The Estonian Data Protection Inspectorate — the GDPR supervisory authority — 448 requests, 7 nodes, a 60-second recording. On its own site the regulator loads a third-party script from the browser-update.org domain, to which the visitor's IP address and referrer are sent, and includes that domain in its own content-security-policy. A Matomo counter runs, not named in the document. Meanwhile the data-protection terms state that the site uses only two technical CloudFlare cookies, which do not identify the visitor and do not track their activity. There is no consent mechanism; the same scripts run on the cookie page.
Timeline of the leak
Declared versus actual
Transfer timings
Matomo on RIK infrastructure, 14 requests to matomo.js.
bootstrap-datepicker library from a third-party CDN, 14 requests.
Performance measurement, 14 requests.
Third-party update.min.js script; the www.aki.ee referrer and the IP address go out, 14 requests.
Detected trackers
- browser-update.org (update.min.js) — third-party widget script, carries the visitor's IP address and the www.aki.ee referrer to an external domain, 14 requests
- Matomo (statistika.rik.ee) — visit counter on RIK infrastructure, 14 requests to matomo.js
- Cloudflare Insights (static.cloudflareinsights.com) — performance measurement, 14 requests
- cdnjs.cloudflare.com — bootstrap-datepicker library from a third-party CDN
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e) — disclosure of recipientsThe data-protection terms list authorised processors — all Estonian state bodies (RIK, RTK, RIT, RIA, the Competition Authority) — but name not a single third-party web recipient. browser-update.org, Matomo on statistika.rik.ee, Cloudflare Insights and cdnjs are absent from the document. The caveat in the general-principles section that the explanations do not cover processing on the external sites mentioned relates to external links, not to third-party code actively loaded by the page itself.
- GDPR Art. 5(1)(a) — transparencyThe cookie section states that the site uses only two CloudFlare cookies (_cf_bm and _cfuvid) for information-security purposes, that they do not identify the visitor in any way and do not track their activity online. The section on collected data adds that the IP address is not linked to identifying information and is used only for visit statistics. In fact the page loads the third-party browser-update.org script, to which the visitor's IP address and referrer are sent, as well as the Matomo counter. The statement about the absence of tracking and about two technical cookies diverges from the actual composition of third-party requests.
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))There is no consent mechanism on the site: across 448 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The Matomo counter and the third-party browser-update.org script start from the page markup at +256 and +1439 ms, before any user choice. The same scripts run on the cookie page itself (/kupsised), which was visited during the recording.
- GDPR Art. 5(1)(c) — minimisation and control over the supply chainThe supervisory authority's site loads a third-party script from the browser-update.org domain and includes that domain in its own content-security-policy (script-src). As a separate analysis of that domain shows, on pages with an ad slot browser-update.org deploys an advertising stack and addresses dozens of RTB recipients. In this recording the widget delivered only update.min.js, but the very fact of including an external mutable source in the trusted list means that the composition of the loaded code is determined by a third party, not by the operator. The visitor's IP address and referrer, moreover, go to the external domain on every load.
Context
www.aki.ee is the site of the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the supervisory authority for the enforcement of the GDPR. The controller in the data-protection terms is the inspectorate itself, Tatari 39, Tallinn. The site is served through Cloudflare (cf-ray, server: cloudflare); the content is in Estonian, and the data-protection terms are given in Estonian and Russian.
The recording: 448 requests, 7 nodes, a recording length of 60.3 seconds, taken on 16 August 2026. Of the 448 requests, 252 fall on www.aki.ee, 140 on the subdomains buerokratt.aki.ee and ruuter.buerokratt.aki.ee (the own Bürokratt chatbot on aki.ee infrastructure), and 56 on four third-party nodes: browser-update.org, statistika.rik.ee, Cloudflare Insights and cdnjs, 14 requests each. The session runs across the sections of the enquiry forms of the inspectorate, the data-protection terms page and the cookie page.
The processing is described by one document — the data-protection terms of the Inspectorate, last updated 16 February 2024.
Who receives data directly
browser-update.org, Matomo (statistika.rik.ee), Cloudflare Insights, cdnjs.
Declared versus actual
The data-protection supervisory authority loads on its site a third-party script from an advertising domain. The first request to browser-update.org/update.min.js goes out at +1439 ms, the initiator being the site’s own combined script file. The request transmits the referrer https://www.aki.ee/ and, accordingly, the visitor’s IP address. This is the same domain that features in a separate analysis as a site that, on pages with an ad slot, deploys an advertising stack and requests to dozens of RTB recipients. Here the widget delivered only update.min.js, but something else is essential: the browser-update.org domain is entered in the script-src of the site’s own content-security-policy. That is, the operator has, in a trusted manner, allowed an external mutable source to execute code on the regulator’s page, and the composition of that code is determined by a third party.
The policy declares two technical cookies and an absence of tracking. The cookie section states directly: the site uses only two CloudFlare cookies (_cf_bm, _cfuvid) for information-security purposes, and they do not identify the individual visitor in any way and do not track their activity online. The section on collected data adds that the IP address is not linked to other identifying information and is used only for visit statistics.
In fact, besides the CloudFlare cookies, the page loads a Matomo counter from statistika.rik.ee and a third-party script from browser-update.org. A request to an external domain transmitting the referrer and the IP address is precisely the outward transfer that the phrase “we do not track” denies.
Not a single third-party web recipient is named. The terms list authorised processors — RIK, RTK, RIT, RIA, the Competition Authority — but these are Estonian state bodies servicing Bürokratt and the information systems. browser-update.org, Matomo, Cloudflare Insights and cdnjs are absent from the document. The general-principles section contains a caveat that the explanations do not cover processing on the external sites mentioned — but it is worded about external links, that is, about the user navigating to a third-party site, not about third-party code that the page itself loads. browser-update.org does not fall under this caveat.
Matomo is not named, though it is the main counter. statistika.rik.ee delivers matomo.js and runs on every page. It is hosted on the infrastructure of RIK — an authorised processor that is named in the policy — but as an analytics tool Matomo is not mentioned in the document, while its purpose (collecting visit statistics) directly corresponds to what the policy describes as its own collection.
Security headers are set well. Unlike many, the site sets strict transport, the frame-embedding ban SAMEORIGIN, the content-type-sniffing ban, the referrer policy origin-when-cross-origin and a detailed content-security-policy. The objection is not to their absence but to their content: the script-src allow-list includes not only Matomo, cdnjs and Cloudflare but also browser-update.org, and — as declared, though not fired in this recording — Google Analytics, Google Tag Manager, Siteimprove, Facebook, Twitter, YouTube. That is, the site’s infrastructure is set up for the connection of external analytics and social services.
Consent: what is proven and what is not
Proven: there is no consent mechanism on the site. Across 448 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The names of known platforms and general markers in addresses and initiators were checked; zero matches.
Proven: the third-party scripts start from the markup, without the user’s choice. Matomo is requested at +256 ms, browser-update.org at +1439 ms, both initiated by the markup and scripts of the page itself. There is no condition before them; on every page of the session they run again.
Proven: the IP address and referrer go to browser-update.org. The referrer header in the request to the external domain contains https://www.aki.ee/; the IP address is transmitted by the very fact of the network request. The domain is entered in the site’s content-security-policy.
Proven: the third-party scripts run on the cookie page too. The /kupsised page was visited during the recording; Matomo and browser-update.org ran on it as well.
Not proven and not asserted: the deployment of the browser-update.org advertising stack on the aki.ee site. In this recording the widget delivered only update.min.js; no requests to advertising and RTB recipients from the aki.ee domain were recorded. What is recorded is the fact of loading the third-party script and transmitting the referrer and IP address to it, not the composition of the code it might execute under other conditions.
Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation.
Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.
Boundaries of observation
The recording covers several pages of the site, including the enquiry forms, the data-protection terms and the cookie page. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording.
A number of nodes are entered in the site’s content-security-policy but did not fire in this recording: Google Analytics, Google Tag Manager, Siteimprove, Facebook, Twitter, YouTube, Vimeo, mapbox. They are recorded as CSP-declared dependencies, but not as actually transmitting data — they do not enter the analysis of violations on the basis of actual transmission.
The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that there is no consent mechanism rests on the network level — the composition, addresses and initiators of all 448 requests are read from the recording, and among them there is neither a consent platform nor its marks; the loading of the third-party scripts, moreover, is initiated by the markup and precedes any user choice.
The identification of services rests on domains, address patterns and the content of the content-security-policy: browser-update.org — by the domain and the update.min.js file included in script-src; Matomo — by statistika.rik.ee and the matomo.js file; Cloudflare Insights — by cloudflareinsights.com; cdnjs — by cdnjs.cloudflare.com; Bürokratt — by the buerokratt.aki.ee subdomains (own infrastructure); the serving provider — by the cf-ray and server: cloudflare headers.
Conclusion
The site of the Estonian data-protection supervisory authority loads on its pages a third-party script from the browser-update.org domain, to which the visitor’s IP address and referrer are sent on every load, and enters that domain in its own content-security-policy — that is, it trustedly allows an external mutable source to execute code on the regulator’s page. A Matomo counter runs, not named in the document.
The data-protection terms, meanwhile, state that the site uses only two technical CloudFlare cookies, which do not identify the visitor and do not track their activity online, and that the IP address is not linked to other information. The actual composition of third-party requests — browser-update.org, Matomo, Cloudflare Insights, cdnjs — does not correspond to this description, and there is no consent mechanism on the site at all. The same third-party scripts run on the very page where the cookies used are described.
Remediation: remove the third-party browser-update.org script from the site or host equivalent functionality on the own infrastructure, eliminating the transmission of the IP address and referrer to an external domain, and remove that domain from the trusted content-security-policy list; name all third-party web recipients in the data-protection terms, including Matomo, with the fields transmitted and the purposes; bring the cookie section into line with the actual composition of third-party requests, or abandon the tracking requests in favour of the declared two technical cookies; introduce a consent mechanism that actually governs the loading of analytics and third-party scripts, with the option to refuse before they start; review the content-security-policy allow-list, excluding external analytics and social sources not used for their purpose.
4ed1374e2428fa2375316c10a65a013387a0ed7b6e158c42930122a5ad1c54aeWhere to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
To: Estonian Data Protection Inspectorate (AKI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website www.aki.ee. 2. Circumstances I visited the website www.aki.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 August 2026 (open methodology, reproducible measurements) documents the following indications: 1) The data-protection terms list authorised processors — all Estonian state bodies (RIK, RTK, RIT, RIA, the Competition Authority) — but name not a single third-party web recipient. browser-update.org, Matomo on statistika.rik.ee, Cloudflare Insights and cdnjs are absent from the document. The caveat in the general-principles section that the explanations do not cover processing on the external sites mentioned relates to external links, not to third-party code actively loaded by the page itself. 2) The cookie section states that the site uses only two CloudFlare cookies (_cf_bm and _cfuvid) for information-security purposes, that they do not identify the visitor in any way and do not track their activity online. The section on collected data adds that the IP address is not linked to identifying information and is used only for visit statistics. In fact the page loads the third-party browser-update.org script, to which the visitor's IP address and referrer are sent, as well as the Matomo counter. The statement about the absence of tracking and about two technical cookies diverges from the actual composition of third-party requests. 3) There is no consent mechanism on the site: across 448 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The Matomo counter and the third-party browser-update.org script start from the page markup at +256 and +1439 ms, before any user choice. The same scripts run on the cookie page itself (/kupsised), which was visited during the recording. 4) The supervisory authority's site loads a third-party script from the browser-update.org domain and includes that domain in its own content-security-policy (script-src). As a separate analysis of that domain shows, on pages with an ad slot browser-update.org deploys an advertising stack and addresses dozens of RTB recipients. In this recording the widget delivered only update.min.js, but the very fact of including an external mutable source in the trusted list means that the composition of the loaded code is determined by a third party, not by the operator. The visitor's IP address and referrer, moreover, go to the external domain on every load. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-aki-ee/ 3. Provisions violated GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 5(1)(a) — transparency; ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 5(1)(c) — minimisation and control over the supply chain 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]