Cases on GDPR Audit

Enefit

Fri, 21 Aug 2026 00:00:00 +0000

Analysis in preparation

The case has been accepted and the regulator’s decision received. Proceedings were discontinued on 21 August 2026 (decision No. 2.1-1/26/1147-2291-5).

A detailed analysis — what was in the complaint, what the regulator decided and how it justified the refusal — will be published here later. This concerns an Estonian energy operator and an incomplete reply to an Art. 15 request.

Okidoki

Fri, 21 Aug 2026 00:00:00 +0000

Analysis in preparation

The case has been accepted and the regulator’s decision received. Proceedings were discontinued on 21 August 2026 (decision No. 2.1-1/26/1150-2305-5).

A detailed analysis — what was in the complaint, what the regulator decided and how it justified the refusal — will be published here later. The same publisher (okidoki.ee) whose vanished policy features in the Adform case.

IIZI

Mon, 17 Aug 2026 00:00:00 +0000

What was in the complaint

The basis was an analysis of the network traffic of the site iizi.ee (an insurance broker), recorded in a HAR log of 30.04.2026. The analysis showed two things that cannot be seen visually, only in a recording of network requests.

Data transfer before consent. The Cookiebot consent banner loaded only at +9759 ms after the page opened. By that moment data had already gone to third-party services: Google (Tag Manager, Analytics, AdSense), Microsoft (Bing Ads, Clarity), Meta/Facebook, Sentry, Hotjar. That is, the IP address and other identifiers were transmitted for more than nine seconds before the user even had the chance to give or decline consent.

ESPAK

Mon, 29 Jun 2026 00:00:00 +0000

What was in the complaint

Espak AS is a retail chain of building materials with a loyalty-card programme. The complainant is a customer; the card was issued against an ID document in the shop, so the fact of processing is indisputable.

22 February 2026 — an Art. 15 request to info@espak.ee: confirmation of processing (purchase history, profile, segments), a list of third parties, transfers outside the EU, the logic of profiling.

Adform

Thu, 18 Jun 2026 00:00:00 +0000

What was in the complaint

24 February 2026 — an access request under Art. 15 GDPR was sent to privacy@adform.com. The request contained all the required points: purposes of processing, categories of data, recipients, retention periods, automated decisions, international transfers.

25 February — Adform replied partially and redirected to its “Rights to Insights” portal.

25 February — the portal returned: “We did not detect our tracking cookie in your current browser mode”.

Wix

Wed, 17 Jun 2026 00:00:00 +0000

What was in the complaint

Art. 21(3) — direct marketing after a formal objection. The complainant filed an Art. 21 objection to direct marketing on 4 March 2026. Wix continued to send marketing emails — with the complainant’s name and photo — six times from 4 to 25 March. Art. 21(3) is unconditional: after an objection, processing must stop immediately. Wix did not do so for at least 21 days.

Quantcast

Mon, 15 Jun 2026 00:00:00 +0000

What was in the complaint

18 February 2026 — an Art. 15 GDPR request to privacy@quantcast.com: a copy of the personal data linked to two email addresses, information on transfers to third parties and on profiling.

18 February — Quantcast replied the same day: to obtain access, a request must be submitted through their data-subject-rights portal (quantcast.com/data-subject-rights). The complainant replied that they could not use the portal, since it relies on cookies and they use cookie-blocking technology. A follow-up request was sent to the two email addresses — it went unanswered.

Tapad

Mon, 15 Jun 2026 00:00:00 +0000

What was in the complaint

An Art. 15 GDPR request was sent on 24 February 2026. Tapad claims that since 1 August 2021 it does not process the data of EEA subjects and has “deleted all data”. The HAR analysis proves the opposite.

20 March — a repeat request with evidence. An auto-reply from the Experian Jira system, ticket PRIV-101489. By 10 April — 47 days without a substantive reply.

Audigent

Mon, 08 Jun 2026 00:00:00 +0000

What was in the complaint

An Art. 15 request was sent on 6 April 2026 with two identifiers found in the HAR of the site soov.ee.

7 April — identity verification via the SixFifty platform was passed, the identifiers were entered, confirmation was received.

10 April — Audigent created a new ticket and demanded identity verification again. Passed the same day.

16 April — verification was demanded a third time. The complainant refused in writing, citing Recital 57 and 64: two completed verifications are enough.

IQzone

Mon, 08 Jun 2026 00:00:00 +0000

What was in the complaint

An Art. 15 request was sent on 6 April 2026. The 30-day deadline expired on 6 May without a reply.

8 May — IQzone’s CTO Matthew A. Feadler replied in a single sentence: “IQzone does not store any personal data about you”.

8 May — the complainant challenged this technically: the HAR of the site soov.ee recorded identifiers (a UUID and a hash identifier) transmitted to cs.iqzone.com. These are personal data under Art. 4(1) — the Breyer case (C-582/14).

DEPO DIY EE

Fri, 29 May 2026 00:00:00 +0000

What was in the complaint

DEPO DIY EE OÜ is an Estonian retail chain (registration code 14652864). The DPO is Alīna Tambora (Latvia). The complainant is a loyalty-card holder, so the processing is indisputable.

28 February 2026 — an Art. 15 request to two addresses. 23 February — a detailed DPO request of 7 points: the loyalty card, automated profiling, data transfers, the consent mechanism when the card was issued. 2 March — the request with a signed document.

Telia Eesti

Tue, 19 May 2026 00:00:00 +0000

What was in the complaint

A Telia customer since 2016 — the contract was signed on 30 January, ten years of relationship.

21 February 2026 — an Art. 15 GDPR request with six specific demands: profiling and RTB, cross-border transfer, shadow-banning, third-party logs for 5 years, the legal basis for data enrichment, automated decisions. The statutory reply deadline was 23 March.

25 February and 10 March — clarifying letters.

12 March — Telia replied partially.

LiveRamp

Fri, 15 May 2026 00:00:00 +0000

What was in the complaint

18 February 2026 — an Art. 15 request to privacy@liveramp.com and dpo@liveramp.com. Both letters immediately bounced with an error BOUNCE 550 5.1.1 — the addresses do not exist.

An attempt via the liveramp.uk portal — the portal is available only to UK residents. As a resident of Estonia, the complainant could not file a request.

20 March — repeat letters to ukprivacy@liveramp.com and cil@liveramp.com. By 25 March (35 days) — no reply.

The Trade Desk

Fri, 15 May 2026 00:00:00 +0000

What was in the complaint

First request — 17 February 2026

Sent under Art. 15 GDPR to privacy@thetradedesk.com and dpo@thetradedesk.com. Full name, two email addresses and a postal address were provided.

18 February — an auto-reply: this mailbox is checked irregularly, but a reply will be given in due course.

3 March — a substantive reply: “TTD conducted a search and did not find any data associated with the information you provided”.

VKontakte

Wed, 13 May 2026 00:00:00 +0000

What was in the complaint

The initial complaint was filed on 2 March 2026, then supplemented with new evidence.

Canvas fingerprinting. The independent scanner Blacklight (a project of The Markup) confirmed that VK uses canvas fingerprinting on the profile page — a technique that identifies a device even with cookies blocked. The user is not notified of this (Art. 5(1)(a)).

Cross-platform synchronisation. A single identifier tmr_lvid was found simultaneously on vk.com, mail.ru, ok.ru and a third-party site — systematic tracking across platforms without consent. yandex.ru, ad.mail.ru and tns-counter.ru are also involved.

Xandr

Mon, 04 May 2026 00:00:00 +0000

What was in the complaint

24 February 2026 — an Art. 15 request to privacy@xandr.com. 28 February — repeated to privacy@xandr.com and mscceudpo@microsoft.com. No substantive reply.

18 March — active persistent Xandr identifiers were found in the HAR of the site delfi.ee, in the domain .adnxs.com. They confirm that Xandr processes the complainant’s data at the moment the complaint was filed.

18 March — an attempt to send an updated request via ProtonMail. Both Xandr/Microsoft addresses rejected the letter with the code 550 5.4.1 — “Recipient address rejected: Access denied”. That is, Microsoft actively blocks letters from a secure email service.

Pinterest Europe

Wed, 29 Apr 2026 00:00:00 +0000

What was in the complaint

The initial complaint was filed on 16 March 2026 (accepted), then supplemented.

Account igor_kuzmin_creator, registered on 25 January 2022. The controller is Pinterest Europe Ltd. (Dublin), the lead authority is the DPC of Ireland.

20 March — a technical analysis via Chrome DevTools (Application → Cookies → www.pinterest.com) showed that Pinterest loads at least 15 cookies of Google LLC domains onto the device.

The breach

Undisclosed transfer of data to Google LLC (USA) — Chapter V GDPR, Art. 13(1)(e). Fifteen Google cookies on the Pinterest page, not disclosed as a data transfer to a recipient in a third country.

AliExpress

Tue, 28 Apr 2026 00:00:00 +0000

What was in the complaint

The key argument: the Member ID — a unique account identifier that does not depend on a change of email. The complainant presented a Member ID + three Order IDs + payment card details. More than enough to establish identity. AliExpress refused to accept it.

Art. 12(1) — obstruction of access. AliExpress four times (10, 10, 13, 18 March) demanded that the request be sent strictly from one specific personal email address. No alternative method of identity confirmation was ever offered — even though the complainant provided screenshots of three orders with amounts and card details, an order report, the Member ID and card details.

Acxiom

Fri, 24 Apr 2026 00:00:00 +0000

What was in the complaint

17 February 2026 — an Art. 15 request to privacy@acxiom.com: all personal data, purposes of processing, categories, information on profiling.

17 February — an auto-reply: the address privacy@acxiom.com is being closed from 30 June, use askprivacy@acxiom.com.

Subsequent correspondence did not lead to a substantive reply on the merits.

Articles: 15(1), 12(3).

The controller is Acxiom LLC (Omnicom Group), USA. A European controller is stated — Acxiom Europe Ltd, Dublin.