Quantcast International Ltd
- Complaint filed
- 29.03.2026
- Decision
- 15.06.2026
- Time to decision
- 78 days
- Decision number
2.1-1/26/659-1356-2- GDPR articles
- 12, 15, 57
8260f8ba8c9c3f71f621bf029072b04c41051b1ea17a977a2ca8017aa17baf0aThe document is published in full. The complainant's personal data (email address) has been removed from the document.
Grounds for refusal
- Art. 57(1)(f) — handled "to the appropriate extent"
- the GDPR does not oblige issuing an order
- "we take into account that the person can resolve it themselves"
- no public interest / an individual request
- cookie complaints are not a supervisory priority
What was in the complaint
18 February 2026 — an Art. 15 GDPR request to privacy@quantcast.com: a copy of the personal data linked to two email addresses, information on transfers to third parties and on profiling.
18 February — Quantcast replied the same day: to obtain access, a request must be submitted through their data-subject-rights portal (quantcast.com/data-subject-rights). The complainant replied that they could not use the portal, since it relies on cookies and they use cookie-blocking technology. A follow-up request was sent to the two email addresses — it went unanswered.
Delay (Art. 12(3)) — by the time the complaint was filed (29 March), 39+ days had passed without a substantive reply.
An additional argument — Quantcast on the site ehituseabc.ee. In the complaint, the complainant stated that Quantcast processes data through the Estonian site ehituseabc.ee and transfers it to the USA.
What AKI decided
Proceedings discontinued on 15 June 2026. Decision No. 2.1-1/26/659-1356-2.
On access to data. Quantcast usually collects not email addresses but pseudonymised web identifiers (for example, a cookie ID). AKI found it justified that, for identification, the company directs the complainant to the portal: the controller is entitled to require additional data to establish identity (Art. 12(6)). The HAR provided contains no email addresses, and the mere presence of identifiers in web requests does not give a direct link to a specific natural person.
On the ehituseabc.ee argument — the regulator checked the HAR and refuted it.
“AKI does not confirm the assertion that, on visiting the site ehituseabc.ee, data is automatically transferred to Quantcast. The HAR file does indeed contain requests related to Quantcast, but from their timestamps, referer fields and URLs it is clear that they are connected with visits to Quantcast’s own sites, not with the loading of the site ehituseabc.ee.”
On 8 June 2026 AKI visited ehituseabc.ee itself and established: without logging into an account and without consent to advertising cookies, no connections to Quantcast arise; optional (analytics) cookies are applied only after consent. The regulator saw no problem with data processing on the site.
Analysis
Here I made a mistake, and it must be said directly
This is one of my first analyses, and I was inexperienced. The argument that “ehituseabc.ee transfers data to Quantcast” turned out to be wrong.
My HAR did contain requests to Quantcast — but they related to visits to Quantcast’s own sites, not to the loading of the building-supplies shop. I confused the context: I took the logs of one site for the behaviour of another.
AKI asked me to check personally. I re-examined all the HAR files and did not find what I had claimed. The regulator reached the same conclusion, and checked the site itself. The case was closed on the merits — and on this point it was closed correctly.
ehituseabc.ee (Optimera Estonia AS) has nothing to do with this. I apologise for the fact that, in the original complaint, this site was named without sufficient grounds.
What still stands
An error in one argument does not cancel the other two, and they remain:
The delay under Art. 12(3). Quantcast did not reply at all to the follow-up request sent to the two email addresses. This is a separate fact, unrelated to the ehituseabc.ee error.
The dispute over the portal’s accessibility. The data-subject-rights portal relies on cookies. A user who blocks cookies for privacy reasons is left without a way to exercise their right of access. Formally AKI recognised the company’s right to require identification — but the question of whether the only channel of access should be inaccessible to those who protect their privacy remains open.
Why this card is published exactly like this
Because the project rests on reproducibility. If I demand that companies answer for a discrepancy between words and facts, I must answer for mine. Here a fact was established incorrectly — the regulator showed this, and I acknowledge it.
To publish only convenient cases would be to turn the archive into a showcase. This card is about the fact that evidence is checked in both directions.