RU EN
www.
Technical audit · 31.05.2026

energinet.dk

Danish Energy System Operator
DK

Denmark's energy system operator — 70 requests, 12 domains. A Cookie Information consent management platform is present, but prior to consent, Google Fonts fires (IP address to Google, USA), along with the Monotype MyFonts counter and the SDK for the GetKarla AI chatbot. The chatbot is declared in the policy; Google Fonts, MyFonts, and the Office CDN are not.

Request timeline

+0 ms · portal load
Content and resources served from energinet.dk.
+92 ms · consent management platform
policy.app.cookieinformation.com/uc.js — Cookie Information loads.
+93 ms · chatbot SDK prior to consent
static.karlahub.com and static.getkarla.ai — the SDK for the GetKarla AI chatbot (hosted on Google Cloud/Firebase).
+290 ms · font counter
hello.myfonts.net/count/ — the Monotype MyFonts license counter. Not named in the policy.
session state — no consent
Set-Cookie across the entire session is zero; no choice has been made by the user.
+1324–1902 ms · Google Fonts prior to consent
fonts.googleapis.com and fonts.gstatic.com — Google Fonts (Inter). The visitor's IP address is transmitted to Google (USA).
+1732 ms · chatbot API
api.getkarla.ai/v1/models/... — a request for the chatbot model, before the user opens the chat.

Declared versus actual

✓ The GetKarla.ai AI chat feature — declared in the policy as the chatbot provider — declared
✓ Statistics and cookies — mentioned in generic terms; transfer to third countries under certain conditions — declared
+ Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — IP address to Google (USA), prior to consent, not named — not declared
+ MyFonts / Monotype (hello.myfonts.net) — font counter, prior to consent, not named — not declared
+ res.cdn.office.net — Microsoft Office CDN, not named — not declared

Transfer timings

+93 ms static.karlahub.com

GetKarla SDK. Hosted on Google Cloud/Firebase.

+290 ms hello.myfonts.net

Monotype MyFonts counter. Not named in the policy.

+1324 ms fonts.googleapis.com

Google Fonts. Google, USA. Not named.

+1732 ms api.getkarla.ai

GetKarla chatbot model API. Before the chat is opened.

Detected trackers

Indicators of GDPR non-compliance

Context

energinet.dk is the website of Energinet, the state operator of Denmark’s electricity and gas transmission systems, a critical infrastructure asset under the Ministry of Climate, Energy and Utilities. The data controller is Energinet. The privacy policy is extensive (approximately 77,000 characters). Capture: 70 requests, 12 domains, recorded in a clean browser.

Google (USA) — the IP address via Google Fonts; Monotype — the MyFonts counter; GetKarla (Google Cloud) — the chatbot SDK and API.

Declared versus Actual

The policy is detailed and, notably, names the chat feature directly: it is provided by GetKarla.ai. This disclosure is correct. However, a number of other services actually in operation are absent from the policy, and some of them fire prior to consent.

On page load, in a state of no consent (Set-Cookie zero, no choice made), the following occurs. At +1324 and +1902 ms, Google Fonts loads (fonts.googleapis.com and fonts.gstatic.com, the Inter font), transmitting the visitor’s IP address to Google (USA). At +290 ms, the Monotype MyFonts font license counter fires (hello.myfonts.net/count/). At +507 ms, Microsoft Office UI resources are pulled in (res.cdn.office.net). Neither Google Fonts, MyFonts/Monotype, nor the Office CDN is named in the policy. A Cookie Information consent management platform is present on the site (loading at +92 ms), but it does not hold back these calls.

Separately, there is the declared GetKarla chatbot: its SDK loads as early as +93 ms, and the chatbot model is requested via api.getkarla.ai at +1732 ms — that is, prior to consent and before the user has opened the chat. GetKarla’s infrastructure is hosted on Google Cloud/Firebase, so even this preliminary loading transmits the visitor’s IP address to the provider. The feature itself is disclosed, but its eager loading prior to consent goes beyond what the user actually initiated. Calls to energikort-prod.kru.so relate to the backend of the interactive map and are functional in nature.

The Cookie Information consent management platform loads at +92 ms; however, the chatbot SDK (+93 ms), the MyFonts counter (+290 ms), the Office CDN (+507 ms), Google Fonts (+1324 ms), and the chatbot API (+1732 ms) all fire without waiting for the user’s choice. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. Google and Cloudflare (MyFonts) may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation, not the physical location of the nodes. Calls to kru.so are classified as belonging to the map’s functional backend. The exact composition of data transmitted by the chatbot during its preliminary loading cannot be reconstructed in detail from the lean capture; what is recorded is the fact of the SDK loading and the API request occurring prior to consent. Server-side processing is not visible in a browser-based capture.

Conclusion

Denmark’s energy system operator correctly discloses the GetKarla AI chat feature in its policy, but a number of other services fire prior to consent and are not named in the policy: Google Fonts transmits the IP address to Google (USA), the Monotype MyFonts counter and Microsoft Office UI resources load from external domains, and the chatbot’s own SDK and API initialize before the user opens the chat. A Cookie Information consent management platform is present but does not hold back these calls. The transfer of the IP address to external recipients, including a US-based recipient, prior to consent, together with the non-disclosure of some services, indicates non-compliance with the requirements concerning consent, disclosure of recipients, and cross-border transfer. Remedy: host fonts locally and remove the MyFonts counter or make it consent-dependent, defer loading of the chatbot SDK and API until the user opens the chat, hold back external services within Cookie Information until consent is given, and disclose all services actually in use in the policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: dk/energinet-dk-2026-05-31.har
SHA-256: 87419632983a968589dd76d977fbe1105fe36f0150d0a87fa32c0e2891195550
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — energinet.dk

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website energinet.dk.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) On page load, prior to consent, Google Fonts loads (fonts.googleapis.com +1324 ms, fonts.gstatic.com +1902 ms), transmitting the visitor's IP address to Google (USA). The Monotype MyFonts counter also fires (hello.myfonts.net/count/, +290 ms), and Microsoft Office UI resources load (res.cdn.office.net). Neither Google Fonts, MyFonts/Monotype, nor the Office CDN is named in the policy. A Cookie Information consent management platform is present but does not hold back these calls; Set-Cookie across the entire session is zero.

2) The GetKarla AI chatbot is declared in the policy as the provider of the chat feature; however, its SDK loads at +93 ms, and the chatbot model is requested via api.getkarla.ai/v1/models/... at +1732 ms — prior to consent and before the user opens the chat. GetKarla's infrastructure is hosted on Google Cloud/Firebase; the mere loading of the SDK and the API call already transmit the visitor's IP address to the provider prior to consent.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/dk-energinet-dk/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Danish Data Protection Agency (Datatilsynet) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — energinet.dk

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website energinet.dk.

2. Circumstances
I visited the website energinet.dk and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) On page load, prior to consent, Google Fonts loads (fonts.googleapis.com +1324 ms, fonts.gstatic.com +1902 ms), transmitting the visitor's IP address to Google (USA). The Monotype MyFonts counter also fires (hello.myfonts.net/count/, +290 ms), and Microsoft Office UI resources load (res.cdn.office.net). Neither Google Fonts, MyFonts/Monotype, nor the Office CDN is named in the policy. A Cookie Information consent management platform is present but does not hold back these calls; Set-Cookie across the entire session is zero.

2) The GetKarla AI chatbot is declared in the policy as the provider of the chat feature; however, its SDK loads at +93 ms, and the chatbot model is requested via api.getkarla.ai/v1/models/... at +1732 ms — prior to consent and before the user opens the chat. GetKarla's infrastructure is hosted on Google Cloud/Firebase; the mere loading of the SDK and the API call already transmit the visitor's IP address to the provider prior to consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/dk-energinet-dk/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and transfer; ePrivacy (Danish Cookiebekendtgørelse) — third-party service prior to consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]