Estonian SA: Ticketer OÜ, shortcomings in privacy policy, third-party cookies on a website without consent

20 January 2023

Background information

  • Date of final decision: 25 July 2022        
  • National Case
  • Controller: Ticketer OÜ   
  • Legal Reference: Lawfulness of processing (Article 6 GDPR), Information to be provided where personal data are collected from the data subject (Article 13 GDPR)                                   
  • Decision: precept, order to comply, temporary ban on processing                                  
  • Key words: privacy notice, cookie consent, third-party cookies


Summary of the Decision


Origin of the case

Estonian SA conducted a self-initiated monitoring to map the situation of a personal data processing in various ticket seller portals. The purpose was to find out how people are informed about privacy-related aspects.

Estonian SA checked the website whether it complies with the requirements in the GDPR. Estonian SA evaluated and analysed the documents, that were submitted to the Estonian SA, and also the actual data processing on the website.


Key Findings

It was found that the privacy notice lacked, among others but not only, of data controller’s name and contact details, purpose and legal basis of the data processing, data retention period, and the rights of data subjects.  

Estonian SA also inspected the third-party cookies used on the website and drew data controller’s attention to the fact that they placed cookies on the data subject’s end device without previously obtaining consent.



The Estonian SA ordered the controller to:

  • align privacy notice according to the requirements set in the GDPR;
  • remove third-party cookies from the website or alternatively obtain consent of data subjects to place the cookies.

Estonian SA issued a precept with a penalty payment of 5000 EUR for each unfulfilled point.

For further information: decision in national language


The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.