The Estonian Data Protection Inspectorate — the GDPR supervisory authority — 448 requests, 7 nodes, a 60-second recording. On its own site the regulator loads a third-party script from the browser-update.org domain, to which the visitor's IP address and referrer are sent, and includes that domain in its own content-security-policy. A Matomo counter runs, not named in the document. Meanwhile the data-protection terms state that the site uses only two technical CloudFlare cookies, which do not identify the visitor and do not track their activity. There is no consent mechanism; the same scripts run on the cookie page.
Request timeline
Declared versus actual
Transfer timings
Matomo on RIK infrastructure, 14 requests to matomo.js.
bootstrap-datepicker library from a third-party CDN, 14 requests.
Performance measurement, 14 requests.
Third-party update.min.js script; the www.aki.ee referrer and the IP address go out, 14 requests.
Detected trackers
- browser-update.org (update.min.js) — third-party widget script, carries the visitor's IP address and the www.aki.ee referrer to an external domain, 14 requests
- Matomo (statistika.rik.ee) — visit counter on RIK infrastructure, 14 requests to matomo.js
- Cloudflare Insights (static.cloudflareinsights.com) — performance measurement, 14 requests
- cdnjs.cloudflare.com — bootstrap-datepicker library from a third-party CDN
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e) — disclosure of recipientsThe data-protection terms list authorised processors — all Estonian state bodies (RIK, RTK, RIT, RIA, the Competition Authority) — but name not a single third-party web recipient. browser-update.org, Matomo on statistika.rik.ee, Cloudflare Insights and cdnjs are absent from the document. The caveat in the general-principles section that the explanations do not cover processing on the external sites mentioned relates to external links, not to third-party code actively loaded by the page itself.
- GDPR Art. 5(1)(a) — transparencyThe cookie section states that the site uses only two CloudFlare cookies (_cf_bm and _cfuvid) for information-security purposes, that they do not identify the visitor in any way and do not track their activity online. The section on collected data adds that the IP address is not linked to identifying information and is used only for visit statistics. In fact the page loads the third-party browser-update.org script, to which the visitor's IP address and referrer are sent, as well as the Matomo counter. The statement about the absence of tracking and about two technical cookies diverges from the actual composition of third-party requests.
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))There is no consent mechanism on the site: across 448 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The Matomo counter and the third-party browser-update.org script start from the page markup at +256 and +1439 ms, before any user choice. The same scripts run on the cookie page itself (/kupsised), which was visited during the recording.
- GDPR Art. 5(1)(c) — minimisation and control over the supply chainThe supervisory authority's site loads a third-party script from the browser-update.org domain and includes that domain in its own content-security-policy (script-src). As a separate analysis of that domain shows, on pages with an ad slot browser-update.org deploys an advertising stack and addresses dozens of RTB recipients. In this recording the widget delivered only update.min.js, but the very fact of including an external mutable source in the trusted list means that the composition of the loaded code is determined by a third party, not by the operator. The visitor's IP address and referrer, moreover, go to the external domain on every load.
Context
www.aki.ee is the site of the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), the supervisory authority for the enforcement of the GDPR. The controller in the data-protection terms is the inspectorate itself, Tatari 39, Tallinn. The site is served through Cloudflare (cf-ray, server: cloudflare); the content is in Estonian, and the data-protection terms are given in Estonian and Russian.
The recording: 448 requests, 7 nodes, a recording length of 60.3 seconds, taken on 16 August 2026. Of the 448 requests, 252 fall on www.aki.ee, 140 on the subdomains buerokratt.aki.ee and ruuter.buerokratt.aki.ee (the own Bürokratt chatbot on aki.ee infrastructure), and 56 on four third-party nodes: browser-update.org, statistika.rik.ee, Cloudflare Insights and cdnjs, 14 requests each. The session runs across the sections of the enquiry forms of the inspectorate, the data-protection terms page and the cookie page.
The processing is described by one document — the data-protection terms of the Inspectorate, last updated 16 February 2024.
Who receives data directly
browser-update.org, Matomo (statistika.rik.ee), Cloudflare Insights, cdnjs.
Declared versus actual
The data-protection supervisory authority loads on its site a third-party script from an advertising domain. The first request to browser-update.org/update.min.js goes out at +1439 ms, the initiator being the site’s own combined script file. The request transmits the referrer https://www.aki.ee/ and, accordingly, the visitor’s IP address. This is the same domain that features in a separate analysis as a site that, on pages with an ad slot, deploys an advertising stack and requests to dozens of RTB recipients. Here the widget delivered only update.min.js, but something else is essential: the browser-update.org domain is entered in the script-src of the site’s own content-security-policy. That is, the operator has, in a trusted manner, allowed an external mutable source to execute code on the regulator’s page, and the composition of that code is determined by a third party.
The policy declares two technical cookies and an absence of tracking. The cookie section states directly: the site uses only two CloudFlare cookies (_cf_bm, _cfuvid) for information-security purposes, and they do not identify the individual visitor in any way and do not track their activity online. The section on collected data adds that the IP address is not linked to other identifying information and is used only for visit statistics.
In fact, besides the CloudFlare cookies, the page loads a Matomo counter from statistika.rik.ee and a third-party script from browser-update.org. A request to an external domain transmitting the referrer and the IP address is precisely the outward transfer that the phrase “we do not track” denies.
Not a single third-party web recipient is named. The terms list authorised processors — RIK, RTK, RIT, RIA, the Competition Authority — but these are Estonian state bodies servicing Bürokratt and the information systems. browser-update.org, Matomo, Cloudflare Insights and cdnjs are absent from the document. The general-principles section contains a caveat that the explanations do not cover processing on the external sites mentioned — but it is worded about external links, that is, about the user navigating to a third-party site, not about third-party code that the page itself loads. browser-update.org does not fall under this caveat.
Matomo is not named, though it is the main counter. statistika.rik.ee delivers matomo.js and runs on every page. It is hosted on the infrastructure of RIK — an authorised processor that is named in the policy — but as an analytics tool Matomo is not mentioned in the document, while its purpose (collecting visit statistics) directly corresponds to what the policy describes as its own collection.
Security headers are set well. Unlike many, the site sets strict transport, the frame-embedding ban SAMEORIGIN, the content-type-sniffing ban, the referrer policy origin-when-cross-origin and a detailed content-security-policy. The objection is not to their absence but to their content: the script-src allow-list includes not only Matomo, cdnjs and Cloudflare but also browser-update.org, and — as declared, though not fired in this recording — Google Analytics, Google Tag Manager, Siteimprove, Facebook, Twitter, YouTube. That is, the site’s infrastructure is set up for the connection of external analytics and social services.
Consent: what is proven and what is not
Proven: there is no consent mechanism on the site. Across 448 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The names of known platforms and general markers in addresses and initiators were checked; zero matches.
Proven: the third-party scripts start from the markup, without the user’s choice. Matomo is requested at +256 ms, browser-update.org at +1439 ms, both initiated by the markup and scripts of the page itself. There is no condition before them; on every page of the session they run again.
Proven: the IP address and referrer go to browser-update.org. The referrer header in the request to the external domain contains https://www.aki.ee/; the IP address is transmitted by the very fact of the network request. The domain is entered in the site’s content-security-policy.
Proven: the third-party scripts run on the cookie page too. The /kupsised page was visited during the recording; Matomo and browser-update.org ran on it as well.
Not proven and not asserted: the deployment of the browser-update.org advertising stack on the aki.ee site. In this recording the widget delivered only update.min.js; no requests to advertising and RTB recipients from the aki.ee domain were recorded. What is recorded is the fact of loading the third-party script and transmitting the referrer and IP address to it, not the composition of the code it might execute under other conditions.
Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation.
Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.
Boundaries of observation
The recording covers several pages of the site, including the enquiry forms, the data-protection terms and the cookie page. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording.
A number of nodes are entered in the site’s content-security-policy but did not fire in this recording: Google Analytics, Google Tag Manager, Siteimprove, Facebook, Twitter, YouTube, Vimeo, mapbox. They are recorded as CSP-declared dependencies, but not as actually transmitting data — they do not enter the analysis of violations on the basis of actual transmission.
The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that there is no consent mechanism rests on the network level — the composition, addresses and initiators of all 448 requests are read from the recording, and among them there is neither a consent platform nor its marks; the loading of the third-party scripts, moreover, is initiated by the markup and precedes any user choice.
The identification of services rests on domains, address patterns and the content of the content-security-policy: browser-update.org — by the domain and the update.min.js file included in script-src; Matomo — by statistika.rik.ee and the matomo.js file; Cloudflare Insights — by cloudflareinsights.com; cdnjs — by cdnjs.cloudflare.com; Bürokratt — by the buerokratt.aki.ee subdomains (own infrastructure); the serving provider — by the cf-ray and server: cloudflare headers.
Conclusion
The site of the Estonian data-protection supervisory authority loads on its pages a third-party script from the browser-update.org domain, to which the visitor’s IP address and referrer are sent on every load, and enters that domain in its own content-security-policy — that is, it trustedly allows an external mutable source to execute code on the regulator’s page. A Matomo counter runs, not named in the document.
The data-protection terms, meanwhile, state that the site uses only two technical CloudFlare cookies, which do not identify the visitor and do not track their activity online, and that the IP address is not linked to other information. The actual composition of third-party requests — browser-update.org, Matomo, Cloudflare Insights, cdnjs — does not correspond to this description, and there is no consent mechanism on the site at all. The same third-party scripts run on the very page where the cookies used are described.
Remediation: remove the third-party browser-update.org script from the site or host equivalent functionality on the own infrastructure, eliminating the transmission of the IP address and referrer to an external domain, and remove that domain from the trusted content-security-policy list; name all third-party web recipients in the data-protection terms, including Matomo, with the fields transmitted and the purposes; bring the cookie section into line with the actual composition of third-party requests, or abandon the tracking requests in favour of the declared two technical cookies; introduce a consent mechanism that actually governs the loading of analytics and third-party scripts, with the option to refuse before they start; review the content-security-policy allow-list, excluding external analytics and social sources not used for their purpose.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
4ed1374e2428fa2375316c10a65a013387a0ed7b6e158c42930122a5ad1c54aeWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — aki.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта aki.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Условия защиты данных перечисляют авторизованных обработчиков — все эстонские госструктуры (RIK, RTK, RIT, RIA, Конкуренции), — но ни одного стороннего веб-получателя не называют. browser-update.org, Matomo на statistika.rik.ee, Cloudflare Insights и cdnjs в документе отсутствуют. Оговорка в разделе об общих принципах о том, что разъяснения не охватывают обработку на упомянутых внешних сайтах, относится к внешним ссылкам, а не к стороннему коду, активно загружаемому самой страницей. 2) Раздел о cookie заявляет, что на сайте используются только два cookie CloudFlare (_cf_bm и _cfuvid) в целях информационной безопасности, что они никак не идентифицируют посетителя и не отслеживают его действия в сети. Раздел о собираемых данных добавляет, что адрес IP не связывается с идентифицирующей информацией и используется только для статистики посещаемости. Фактически страница загружает сторонний скрипт browser-update.org, которому уходят адрес IP и реферер посетителя, а также счётчик Matomo. Заявление об отсутствии отслеживания и о двух технических cookie расходится с фактическим составом сторонних обращений. 3) Механизма согласия на сайте нет: за 448 обращений не встречается ни одного обращения к платформе управления согласием, ни одного сценария с признаками баннера, ни одного заголовка Set-Cookie. Счётчик Matomo и сторонний скрипт browser-update.org стартуют из разметки страницы на +256 и +1439 мс, до какого-либо выбора пользователя. Те же скрипты работают и на самой странице о cookie (/kupsised), которую посещали в ходе записи. 4) Сайт надзорного органа загружает сторонний скрипт с домена browser-update.org и включает этот домен в собственную политику безопасности содержимого (script-src). Как показывает отдельный разбор этого домена, на страницах с рекламным слотом browser-update.org разворачивает рекламный стек и обращается к десяткам RTB-получателей. В данной записи виджет отдал только update.min.js, однако сам факт включения внешнего изменяемого источника в доверенный список означает, что состав загружаемого кода определяется третьей стороной, а не оператором. Адрес IP и реферер посетителя при этом уходят на внешний домен при каждой загрузке. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-aki-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — aki.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website aki.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The data-protection terms list authorised processors — all Estonian state bodies (RIK, RTK, RIT, RIA, the Competition Authority) — but name not a single third-party web recipient. browser-update.org, Matomo on statistika.rik.ee, Cloudflare Insights and cdnjs are absent from the document. The caveat in the general-principles section that the explanations do not cover processing on the external sites mentioned relates to external links, not to third-party code actively loaded by the page itself. 2) The cookie section states that the site uses only two CloudFlare cookies (_cf_bm and _cfuvid) for information-security purposes, that they do not identify the visitor in any way and do not track their activity online. The section on collected data adds that the IP address is not linked to identifying information and is used only for visit statistics. In fact the page loads the third-party browser-update.org script, to which the visitor's IP address and referrer are sent, as well as the Matomo counter. The statement about the absence of tracking and about two technical cookies diverges from the actual composition of third-party requests. 3) There is no consent mechanism on the site: across 448 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The Matomo counter and the third-party browser-update.org script start from the page markup at +256 and +1439 ms, before any user choice. The same scripts run on the cookie page itself (/kupsised), which was visited during the recording. 4) The supervisory authority's site loads a third-party script from the browser-update.org domain and includes that domain in its own content-security-policy (script-src). As a separate analysis of that domain shows, on pages with an ad slot browser-update.org deploys an advertising stack and addresses dozens of RTB recipients. In this recording the widget delivered only update.min.js, but the very fact of including an external mutable source in the trusted list means that the composition of the loaded code is determined by a third party, not by the operator. The visitor's IP address and referrer, moreover, go to the external domain on every load. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-aki-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — aki.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi aki.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Andmekaitse mõisted loetlevad volitatud töötlejad – kõik Eesti valitsusasutused (RIK, RTK, RIT, RIA, Competition), kuid kolmandatest isikutest veebisaajaid ei nimetata. browser-update.org, Matomo statistikast. rik.ee, Cloudflare Insights ja cdnjs on puudu. Punktis „Üldpõhimõtted sisalduv punkt, mille kohaselt selgitused ei hõlma töötlemist nimetatud välistel saitidel, viitab välistele linkidele ja mitte lehekülje enda poolt aktiivselt laaditud kolmanda osapoole koodile. 2) Küpsise jaotises on kirjas, et saidil kasutatakse infoturbe eesmärgil ainult kahte CloudFlare'i küpsist (cf bm ja cfuvid), mis ei tuvasta külastajat ega jälgi tema veebitegevust. Kogutud andmete osas lisatakse, et IP-aadress ei ole seotud teabe identifitseerimisega ja seda kasutatakse ainult kohalolijate statistika jaoks. Tegelikult laadib leht kolmanda osapoole skripti browser-update.org, mis jätab IP-aadressi ja külastaja suunaja, samuti Matomo loenduri. Märge jälgimise puudumise kohta ja kaks tehnilist küpsist erinevad kolmandate osapoolte taotluste tegelikust koosseisust. 3) Saidil puudub nõusoleku mehhanism: 448 rakenduse puhul puudub juurdepääs nõusoleku haldamise platvormile, bännerimärkidega skriptile, Set-Cookie päisele. Matomo loendur ja kolmanda osapoole skript browser-update.org algavad lehelt märgistust +256 ja +1439 ms enne kasutaja valikut. Samad skriptid töötavad lehel, mis käsitleb salvestamise ajal külastatud küpsiseid (/kupseeritud). 4) Järelevalveasutuse veebisait laadib domeenist browser-update.org alla kolmanda osapoole skripti ja lisab selle domeeni oma sisuturbepoliitikasse (script-src). Nagu selle domeeni eraldi analüüs näitab, kasutab browser-update.org reklaamipesaga lehekülgedel reklaamikomplekti ja käsitleb kümneid RTB saajaid. Selles kirjes andis vidina ainult update.min.js, kuid ainuüksi asjaolu, et väline muutujaallikas on usaldusnimekirjas, tähendab, et allalaaditud koodi koosseisu määrab kolmas isik, mitte operaator. Külastaja IP-aadress ja viitaja lähevad igal allalaadimisel välisele domeenile. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-aki-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — aki.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом aki.ee. 2. Обстоятельства Я посетил сайт aki.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 16.08.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Условия защиты данных перечисляют авторизованных обработчиков — все эстонские госструктуры (RIK, RTK, RIT, RIA, Конкуренции), — но ни одного стороннего веб-получателя не называют. browser-update.org, Matomo на statistika.rik.ee, Cloudflare Insights и cdnjs в документе отсутствуют. Оговорка в разделе об общих принципах о том, что разъяснения не охватывают обработку на упомянутых внешних сайтах, относится к внешним ссылкам, а не к стороннему коду, активно загружаемому самой страницей. 2) Раздел о cookie заявляет, что на сайте используются только два cookie CloudFlare (_cf_bm и _cfuvid) в целях информационной безопасности, что они никак не идентифицируют посетителя и не отслеживают его действия в сети. Раздел о собираемых данных добавляет, что адрес IP не связывается с идентифицирующей информацией и используется только для статистики посещаемости. Фактически страница загружает сторонний скрипт browser-update.org, которому уходят адрес IP и реферер посетителя, а также счётчик Matomo. Заявление об отсутствии отслеживания и о двух технических cookie расходится с фактическим составом сторонних обращений. 3) Механизма согласия на сайте нет: за 448 обращений не встречается ни одного обращения к платформе управления согласием, ни одного сценария с признаками баннера, ни одного заголовка Set-Cookie. Счётчик Matomo и сторонний скрипт browser-update.org стартуют из разметки страницы на +256 и +1439 мс, до какого-либо выбора пользователя. Те же скрипты работают и на самой странице о cookie (/kupsised), которую посещали в ходе записи. 4) Сайт надзорного органа загружает сторонний скрипт с домена browser-update.org и включает этот домен в собственную политику безопасности содержимого (script-src). Как показывает отдельный разбор этого домена, на страницах с рекламным слотом browser-update.org разворачивает рекламный стек и обращается к десяткам RTB-получателей. В данной записи виджет отдал только update.min.js, однако сам факт включения внешнего изменяемого источника в доверенный список означает, что состав загружаемого кода определяется третьей стороной, а не оператором. Адрес IP и реферер посетителя при этом уходят на внешний домен при каждой загрузке. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-aki-ee/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 13(1)(e) — раскрытие получателей; GDPR Art. 5(1)(a) — прозрачность; ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 5(1)(c) — минимизация и контроль над цепочкой поставки 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — aki.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website aki.ee. 2. Circumstances I visited the website aki.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 August 2026 (open methodology, reproducible measurements) documents the following indications: 1) The data-protection terms list authorised processors — all Estonian state bodies (RIK, RTK, RIT, RIA, the Competition Authority) — but name not a single third-party web recipient. browser-update.org, Matomo on statistika.rik.ee, Cloudflare Insights and cdnjs are absent from the document. The caveat in the general-principles section that the explanations do not cover processing on the external sites mentioned relates to external links, not to third-party code actively loaded by the page itself. 2) The cookie section states that the site uses only two CloudFlare cookies (_cf_bm and _cfuvid) for information-security purposes, that they do not identify the visitor in any way and do not track their activity online. The section on collected data adds that the IP address is not linked to identifying information and is used only for visit statistics. In fact the page loads the third-party browser-update.org script, to which the visitor's IP address and referrer are sent, as well as the Matomo counter. The statement about the absence of tracking and about two technical cookies diverges from the actual composition of third-party requests. 3) There is no consent mechanism on the site: across 448 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The Matomo counter and the third-party browser-update.org script start from the page markup at +256 and +1439 ms, before any user choice. The same scripts run on the cookie page itself (/kupsised), which was visited during the recording. 4) The supervisory authority's site loads a third-party script from the browser-update.org domain and includes that domain in its own content-security-policy (script-src). As a separate analysis of that domain shows, on pages with an ad slot browser-update.org deploys an advertising stack and addresses dozens of RTB recipients. In this recording the widget delivered only update.min.js, but the very fact of including an external mutable source in the trusted list means that the composition of the loaded code is determined by a third party, not by the operator. The visitor's IP address and referrer, moreover, go to the external domain on every load. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-aki-ee/ 3. GDPR provisions I ask you to examine GDPR Art. 13(1)(e) — disclosure of recipients; GDPR Art. 5(1)(a) — transparency; ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 5(1)(c) — minimisation and control over the supply chain 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil aki.ee. 2. Asjaolud Külastasin veebisaiti aki.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 16.08.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Andmekaitse mõisted loetlevad volitatud töötlejad – kõik Eesti valitsusasutused (RIK, RTK, RIT, RIA, Competition), kuid kolmandatest isikutest veebisaajaid ei nimetata. browser-update.org, Matomo statistikast. rik.ee, Cloudflare Insights ja cdnjs on puudu. Punktis „Üldpõhimõtted sisalduv punkt, mille kohaselt selgitused ei hõlma töötlemist nimetatud välistel saitidel, viitab välistele linkidele ja mitte lehekülje enda poolt aktiivselt laaditud kolmanda osapoole koodile. 2) Küpsise jaotises on kirjas, et saidil kasutatakse infoturbe eesmärgil ainult kahte CloudFlare'i küpsist (cf bm ja cfuvid), mis ei tuvasta külastajat ega jälgi tema veebitegevust. Kogutud andmete osas lisatakse, et IP-aadress ei ole seotud teabe identifitseerimisega ja seda kasutatakse ainult kohalolijate statistika jaoks. Tegelikult laadib leht kolmanda osapoole skripti browser-update.org, mis jätab IP-aadressi ja külastaja suunaja, samuti Matomo loenduri. Märge jälgimise puudumise kohta ja kaks tehnilist küpsist erinevad kolmandate osapoolte taotluste tegelikust koosseisust. 3) Saidil puudub nõusoleku mehhanism: 448 rakenduse puhul puudub juurdepääs nõusoleku haldamise platvormile, bännerimärkidega skriptile, Set-Cookie päisele. Matomo loendur ja kolmanda osapoole skript browser-update.org algavad lehelt märgistust +256 ja +1439 ms enne kasutaja valikut. Samad skriptid töötavad lehel, mis käsitleb salvestamise ajal külastatud küpsiseid (/kupseeritud). 4) Järelevalveasutuse veebisait laadib domeenist browser-update.org alla kolmanda osapoole skripti ja lisab selle domeeni oma sisuturbepoliitikasse (script-src). Nagu selle domeeni eraldi analüüs näitab, kasutab browser-update.org reklaamipesaga lehekülgedel reklaamikomplekti ja käsitleb kümneid RTB saajaid. Selles kirjes andis vidina ainult update.min.js, kuid ainuüksi asjaolu, et väline muutujaallikas on usaldusnimekirjas, tähendab, et allalaaditud koodi koosseisu määrab kolmas isik, mitte operaator. Külastaja IP-aadress ja viitaja lähevad igal allalaadimisel välisele domeenile. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-aki-ee/ 3. Sätted, mille järgimist palun kontrollida GDPR – artikli 13 lõike 1 punkt e – vastuvõtjate avalikustamine; GDPR artikli 5 lõike 1 punkt a Läbipaistvus; e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a); GDPR artikli 5 lõike 1 punkt c – tarneahela minimeerimine ja kontroll 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]