www.eesti.ee

Context

www.eesti.ee is the Estonian state portal, the single point of access for citizens to the state’s electronic services. The controller is the State Information System Authority (RIA), registry code 70006317, Pärnu mnt. 139a, Tallinn; the data-protection specialist is andmekaitse@ria.ee. The site is served through Cloudflare (server: cloudflare); the content is in Estonian and Russian.

The recording: 1240 requests, 9 nodes, a recording length of 484 seconds (about eight minutes), taken on 19 August 2026. The recording was made with a login to the personal account: authentication via the state systems TARA and GovSSO, then work in sections containing health and social-security data. Of the nine nodes, the overwhelming majority are Estonian state infrastructure: the portal itself, the *.ria.ee subdomains (authentication and Matomo), buerokratt.eesti.ee (the chatbot). Outside the state infrastructure — static.cloudflareinsights.com (third-party analytics, 7 requests) and one request to Microsoft browser telemetry not related to the portal.

The processing is described by the privacy policy of the eesti.ee state portal (RIA), version of 9 April 2025: eighteen sections, a separate processing table for each service, an analysis of the roles of controller and processor.

Who receives data directly

Beyond the Estonian state infrastructure — only Cloudflare Insights.

Declared versus actual

For an authenticated zone with medical data, the architecture is set up strictly. This should be said directly, since the case is atypical. Login is carried out via the state authentication systems TARA and GovSSO. The content-security-policy restricts sources to the domains of Estonian state agencies (*.ria.ee, *.eesti.ee, *.rik.ee, *.sotsiaalkindlustusamet.ee), the fonts are loaded from the own and state infrastructure, and a referrer policy and a permissions policy are set. All content of the medical and social sections is served from state nodes.

Analytics is disclosed in the policy as an activity. Unlike the typical story of an undisclosed counter, here the document names RIA directly as the controller for the recording of user behaviour and route across the whole portal and for the analytics and development of the portal (clause 3.5.1). That is, the very fact of analytics collection is declared. Only the specific tool — Matomo — is not named, but it is hosted on matomo.ria.ee, the infrastructure of the same controller agency.

The Matomo counter is state-owned, and the medical data did not reach it. Matomo fired late, on the “Data tracking” page (andmejälgija), and transmitted only the URL of this service page and its title. The URLs of the sections viewed earlier — incapacity certificates, prescriptions, health data — did not reach the request to Matomo. That is, the sensitive URLs did not leak into the analytics.

The only recipient outside the state infrastructure is Cloudflare Insights. The static.cloudflareinsights.com/beacon.min.js script is loaded on opening the portal and transmits the visitor’s IP address and referrer to an external performance-analytics node. This is the only transmission of data beyond the Estonian and pan-European state perimeter (the Microsoft browser telemetry does not relate to the portal). Here a subtlety matters: the policy in the security-measures section names Cloudflare directly — but only as a means of protection against cyberattacks under CERT management. The performance analytics cloudflareinsights.com is a different function, and it is not disclosed in the list of recipients of web data.

The policy reserves advertising partners — while the portal processes health data. Clause 12.2, among the authorised processors, names advertising and marketing partners (information from cookies). No advertising requests were recorded — advertising did not fire. But the very presence of such a category in the policy of a state portal through which health and social-security data pass is a wording that calls for caution: it permits what is not expected of such a portal.

A minimisation measure is declared. The policy states that pseudonymisation is applied: the cookie value is stored in the logs without a unique identifier (clause 13). This is noted in the operator’s favour.

Consent: what is proven and what is not

Proven: all the main infrastructure is state-owned. Authentication, the content of the sections, the chatbot and Matomo are hosted on the domains of Estonian state agencies. The content-security-policy restricts loading to these domains.

Proven: the medical URLs were not transmitted to the analytics. The single request to Matomo carries the URL of the andmejälgija service page; the URLs of the medical and social sections visited earlier did not enter it.

Proven: Cloudflare Insights is loaded outside the state infrastructure and before the user’s choice. The request to static.cloudflareinsights.com is initiated by the markup at +7545 ms, with the portal referrer transmitted.

Not proven and not required: the content of the medical sections. What exactly of the health information was displayed to the user is immaterial to the conclusion and is not used in the analysis; response bodies were removed from the published file during sanitisation. What matters is that these URLs did not go to the third-party analytics.

Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation.

Separately: the browser was sending the DNT: 1 header during capture.

Boundaries of observation

The recording covers the login to the personal account and work in the health, social-security and authorisations sections. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

The request to browser.events.data.msn.com relates to the telemetry of the start page of the Microsoft Edge browser (origin ntp.msn.com), not to the eesti.ee portal, and does not enter the analysis of the portal’s behaviour; it is listed only for the completeness of the recording. The TARA, GovSSO, Bürokratt and Matomo systems are hosted on the infrastructure of Estonian state agencies and are not treated as third-party commercial recipients.

The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that the medical URLs did not reach the analytics rests on the network level — the composition of the parameters transmitted to Matomo is read from the recording, and the URL in the single request relates to the service page. Full identifiers are not reproduced in the analysis.

The identification of services rests on domains and address patterns: Cloudflare Insights — by cloudflareinsights.com; Matomo — by matomo.ria.ee and the files matomo.js, matomo.php; TARA and GovSSO — by tara.ria.ee and govsso.ria.ee; Bürokratt — by buerokratt.eesti.ee; the serving provider — by the server: cloudflare header.

Conclusion

The Estonian state portal, in the authenticated zone, behaves almost exemplarily for a portal of this level of sensitivity: login via state authentication systems, all infrastructure state-owned, the content-security-policy restricted to the domains of Estonian agencies, the fonts the own ones, behavioural analytics disclosed in the policy itself, and the Matomo counter, hosted on the infrastructure of the same controller agency, fired in such a way that the URLs of the medical sections did not reach the analytics.

There is essentially one discrepancy: the third-party performance analytics Cloudflare Insights — the only recipient outside the state infrastructure, transmitting the visitor’s IP address and referrer to an external node. The policy names Cloudflare only as a means of protection against attacks, but does not disclose the cloudflareinsights.com analytics in the list of recipients; Matomo, too, is not named individually. Separately, the wording of clause 12.2, which reserves advertising and marketing partners for the portal, draws attention — while health data passes through the portal; in the recording this category did not activate.

Remediation: abandon the third-party Cloudflare Insights performance analytics in favour of measurement by means of the state infrastructure or, if retained, disclose the Cloudflare analytics as a processor separately from the protection against attacks, with the fields transmitted and the legal basis indicated; name the recipients of web data in the cookie policy individually, including Matomo, with the purposes indicated; review the wording of clause 12.2 on advertising and marketing partners as applied to a portal processing special categories of data.