, the following fire: GA4 (G-R9Y1176PTY, page_view event), Google Ads and DoubleClick, the Meta Pixel (474000569742910, PageView event) with an additional server-side Conversions API channel via capig.datah04.com, Microsoft Bing Ads, Microsoft Clarity (session recording), and Hotjar. Zero Set-Cookie headers for the entire session, and no user choice was made. TikTok Pixel, Omnisend, and the Octocom AI chat are added later (+10–13 s).

2) Before consent, data (page_view, URL, identifiers) is transmitted to recipients in the US: Google, Meta (client-side Pixel and server-side CAPI), Microsoft (Bing Ads and Clarity), TikTok. The server-side Conversions API channel (datah04.com) transmits data bypassing browser-side blocking.

3) A privacy policy was not provided as part of the package. Given the volume of actual processing (at least ten third-party services), the disclosure assessment is based on the scan; the actual recipients are numerous and include advertising networks and session-recording services.

Full technical documentation is published at: https://gdpru.eu/en/audits/lt-varle-lt/

3. GDPR provisions I ask you to examine
ePrivacy (Lithuanian implementation) + GDPR Art. 6(1) — trackers before consent; GDPR Chapter V — cross-border transfer; GDPR Art. 13(1)(e) — disclosure of recipients

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]