energinet.dk

Context

energinet.dk is the website of Energinet, the state operator of Denmark’s electricity and gas transmission systems, a critical infrastructure asset under the Ministry of Climate, Energy and Utilities. The data controller is Energinet. The privacy policy is extensive (approximately 77,000 characters). Capture: 70 requests, 12 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the IP address via Google Fonts; Monotype — the MyFonts counter; GetKarla (Google Cloud) — the chatbot SDK and API.

Declared versus Actual

The policy is detailed and, notably, names the chat feature directly: it is provided by GetKarla.ai. This disclosure is correct. However, a number of other services actually in operation are absent from the policy, and some of them fire prior to consent.

On page load, in a state of no consent (Set-Cookie zero, no choice made), the following occurs. At +1324 and +1902 ms, Google Fonts loads (fonts.googleapis.com and fonts.gstatic.com, the Inter font), transmitting the visitor’s IP address to Google (USA). At +290 ms, the Monotype MyFonts font license counter fires (hello.myfonts.net/count/). At +507 ms, Microsoft Office UI resources are pulled in (res.cdn.office.net). Neither Google Fonts, MyFonts/Monotype, nor the Office CDN is named in the policy. A Cookie Information consent management platform is present on the site (loading at +92 ms), but it does not hold back these calls.

Separately, there is the declared GetKarla chatbot: its SDK loads as early as +93 ms, and the chatbot model is requested via api.getkarla.ai at +1732 ms — that is, prior to consent and before the user has opened the chat. GetKarla’s infrastructure is hosted on Google Cloud/Firebase, so even this preliminary loading transmits the visitor’s IP address to the provider. The feature itself is disclosed, but its eager loading prior to consent goes beyond what the user actually initiated. Calls to energikort-prod.kru.so relate to the backend of the interactive map and are functional in nature.

Timing Relative to Consent

The Cookie Information consent management platform loads at +92 ms; however, the chatbot SDK (+93 ms), the MyFonts counter (+290 ms), the Office CDN (+507 ms), Google Fonts (+1324 ms), and the chatbot API (+1732 ms) all fire without waiting for the user’s choice. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. Google and Cloudflare (MyFonts) may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation, not the physical location of the nodes. Calls to kru.so are classified as belonging to the map’s functional backend. The exact composition of data transmitted by the chatbot during its preliminary loading cannot be reconstructed in detail from the lean capture; what is recorded is the fact of the SDK loading and the API request occurring prior to consent. Server-side processing is not visible in a browser-based capture.

Conclusion

Denmark’s energy system operator correctly discloses the GetKarla AI chat feature in its policy, but a number of other services fire prior to consent and are not named in the policy: Google Fonts transmits the IP address to Google (USA), the Monotype MyFonts counter and Microsoft Office UI resources load from external domains, and the chatbot’s own SDK and API initialize before the user opens the chat. A Cookie Information consent management platform is present but does not hold back these calls. The transfer of the IP address to external recipients, including a US-based recipient, prior to consent, together with the non-disclosure of some services, constitutes a violation of the requirements concerning consent, disclosure of recipients, and cross-border transfer. Remedy: host fonts locally and remove the MyFonts counter or make it consent-dependent, defer loading of the chatbot SDK and API until the user opens the chat, hold back external services within Cookie Information until consent is given, and disclose all services actually in use in the policy.