Adform A/S

Complaint filed

29.04.2026

Decision

18.06.2026

Time to decision

50 days

Decision number

2.1-1/26/891-1777-2

GDPR articles

12, 15, 57

What was in the complaint

24 February 2026 — an access request under Art. 15 GDPR was sent to privacy@adform.com. The request contained all the required points: purposes of processing, categories of data, recipients, retention periods, automated decisions, international transfers.

25 February — Adform replied partially and redirected to its “Rights to Insights” portal.

25 February — the portal returned: “We did not detect our tracking cookie in your current browser mode”.

26 March — the 30-day deadline expired. A follow-up letter was sent with specific identifiers, documented in HAR logs from the domain track.adform.net: three Banner IDs recorded in network requests to the complainant’s device. With a reference to Art. 11(2): the controller is obliged to use additional information provided by the data subject.

24 April — Adform replied with the exact same text as in the first reply. The letter of 26 March, the identifiers and the Art. 11(2) argument were ignored entirely.

Key evidence: a 10-year retention period

Attached to the complaint is a document — the published privacy policy of the Estonian site okidoki.ee with a list of partners (TCF vendors) and the lifetimes of their cookies. In it, in black and white:

Adform A/S — Küpsisefaili kestus: 3650 (päevad) “Adform A/S — cookie file lifetime: 3650 (days)”

3650 days is ten years.

Adform itself, in its reply of 25 February, stated that the maximum cookie lifetime is 13 months. A discrepancy of nine times.

And it is not the only company in that document

Nine companies with a period over five years. Twenty-one — over two.

LiveRamp and Quantcast are separate cases in this same section. Both closed.

Alleged breaches

Art. 12(3) — a late reply with no substantive answer and no request for an extension. Art. 15 — Adform neither confirmed nor denied the fact of processing; the reply refers to the portal. Art. 11(2) — the identifiers provided were ignored, the standard reply was repeated. Art. 5(1)(e) — a disproportionate retention period: 10 years against the company’s stated 13 months.

What AKI decided

Proceedings discontinued on 18 June 2026. Decision No. 2.1-1/26/891-1777-2.

On access to data, the regulator relied on Art. 11(2): if the controller can demonstrate that it is not in a position to identify the subject, Articles 15–20 do not apply. AKI’s conclusion: Adform assessed the Banner IDs provided and did not breach the requirement of Art. 11(2).

On the retention period:

“AKI has no grounds to doubt Adform’s explanations, and since you have questions about the privacy terms of the site okidoki.ee, you may seek clarification from the administrator of okidoki.ee. In this case AKI does not see that you did so.”

On the scope of the investigation:

“Art. 77 GDPR gives the data subject the right to lodge a complaint with a supervisory authority, but this does not mean that the supervisory authority must necessarily conduct a thorough proceeding and establish all the circumstances.”

What happened next

The document with the list of partners disappeared from okidoki.ee.

At the time this analysis was published, the privacy policy of okidoki.ee contains a different text: about signing in via Google and device identification “for security and fraud prevention”. The list of vendors with retention periods is no longer in it.

In response to an enquiry about the fate of this information, the site operator replied that they did not know what was being referred to.

We do not establish or assert the reason for the disappearance. Consent-management platforms are updated regularly, and a coincidence in timing by itself proves nothing.

We record the sequence:

1. The document was published and documented.
2. It was attached to the complaint — that is, it is in the case file held by the supervisory authority.
3. The regulator refused to check the discrepancy, citing the absence of grounds to doubt the company, and suggested contacting the site owner.
4. By the time it became possible to check this, the document was no longer on the site.

Analysis

What is justified in the refusal

Art. 11(2) is a real provision. If the controller genuinely cannot identify the person, the rights under Articles 15–20 do not apply.

Adform did not breach the deadlines. The first reply came the day after the request, the second — 29 days later, within the month. The complainant’s argument about a late reply does not hold, and this is acknowledged here directly.

Formally, okidoki.ee is a third-party site. The figure of 3650 days stood in the publisher’s policy, not in Adform’s. The publisher should have been asked too.

What remains disputable

The discrepancy was not checked — it was resolved in the company’s favour. A published document against the company’s letter. The regulator chose the letter. Without requesting confirmation from either side.

The burden of proof is asymmetric. The complainant was required to provide identifiers proving processing. Nothing was required of the company: its word was enough.

The evidence was in the regulator’s hands. The document is attached to the complaint. AKI could not have failed to see it — and still wrote that there are no grounds for doubt.

The advice to contact the publisher turned out to be impossible to follow. By the time it could be followed, the document no longer existed.

The main point

The most telling sentence of the decision is not about Adform, but about supervision itself: the right to lodge a complaint does not mean the authority is obliged to establish all the circumstances.

Legally this is correct: the CJEU confirmed the regulator’s discretion (C-768/21, 26 September 2024). But combined with “no grounds to doubt the company’s explanations”, the result is a practical standard under which the company’s word weighs more than a published document, and no one is obliged to check the discrepancy.

This is exactly why this site runs daily policy monitoring: texts are saved with a date and a checksum. A document that disappears ceases to be an argument — unless it was saved in advance.

This case took place before the monitoring was launched. It will not happen a second time.

← back to all cases