IIZI Kindlustusmaakler AS

Complaint filed

13.06.2026

Decision

17.08.2026

Time to decision

65 days

Decision number

2.1-1/26/1160-2325-5

GDPR articles

6, 7, 13, 15

What was in the complaint

The basis was an analysis of the network traffic of the site iizi.ee (an insurance broker), recorded in a HAR log of 30.04.2026. The analysis showed two things that cannot be seen visually, only in a recording of network requests.

Data transfer before consent. The Cookiebot consent banner loaded only at +9759 ms after the page opened. By that moment data had already gone to third-party services: Google (Tag Manager, Analytics, AdSense), Microsoft (Bing Ads, Clarity), Meta/Facebook, Sentry, Hotjar. That is, the IP address and other identifiers were transmitted for more than nine seconds before the user even had the chance to give or decline consent.

Collection continued after refusal. The refusal of consent was recorded at +92510 ms. After it, requests to trackers did not stop — the HAR records a further 63 successful requests over almost three minutes after the explicit refusal: Microsoft Clarity, Google Analytics, Bing, AdSense/DoubleClick, Sentry.

Correspondence

1 May 2026 — an Art. 15 GDPR request was sent to andmekaitse@iizi.ee with the technical documentation of the HAR analysis attached: the list of recipients, transfer timings, identifiers (Google Analytics G-ZYCCJ74D78, Bing/UET ti=97191377, Hotjar-2994751, Sentry o481744, Crisp). 5 June 2026 — IIZI (Kaido Tropp) replied: it listed the recipients (Google, Microsoft, Meta, Hotjar, Sentry, Crisp) but at the same time stated that “we do not transfer data outside the EU/EEA”, and called Microsoft Clarity a cookie declared in the policy. The reply was given after the expiry of the one-month deadline under Art. 12(3). 5 June 2026 — a follow-up letter was sent: it pointed out the internal contradiction (US-based services listed alongside the claim that there is no cross-border transfer) and posed three specific questions — the transfer mechanism (DPF/SCC) for each recipient; the legal basis for Meta and Crisp before consent; what exactly Clarity had collected (with a reference to the HAR: a request to y.clarity.ms/collect at +875 ms, before the banner). 9 June 2026 — IIZI replied at length: it does not consider the IP address an identifier in its case; it cited the CJEU judgment C-582/14 (Breyer), interpreting it in its own favour; it referred to the DPF decision (10.07.2023) for Meta; it stated that Crisp is hosted in Amsterdam and the Clarity cookie was “empty” (with a reference to a Microsoft support letter). 12 June 2026 — IIZI considered the correspondence concluded. 13 June 2026 — a complaint was filed with AKI. It set out both key facts (transfer before consent and collection after refusal), which are visible only in the HAR, not on a visual inspection of the banner. It separately noted: in a similar case (AKI No. 2.1-1/26/676-1392-3) the check was limited to a visual inspection of the banner, which is not enough to detect such breaches.

What the regulator decided

On 17 August 2026 AKI discontinued the proceedings. Grounds:

• in AKI’s view, the submitted HAR file does not show that data is transferred to trackers automatically upon the loading of iizi.ee — the requests are connected with the visit, but the regulator considered the link to a specific transfer unproven;
• cookie-related complaints are not among the supervisory priorities (Art. 57(1)(f) — the supervisory authority handles complaints “to the appropriate extent”);
• the GDPR does not oblige issuing an order on every complaint;
• the complainant was invited first to exhaust other means of protecting their rights.

← back to all cases