The website of the Merko construction group — a click from a Google ad to a project page and then to the homepage, 252 requests. The capture contains no analytics or advertising: Google Tag Manager containers load, but no tag fires. But in the CookieScript banner all optional categories are ticked in advance, statistics are described in the documents as anonymous although the declaration itself names identifiers, and Sentry and Google Maps are named nowhere.
Request timeline
Declared versus actual
Transfer timings
Google Maps on the project page; not named in the documents.
GTM-5G86ZN; no tag fired.
Sentry, first submission from the homepage.
Sentry, a submission of about 260 KB; content removed in cleaning.
Detected trackers
- CookieScript (cdn.cookie-script.com) — consent platform; refusal on the first layer exists, all optional categories ticked by default
- Google Tag Manager (GTM-5G86ZN, GTM-NR8B8CM7) — containers on the pages; no analytics or advertising tag fired in the capture
- Sentry (o4510306345549824.ingest.de.sentry.io) — error monitoring; three submissions from the homepage, one of them about 260 KB
- Google Maps (maps.googleapis.com) — map on the project page before any choice
- Google Fonts, jQuery CDN, cdnjs, Google Hosted Libraries — fonts and libraries
- First party: merko.ee (WordPress)
Indicators of GDPR non-compliance
- GDPR Art. 4(11) / Art. 7(1) — optional categories ticked by defaultOn its first layer, the CookieScript banner shows the 'Jõudlusküpsised', 'Reklaamküpsised', 'Funktsionaalsed küpsised' and 'Klassifitseerimata küpsised' boxes already ticked — before the visitor has chosen anything (screenshots 1 and 2). Pre-ticked fields do not constitute consent: consent must be expressed by an affirmative action. The 'Keeldu kõigist' button is present on the first layer.
- GDPR Art. 13(1)(e) / Art. 5(1)(a) — statistics described as anonymous, Sentry and Google Maps not namedThe data processing principles state that statistics use anonymised data, and the cookie declaration that analytics cookies 'cannot directly identify visitors'. The same declaration describes _ga as a cookie that distinguishes unique users by a client identifier, and Microsoft's MUID as an identifier that 'enables tracking of users'. Sentry, which in the capture receives three submissions from the homepage, one of about 260 KB, and Google Maps, loaded on the project page, are named neither in the principles nor in the declaration.
- GDPR Art. 13(2)(b) — rights listed incompletelyThe principles name the rights of access and to a copy, rectification, erasure, objection, restriction of processing and withdrawal of consent. The right to data portability is missing.
Context
merko.ee is the website of the Merko construction group: construction, Merko Kodud housing projects and commercial premises. The controller is OÜ Merko Kodud or another company of the AS Merko Ehitus group. Consent is managed by CookieScript.
The measurement is a single capture: a Google search, a click on an ad link to the Uus-Karlowa project page, a return to the search and a visit to the homepage. In total, 252 requests, 16 of them from the Google search page itself.
Who receives data directly
Google — Tag Manager with no fired tags, Maps, Fonts, libraries. Sentry — error monitoring. CookieScript — as the consent platform.
Declared versus actual
First — the boxes are ticked for the visitor. In the CookieScript banner, all four optional categories are ticked before any choice. The “Keeldu kõigist” button is nevertheless present on the first layer.
Second — the traffic is cleaner than the declaration. The cookie declaration lists Google Analytics, Google Ads, Microsoft Clarity, Adform and Meta. None of them fires in the capture: the Google Tag Manager containers load but launch no tags.
Third — “anonymous” statistics. The principles and the declaration call statistics anonymous, while the declaration itself describes Google and Microsoft identifiers designed to recognise users.
Fourth — Sentry and Google Maps are not named. Sentry receives three submissions from the homepage, the last of about 260 KB. Google Maps loads on the project page before any choice. Neither is mentioned in the documents. Rights are listed without the right to data portability.
Consent: what is proven and what is not
Proven: there is a refusal on the first layer. The “Keeldu kõigist” button on screenshot 1.
Proven: optional categories are ticked in advance. Screenshots 1 and 2.
Proven: analytics and advertising do not fire in the capture. Not a single request to Google Analytics, Clarity, Adform or Meta.
Proven: Sentry and Google Maps are not named. A search of the saved principles and declaration.
Not established: whether a decision was made in the banner. CookieScript does not send the decision to a server, and there is no Google consent mode in the capture.
Not established: what the Sentry submission of about 260 KB contains. Request bodies were removed; by its size it may be a session recording rather than just an error report.
Boundaries of this observation
The measurement covers the Uus-Karlowa project page and the homepage. The capture starts on the Google results page: its own requests, including the recording of the ad click on www.googleadservices.com, are made by Google itself and are not attributed to the site. The observation records browser behavior, not server-side processing. The file has been published cleaned: Cookie headers and POST bodies were removed.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in the principles themselves.
Conclusion
On the Merko website, neither analytics nor advertising runs in the capture, and there is a refusal on the first layer. The violations lie in the banner configuration and the documents: all optional categories are ticked in advance, statistics are described as anonymous despite explicit identifiers, Sentry and Google Maps are not named, and rights are listed incompletely.
Remedy: untick optional categories by default in CookieScript; remove the claims of anonymous statistics; name Sentry and Google Maps in the principles and the declaration; add the right to data portability. Suggestion: load the Google map on the project page after consent.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
4f4586f609b856cbbbbdfb015a1940acf0912716798398e58a4127af32e5fc26
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — merko.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта merko.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Баннер CookieScript на первом слое показывает флажки «Jõudlusküpsised», «Reklaamküpsised», «Funktsionaalsed küpsised» и «Klassifitseerimata küpsised» уже отмеченными — до того, как посетитель что-либо выбрал (скриншоты 1 и 2). Заранее отмеченные поля согласием не являются: согласие должно быть выражено активным действием. Кнопка «Keeldu kõigist» на первом слое есть. 2) Принципы обработки данных утверждают, что для статистики используются обезличенные данные, а декларация cookie — что аналитическими cookie «невозможно напрямую идентифицировать посетителей». Та же декларация описывает _ga как cookie, который различает уникальных пользователей по идентификатору клиента, и MUID Microsoft как идентификатор, который «позволяет отслеживать пользователей». Sentry, который в замере получает с главной три отправки, одну около 260 КБ, и Google Maps, загружаемый на странице проекта, не названы ни в принципах, ни в декларации. 3) Принципы называют право на доступ и копию, исправление, удаление, возражение, ограничение обработки и отзыв согласия. Права на переносимость данных нет. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-merko-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — merko.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website merko.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) On its first layer, the CookieScript banner shows the 'Jõudlusküpsised', 'Reklaamküpsised', 'Funktsionaalsed küpsised' and 'Klassifitseerimata küpsised' boxes already ticked — before the visitor has chosen anything (screenshots 1 and 2). Pre-ticked fields do not constitute consent: consent must be expressed by an affirmative action. The 'Keeldu kõigist' button is present on the first layer. 2) The data processing principles state that statistics use anonymised data, and the cookie declaration that analytics cookies 'cannot directly identify visitors'. The same declaration describes _ga as a cookie that distinguishes unique users by a client identifier, and Microsoft's MUID as an identifier that 'enables tracking of users'. Sentry, which in the capture receives three submissions from the homepage, one of about 260 KB, and Google Maps, loaded on the project page, are named neither in the principles nor in the declaration. 3) The principles name the rights of access and to a copy, rectification, erasure, objection, restriction of processing and withdrawal of consent. The right to data portability is missing. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-merko-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — merko.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi merko.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) CookieScripti bänner näitab esimesel kihil märkeruute „Jõudlusküpsised“, „Reklaamküpsised“, „Funktsionaalsed küpsised“ ja „Klassifitseerimata küpsised“ juba märgituna – enne, kui külastaja on midagi valinud (kuvatõmmised 1 ja 2). Eelnevalt märgitud väljad ei ole nõusolek: nõusolek tuleb väljendada aktiivse tegevusega. Nupp „Keeldu kõigist“ on esimesel kihil olemas. 2) Isikuandmete töötlemise põhimõtted väidavad, et statistika tegemiseks kasutatakse isikustamata andmeid, ning küpsiste deklaratsioon, et analüütiliste küpsistega „ei ole võimalik külastajaid otseselt tuvastada“. Sama deklaratsioon kirjeldab _ga küpsist kui küpsist, mis eristab unikaalseid kasutajaid kliendiidentifikaatori abil, ning Microsofti MUID-d kui identifikaatorit, mis „võimaldab kasutajate jälgimist“. Sentryt, kes saab mõõtmise käigus avalehelt kolm saadetist, millest üks on umbes 260 KB, ega projekti lehel laaditavat Google Mapsi ei nimetata ei põhimõtetes ega deklaratsioonis. 3) Põhimõtted nimetavad õigust tutvuda andmetega ja saada koopia, õigust andmete parandamisele, kustutamisele, vastuväidete esitamisele, töötlemise piiramisele ja nõusoleku tagasivõtmisele. Õigust andmete ülekandmisele ei ole. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-merko-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — merko.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом merko.ee. 2. Обстоятельства Я посетил сайт merko.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 18.10.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Баннер CookieScript на первом слое показывает флажки «Jõudlusküpsised», «Reklaamküpsised», «Funktsionaalsed küpsised» и «Klassifitseerimata küpsised» уже отмеченными — до того, как посетитель что-либо выбрал (скриншоты 1 и 2). Заранее отмеченные поля согласием не являются: согласие должно быть выражено активным действием. Кнопка «Keeldu kõigist» на первом слое есть. 2) Принципы обработки данных утверждают, что для статистики используются обезличенные данные, а декларация cookie — что аналитическими cookie «невозможно напрямую идентифицировать посетителей». Та же декларация описывает _ga как cookie, который различает уникальных пользователей по идентификатору клиента, и MUID Microsoft как идентификатор, который «позволяет отслеживать пользователей». Sentry, который в замере получает с главной три отправки, одну около 260 КБ, и Google Maps, загружаемый на странице проекта, не названы ни в принципах, ни в декларации. 3) Принципы называют право на доступ и копию, исправление, удаление, возражение, ограничение обработки и отзыв согласия. Права на переносимость данных нет. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-merko-ee/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 4(11) / Art. 7(1) — необязательные категории отмечены по умолчанию; GDPR Art. 13(1)(e) / Art. 5(1)(a) — статистика описана как обезличенная, Sentry и Google Maps не названы; GDPR Art. 13(2)(b) — права перечислены не полностью 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — merko.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website merko.ee. 2. Circumstances I visited the website merko.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 18 October 2026 (open methodology, reproducible measurements) documents the following indications: 1) On its first layer, the CookieScript banner shows the 'Jõudlusküpsised', 'Reklaamküpsised', 'Funktsionaalsed küpsised' and 'Klassifitseerimata küpsised' boxes already ticked — before the visitor has chosen anything (screenshots 1 and 2). Pre-ticked fields do not constitute consent: consent must be expressed by an affirmative action. The 'Keeldu kõigist' button is present on the first layer. 2) The data processing principles state that statistics use anonymised data, and the cookie declaration that analytics cookies 'cannot directly identify visitors'. The same declaration describes _ga as a cookie that distinguishes unique users by a client identifier, and Microsoft's MUID as an identifier that 'enables tracking of users'. Sentry, which in the capture receives three submissions from the homepage, one of about 260 KB, and Google Maps, loaded on the project page, are named neither in the principles nor in the declaration. 3) The principles name the rights of access and to a copy, rectification, erasure, objection, restriction of processing and withdrawal of consent. The right to data portability is missing. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-merko-ee/ 3. GDPR provisions I ask you to examine GDPR Art. 4(11) / Art. 7(1) — optional categories ticked by default; GDPR Art. 13(1)(e) / Art. 5(1)(a) — statistics described as anonymous, Sentry and Google Maps not named; GDPR Art. 13(2)(b) — rights listed incompletely 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil merko.ee. 2. Asjaolud Külastasin veebisaiti merko.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 18.10.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) CookieScripti bänner näitab esimesel kihil märkeruute „Jõudlusküpsised“, „Reklaamküpsised“, „Funktsionaalsed küpsised“ ja „Klassifitseerimata küpsised“ juba märgituna – enne, kui külastaja on midagi valinud (kuvatõmmised 1 ja 2). Eelnevalt märgitud väljad ei ole nõusolek: nõusolek tuleb väljendada aktiivse tegevusega. Nupp „Keeldu kõigist“ on esimesel kihil olemas. 2) Isikuandmete töötlemise põhimõtted väidavad, et statistika tegemiseks kasutatakse isikustamata andmeid, ning küpsiste deklaratsioon, et analüütiliste küpsistega „ei ole võimalik külastajaid otseselt tuvastada“. Sama deklaratsioon kirjeldab _ga küpsist kui küpsist, mis eristab unikaalseid kasutajaid kliendiidentifikaatori abil, ning Microsofti MUID-d kui identifikaatorit, mis „võimaldab kasutajate jälgimist“. Sentryt, kes saab mõõtmise käigus avalehelt kolm saadetist, millest üks on umbes 260 KB, ega projekti lehel laaditavat Google Mapsi ei nimetata ei põhimõtetes ega deklaratsioonis. 3) Põhimõtted nimetavad õigust tutvuda andmetega ja saada koopia, õigust andmete parandamisele, kustutamisele, vastuväidete esitamisele, töötlemise piiramisele ja nõusoleku tagasivõtmisele. Õigust andmete ülekandmisele ei ole. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-merko-ee/ 3. Sätted, mille järgimist palun kontrollida IKÜM art 4 p 11 / art 7 lg 1 — mittevajalikud kategooriad on vaikimisi märgitud; IKÜM art 13 lg 1 p e / art 5 lg 1 p a — statistikat kirjeldatakse isikustamatana, Sentry ja Google Maps on nimetamata; IKÜM art 13 lg 2 p b — õigused on loetletud mittetäielikult 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]