RU EN
www.
Technical audit · 2026-04-16

ekool.eu

Estonia's Largest Education Platform — Grades, Attendance, Correspondence
EE

Estonia's largest school diary: grades, attendance, correspondence between teachers and parents. Its users are children. No consent banner exists at all, and data on every visit goes to six recipients in the USA — including a test server no one has taken down. Either a child's data is protected, or it already belongs to someone else.

Timeline of the leak

On load · before consent
GTM (GTM-NKP9Z9QH), Cloudflare Insights, Amazon CloudFront (Webflow), Google Fonts, cdnjs, jsDelivr, ajax.googleapis — all fire immediately. The user's IP address reaches Google, Amazon, and Cloudflare's servers.
Consent banner
Does not exist as a mechanism. Not a single consent script, no cookie banner. There is technically nothing in place to ask children's parents for consent.
A test server, live in production
announcement-backend.ekool-test.workers.dev — the domain literally contains the word 'test.' Test infrastructure is running on the live site, with visit data going through Cloudflare to the USA. Not mentioned in the policy.

Declared versus actual

✓ Policy: one sentence — 'the Google Analytics service is used' — заявлен
+ Google Tag Manager (GTM-NKP9Z9QH) — не заявлен
+ Amazon CloudFront (Webflow) — an American site builder — не заявлен
+ Cloudflare Insights, cdn.jsdelivr.net, cdnjs.cloudflare.com — не заявлен
+ ekool-test.workers.dev — a test server — не заявлен

Transfer timings

No exact timing

on load www.googletagmanager.comGTM-NKP9Z9QH. The browser blocked the response, but the request went out, IP address to Google
on load d3e54v103j8qbb.cloudfront.netAmazon CloudFront (Webflow), status 200. Data to the USA
on load static.cloudflareinsights.comCloudflare Insights — the attempt was recorded
on load ekool-test.workers.devA test server running in production. Data via Cloudflare to the USA

Detected trackers

Indicators of GDPR non-compliance

Context

eKool is Estonia’s largest education platform: an electronic gradebook, attendance tracking, correspondence between teachers and parents, homework assignments. Used in most Estonian schools. Its users are teachers, parents, and children.

The main issue — no consent banner exists

The eKool site has no consent mechanism at all. Not a single script related to consent, a cookie banner, or GDPR. Scripts fire immediately, with no asking, before any interaction. On page load, GTM (GTM-NKP9Z9QH), Cloudflare Insights, Amazon CloudFront, Google Fonts, cdnjs, jsDelivr, and ajax.googleapis all fire — all before any consent, because consent doesn’t exist as a mechanism here. And GTM isn’t just one tracker — it’s a platform capable of activating any third-party script without changing the site’s code; what exactly is configured inside the container is unknown without access to the account.

Amazon and the test server

eKool is built on Webflow, an American website builder, so data from every visit passes through Amazon CloudFront’s infrastructure (d3e54v103j8qbb.cloudfront.net, USA). A separate finding is announcement-backend.ekool-test.workers.dev: the domain literally contains the word test. This looks like test infrastructure running on the live site; visit data goes through Cloudflare to the USA. Not mentioned in the policy.

The policy — one sentence

The privacy policy addresses analytics in literally one sentence: “The eKool website uses the Google Analytics service.” Absent as recipients: Google Tag Manager, Cloudflare Insights, Amazon CloudFront, cdn.jsdelivr.net, cdnjs.cloudflare.com, ekool-test.workers.dev. Six external recipients — not one appears in the policy (Art. 13(1)(e)).

Conclusion

When it comes to children’s data, there are only two honest paths. The first: the state takes full custody of it — a closed platform, only Estonian servers, only Estonian law and accountability, the way a bank or a hospital would handle it. The second is this: Google, Amazon, Cloudflare, a test server no one bothered to shut down, and six data recipients that appear in not a single document. There is no middle ground: either a child’s data is protected, or it already belongs to someone else. eKool made its choice — the parents just weren’t told about it.

Evidence
Original (audit)
HAR file: ee/ekool-eu-2026-04-16.har
SHA-256: e42555aad6a9ddbae0192fac4b3eb263873f10e8886c59617d9343dabfd9c6c8
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ekool.eu.

2. Circumstances
I visited the website ekool.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) There is no consent mechanism whatsoever. Not a single script related to consent, a cookie banner, or GDPR. Scripts fire immediately, before any interaction.

2) A platform whose users are children operates with no mechanism for obtaining parental consent. Special protection for minors' data is not provided.

3) GTM, Cloudflare Insights, Amazon CloudFront, and Google Fonts fire with no consent — because giving consent is not even possible.

4) Six external recipients (Google Tag Manager, Cloudflare Insights, Amazon CloudFront, cdn.jsdelivr.net, cdnjs.cloudflare.com, ekool-test.workers.dev) are not declared. The policy mentions only Google Analytics.

5) Data transfer to the USA (Google, Amazon, Cloudflare) with no legal mechanism stated.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-ekool-eu/

3. Provisions violated
GDPR Art. 7; GDPR Art. 8; GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]