RU EN
www.
Technical audit · 2026-06-15

varle.lt

Online electronics store
LT

The Varlė electronics online store, Lithuania — 166 requests, 32 domains. The Cookiebot consent manager loads at +10 seconds, while advertising, analytics, and session recording start at +3 seconds — before it. Before consent, GA4, Google Ads, Meta Pixel with server-side CAPI, Bing Ads, TikTok, Microsoft Clarity, and Hotjar all fire. Data goes out to recipients in the US.

Timeline of the leak

+490 ms · fonts and libraries
fonts.gstatic.com (Google Fonts) and cdnjs.cloudflare.com.
+3035 ms · Google Tag Manager
www.googletagmanager.com — the tag container launches.
+3301–3327 ms · Meta, Bing, CAPI
connect.facebook.net (Meta Pixel), bat.bing.com (Bing Ads), and capig.datah04.com (server-side Conversions API) — advertising and server-side tracking.
+3457–3827 ms · GA4, DoubleClick, Clarity
region1.analytics.google.com (GA4 page_view), stats.g.doubleclick.net, www.facebook.com/tr (Meta PageView), www.clarity.ms (session recording).
+10322 ms · consent manager (severely delayed)
consent.cookiebot.com — Cookiebot loads seven seconds after trackers start and does not hold them back.
session state — no consent given
Zero Set-Cookie headers for the entire session, and no user choice was made.
+10333–13841 ms · TikTok, Omnisend, Octocom
analytics.tiktok.com (TikTok Pixel), omnisnippet1.com and forms.soundestlink.com (Omnisend), chat.octocom.ai (AI chat).

Declared versus actual

✓ A privacy policy was not provided as part of the package — заявлен
✓ The Cookiebot consent manager is present, but loads too late — заявлен
+ GA4, Google Ads, DoubleClick, Meta Pixel + server-side CAPI, Bing Ads, TikTok, Clarity, Hotjar, Omnisend, Octocom — before consent — не заявлен

Transfer timings

+3325 ms capig.datah04.com

Server-side Conversions API (Meta/TikTok). Bypasses client-side blocking.

+3457 ms region1.analytics.google.com

GA4 page_view (G-R9Y1176PTY). Google, US.

+3803 ms www.facebook.com

Meta Pixel PageView (474000569742910). US.

+3827 ms www.clarity.ms

Microsoft Clarity — session recording. US.

+10322 ms consent.cookiebot.com

Loads 7 seconds after trackers start.

Detected trackers

Indicators of GDPR non-compliance

Context

varle.lt is the site of Varlė, an online electronics and household-goods retailer and one of the major Lithuanian retail chains. The operator is UAB “Varlė.” A privacy policy was not provided as part of the package. Scan: 166 requests, 32 domains, captured in a clean browser.

Google (US) — GA4, Google Ads, DoubleClick; Meta (US) — Pixel and server-side CAPI; Microsoft (US) — Bing Ads and Clarity; TikTok — Pixel.

Declared versus actual

A privacy policy was not provided as part of this audit, so the assessment is based on the scan. The key fact is the loading order of the consent manager relative to the trackers.

Cookiebot, the consent mechanism, only loads at +10322 ms. By this point, the advertising/analytics stack has already run: Google Tag Manager launches at +3035 ms, the Meta Pixel, Microsoft Bing Ads, and the server-side Conversions API channel via capig.datah04.com at +3301–3327 ms, GA4 (identifier G-R9Y1176PTY) sends a page_view event at +3457 ms, the Meta Pixel (474000569742910) sends a PageView event at +3803 ms, and Microsoft Clarity begins recording user behavior at +3827 ms. Later, at +10–13 s, Hotjar, TikTok Pixel, the Omnisend email-marketing service, and the Octocom AI chat are added. All of this occurs in a no-consent state: not a single cookie was set during the entire session, and no user choice was made.

The server-side Conversions API channel (datah04.com) deserves particular attention: it transmits visitor data to the server bypassing browser-side blocking mechanisms, making such a transmission especially resistant to a refusal of consent. A consent manager is present on the site, but due to its late launch it effectively holds none of the listed services back.

Trackers start from +3035 ms, while the Cookiebot consent manager only starts from +10322 ms — seven seconds later. The loading order rules out the possibility of consent preceding the firing of advertising and analytics; consent was in fact not given in this session (zero Set-Cookie headers).

What cannot be claimed from this scan

The scan covers the homepage. Visitor identifiers are not published; service account identifiers relate to site configuration. The policy was not provided, so disclosure of recipients in the text was not checked; the violation finding rests on trackers firing before consent. Recipients may use edge nodes within the EU, so the conclusion regarding their affiliation is based on company origin (US companies). Server-side processing, beyond the explicitly observed CAPI channel, is not visible in a browser-based scan.

Conclusion

The Varlė online store deploys an extensive commercial stack before consent — GA4, Google Ads and DoubleClick, the Meta Pixel with an additional server-side Conversions API, Bing Ads, the TikTok Pixel, as well as the session-recording services Microsoft Clarity and Hotjar. The Cookiebot consent manager is present on the site, but loads seven seconds after trackers start and does not hold them back; the server-side CAPI channel additionally transmits data bypassing browser-side blocking. The firing of advertising, analytics, and session recording before consent, and the transmission of data to recipients in the US, constitute a violation of the requirements on prior consent and cross-border transfer. Remediation: reconfigure Cookiebot to load first and genuinely block all non-technical services until consent; disable the server-side CAPI until consent is obtained; prevent advertising pixels and session recording from firing before the user’s choice; publish a complete cookie policy with a list of recipients.

Evidence
Original (audit)
HAR file: lt/varle-lt-2026-06-15.har
SHA-256: 8fb0005b71fb38cc9de526ede7abedf59adf17932b42bfbc5b582e43dda3340b
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: State Data Protection Inspectorate (ADA) — ada.lt

To: State Data Protection Inspectorate (ADA)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website varle.lt.

2. Circumstances
I visited the website varle.lt and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 15 June 2026 (open methodology, reproducible measurements) documents the following indications:

1) The Cookiebot consent manager only loads at +10322 ms, whereas the advertising/analytics stack already starts at +3301 ms — before the CMP has even loaded. Before consent, the following fire: GA4 (G-R9Y1176PTY, page_view event), Google Ads and DoubleClick, the Meta Pixel (474000569742910, PageView event) with an additional server-side Conversions API channel via capig.datah04.com, Microsoft Bing Ads, Microsoft Clarity (session recording), and Hotjar. Zero Set-Cookie headers for the entire session, and no user choice was made. TikTok Pixel, Omnisend, and the Octocom AI chat are added later (+10–13 s).

2) Before consent, data (page_view, URL, identifiers) is transmitted to recipients in the US: Google, Meta (client-side Pixel and server-side CAPI), Microsoft (Bing Ads and Clarity), TikTok. The server-side Conversions API channel (datah04.com) transmits data bypassing browser-side blocking.

3) A privacy policy was not provided as part of the package. Given the volume of actual processing (at least ten third-party services), the disclosure assessment is based on the scan; the actual recipients are numerous and include advertising networks and session-recording services.

Full technical documentation is published at: https://gdpru.eu/en/audits/lt-varle-lt/

3. Provisions violated
ePrivacy (Lithuanian implementation) + GDPR Art. 6(1) — trackers before consent; GDPR Chapter V — cross-border transfer; GDPR Art. 13(1)(e) — disclosure of recipients

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]