https://www.obchod-priklad.sk/
Summary
Your website sends data to third-party services before the visitor clicks anything (services: 1). Even after "Reject all" the website keeps tracking visitors. Findings: 7, of which serious (critical or high): 4.
The score starts at 100 and each rule the website breaks deducts points by severity.
What changes after the visitor's decision
No interaction
Scroll without a click
Accept all
Reject all
After a rejection the website still talks to third-party services (count: 2), of which tracking, i.e. advertising or analytics: 2.
Tracking services after a rejection (2)
- Meta · marketing
- Seznam.cz · marketing
Technical data from the scan. Services without tracking (CDN, fonts, maps) may run after a rejection. A service is a provider by our database, otherwise a domain; unclassified domains are not counted as tracking. We also count known tracking tools the website loads through its own domain (for example server-side measurement).
Three scenarios
No interaction
- Cookies
- 2
- Tracking requests
- 2
- External resources
- 0
- All requests
- 3
Scroll without a click
- Cookies
- 2
- Tracking requests
- 2
- External resources
- 0
- All requests
- 3
Accept all
- Cookies
- 4
- Tracking requests
- 4
- External resources
- 0
- All requests
- 5
Reject all
- Cookies
- 2
- Tracking requests
- 3
- External resources
- 0
- All requests
- 4
Findings
Critical Tracker pred udelením súhlasu R-001
Pred akoukoľvek interakciou s bannerom web odoslal požiadavky na analytické alebo marketingové nástroje (počet: 1): Google Analytics 4.
Evidence
- Request · No interaction: https://region1.google-analytics.com/g/collect?v=2&tid=G-0000000000&cid=GA1.1.0.0&en=page_view&_p=0 → Google Analytics 4
Legal basis
ePrivacy čl. 5(3); § 109 zák. 452/2021 Z. z.; budúci GDPR čl. 88a
Recommendation
Načítať tag až po udelení súhlasu (GTM consent mode / trigger na consent event)
Critical Cookie pred udelením súhlasu R-002
Pred akoukoľvek interakciou s bannerom web nastavil analytické alebo marketingové cookies (počet: 2): _ga a _ga_0000000000.
Evidence
- Cookie · No interaction: _ga (.obchod-priklad.sk)
- Cookie · No interaction: _ga_0000000000 (.obchod-priklad.sk)
Legal basis
ePrivacy čl. 5(3); § 109 zák. 452/2021 Z. z.; budúci GDPR čl. 88a
Recommendation
Nenastavovať cookie pred súhlasom
Critical Tracker po odmietnutí R-003
Po kliknutí na „Odmietnuť všetko“ a opätovnom načítaní web odoslal požiadavky na sledovacie nástroje (počet: 2): Meta Pixel a Sklik.
Evidence
- Request · Reject all: https://www.facebook.com/tr/?id=000000000000000&ev=PageView&noscript=0 → Meta Pixel
- Request · Reject all: https://c.seznam.cz/retargeting?id=000000 → Sklik
Legal basis
GDPR čl. 7(3), čl. 4(11); ePrivacy čl. 5(3)
Recommendation
Prepojiť CMP s tag managerom; overiť consent mode
High Cookie po odmietnutí R-004
Po kliknutí na „Odmietnuť všetko“ a opätovnom načítaní zostali alebo vznikli analytické alebo marketingové cookies (počet: 1): _fbp.
Evidence
- Cookie · Reject all: _fbp (.obchod-priklad.sk)
Legal basis
GDPR čl. 7(3), čl. 4(11); ePrivacy čl. 5(3)
Recommendation
Nenastavovať / zmazať cookies po odmietnutí
Medium Príliš dlhá životnosť cookies R-011
Cookies, ktoré nie sú nevyhnutné, majú životnosť dlhšiu ako 395 dní (13 mesiacov). Počet: 2; v zátvorke dni: _ga (400) a _ga_0000000000 (400).
Evidence
- Cookie · No interaction: _ga (.obchod-priklad.sk)
- Cookie · No interaction: _ga_0000000000 (.obchod-priklad.sk)
Legal basis
CNIL/EDPB odporúčanie 13 mes.; TCF
Recommendation
Skrátiť životnosť
Low Cookies bez atribútu Secure R-012
Na HTTPS stránke sú cookies bez atribútu Secure (počet: 3): _ga, _ga_0000000000 a cookie_consent.
Evidence
- Cookie · No interaction: _ga (.obchod-priklad.sk)
- Cookie · No interaction: _ga_0000000000 (.obchod-priklad.sk)
- Cookie · Accept all: cookie_consent (.obchod-priklad.sk)
Legal basis
Best practice
Recommendation
Nastaviť Secure
Info Prenos dát mimo EÚ R-024
Pred súhlasom alebo po odmietnutí web komunikoval s doménami poskytovateľov so sídlom mimo EÚ alebo s prenosom do krajín bez rozhodnutia Komisie o primeranosti (počet: 4): region1.google-analytics.com, www.googletagmanager.com, connect.facebook.net a www.facebook.com.
Evidence
- Request · No interaction: region1.google-analytics.com
- Request · No interaction: www.googletagmanager.com
- Request · Reject all: connect.facebook.net
- Request · Reject all: www.facebook.com
Legal basis
GDPR kap. V (čl. 44–49); EU-US DPF pokrýva len certifikovaných poskytovateľov
Recommendation
Pri každom poskytovateľovi v tabuľke „Kam odchádzajú dáta“ overte právny základ prenosu: rozhodnutie o primeranosti, certifikáciu v EU-US DPF alebo štandardné zmluvné doložky. Chýbajúce rozhodnutie o primeranosti neznamená, že prenos je nezákonný.
Where data goes
Third-party domains the website talked to before consent or after rejection.
| Domain | Provider | Established in | EU-US DPF | Category | When |
|---|---|---|---|---|---|
| c.seznam.cz | Seznam.cz | EU | — | marketing | Reject all |
| connect.facebook.net | Meta | USA | yes | marketing | Reject all |
| region1.google-analytics.com | USA | yes | analytics | No interaction, Scroll without a click | |
| www.facebook.com | Meta | USA | yes | marketing | Reject all |
| www.googletagmanager.com | USA | yes | analytics | No interaction, Scroll without a click |
Map of the data flow
Where data from the website goes: services grouped by the seat of their provider, separately before consent, after consent and after rejection. The grouping comes from our database of providers and from the EU-U.S. Data Privacy Framework list; it is not a legal assessment of the transfer.
Before consent
After consent
After rejection
Groups without services are not shown. Further transfers of a provider (for example from the EU to the USA) are in the column “Transfers to”.
Services on the map
| Service | Group | Seat | Transfers to | When | Note |
|---|---|---|---|---|---|
| Seznam.cz | EU/EEA | EU/EEA | — | After rejection | — |
| USA, active DPF entry | USA | — | Before consent, After consent | — | |
| Meta | USA, active DPF entry | USA | — | After consent, After rejection | — |
Chain of partners
Which service loaded which: the website loads, for example, a tag manager, that one an ad network and the ad network its partners. This is what the browser recorded during the scan, not the contracts between the companies.
-
Website obchod-priklad.sk
- Google before consent · tracks after consent · tracksregion1.google-analytics.com, www.googletagmanager.com
- Meta after consent · tracks after rejection · tracksconnect.facebook.net, www.facebook.com
- Sklik Seznam.cz after rejection · tracksc.seznam.cz
Security headers and HTTPS
| Header | Value | State |
|---|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains | set |
| Referrer-Policy | strict-origin-when-cross-origin | set |
| X-Content-Type-Options | nosniff | set |
| Content-Security-Policy | — | missing |
| X-Frame-Options | — | missing |
- HTTP status of the main response
- 200
- HTTP to HTTPS redirect
- not tested
- Insecure resources on an HTTPS page (mixed content)
- 0
Consent banner
- Detected
- heuristically
- Accept
- Prijať všetko (button)
- Reject
- Odmietnuť všetko (button)
- Settings
- missing
- Cookie policy link
- yes
- Change consent after accepting
- yes
- Banner shown again after rejecting
- no
- "By continuing you agree" wording
- no
Policy vs. reality
- Cookie policy: https://www.obchod-priklad.sk/privacy.html (page has no policy text)
The policies could not be compared with the behaviour of the site.
Cookies by scenario
| Name | Domain | Category | Provider | Lifetime | No click | Scroll | Accept | Reject |
|---|---|---|---|---|---|---|---|---|
| _fbp | .obchod-priklad.sk | marketing | Meta | 90 days | – | – | ✓ | ✓ |
| _ga | .obchod-priklad.sk | analytics | 400 days | ✓ | ✓ | ✓ | – | |
| _ga_0000000000 | .obchod-priklad.sk | analytics | 400 days | ✓ | ✓ | ✓ | – | |
| cookie_consent | .obchod-priklad.sk | necessary | — | 180 days | – | – | ✓ | ✓ |
Requests by scenario
No interaction (3)
| URL | Type | Classification |
|---|---|---|
| https://www.obchod-priklad.sk/ | document | own site |
| https://region1.google-analytics.com/g/collect?v=2&tid=G-0000000000&cid=GA1.1.0.0&en=page_view&_p=0 | fetch | Google Analytics 4 · analytics |
| https://www.googletagmanager.com/gtag/js?id=G-0000000000 | script | Google tag (gtag.js) loader · analytics |
Scroll without a click (3)
| URL | Type | Classification |
|---|---|---|
| https://www.obchod-priklad.sk/ | document | own site |
| https://region1.google-analytics.com/g/collect?v=2&tid=G-0000000000&cid=GA1.1.0.0&en=page_view&_p=0 | fetch | Google Analytics 4 · analytics |
| https://www.googletagmanager.com/gtag/js?id=G-0000000000 | script | Google tag (gtag.js) loader · analytics |
Accept all (5)
| URL | Type | Classification |
|---|---|---|
| https://www.obchod-priklad.sk/ | document | own site |
| https://region1.google-analytics.com/g/collect?v=2&tid=G-0000000000&cid=GA1.1.0.0&en=page_view&_p=0 | fetch | Google Analytics 4 · analytics |
| https://www.googletagmanager.com/gtag/js?id=G-0000000000 | script | Google tag (gtag.js) loader · analytics |
| https://connect.facebook.net/en_US/fbevents.js | script | Meta Pixel loader (fbevents.js) · marketing |
| https://www.facebook.com/tr/?id=000000000000000&ev=PageView&noscript=0 | image | Meta Pixel · marketing |
Reject all (4)
| URL | Type | Classification |
|---|---|---|
| https://www.obchod-priklad.sk/ | document | own site |
| https://connect.facebook.net/en_US/fbevents.js | script | Meta Pixel loader (fbevents.js) · marketing |
| https://www.facebook.com/tr/?id=000000000000000&ev=PageView&noscript=0 | image | Meta Pixel · marketing |
| https://c.seznam.cz/retargeting?id=000000 | image | Sklik · marketing |