RU EN
www.
Technical audit · 16.04.2026

ekool.eu

Estonia's Largest Education Platform — Grades, Attendance, Correspondence
EE

Estonia's largest school diary: grades, attendance, correspondence between teachers and parents. Its users are children. No consent banner exists at all, and data on every visit goes to six recipients in the USA — including a test server no one has taken down. Either a child's data is protected, or it already belongs to someone else.

Request timeline

On load · before consent
GTM (GTM-NKP9Z9QH), Cloudflare Insights, Amazon CloudFront (Webflow), Google Fonts, cdnjs, jsDelivr, ajax.googleapis — all fire immediately. The user's IP address reaches Google, Amazon, and Cloudflare's servers.
Consent banner
Does not exist as a mechanism. Not a single consent script, no cookie banner. There is technically nothing in place to ask children's parents for consent.
A test server, live in production
announcement-backend.ekool-test.workers.dev — the domain literally contains the word 'test.' Test infrastructure is running on the live site, with visit data going through Cloudflare to the USA. Not mentioned in the policy.

Declared versus actual

✓ Policy: one sentence — 'the Google Analytics service is used' — declared
+ Google Tag Manager (GTM-NKP9Z9QH) — not declared
+ Amazon CloudFront (Webflow) — an American site builder — not declared
+ Cloudflare Insights, cdn.jsdelivr.net, cdnjs.cloudflare.com — not declared
+ ekool-test.workers.dev — a test server — not declared

Transfer timings

No exact timing

on load www.googletagmanager.comGTM-NKP9Z9QH. The browser blocked the response, but the request went out, IP address to Google
on load d3e54v103j8qbb.cloudfront.netAmazon CloudFront (Webflow), status 200. Data to the USA
on load static.cloudflareinsights.comCloudflare Insights — the attempt was recorded
on load ekool-test.workers.devA test server running in production. Data via Cloudflare to the USA

Detected trackers

Indicators of GDPR non-compliance

Context

eKool is Estonia’s largest education platform: an electronic gradebook, attendance tracking, correspondence between teachers and parents, homework assignments. Used in most Estonian schools. Its users are teachers, parents, and children.

The main issue — no consent banner exists

The eKool site has no consent mechanism at all. Not a single script related to consent, a cookie banner, or GDPR. Scripts fire immediately, with no asking, before any interaction. On page load, GTM (GTM-NKP9Z9QH), Cloudflare Insights, Amazon CloudFront, Google Fonts, cdnjs, jsDelivr, and ajax.googleapis all fire — all before any consent, because consent doesn’t exist as a mechanism here. And GTM isn’t just one tracker — it’s a platform capable of activating any third-party script without changing the site’s code; what exactly is configured inside the container is unknown without access to the account.

Amazon and the test server

eKool is built on Webflow, an American website builder, so data from every visit passes through Amazon CloudFront’s infrastructure (d3e54v103j8qbb.cloudfront.net, USA). A separate finding is announcement-backend.ekool-test.workers.dev: the domain literally contains the word test. This looks like test infrastructure running on the live site; visit data goes through Cloudflare to the USA. Not mentioned in the policy.

The policy — one sentence

The privacy policy addresses analytics in literally one sentence: “The eKool website uses the Google Analytics service.” Absent as recipients: Google Tag Manager, Cloudflare Insights, Amazon CloudFront, cdn.jsdelivr.net, cdnjs.cloudflare.com, ekool-test.workers.dev. Six external recipients — not one appears in the policy (Art. 13(1)(e)).

Conclusion

When it comes to children’s data, there are only two honest paths. The first: the state takes full custody of it — a closed platform, only Estonian servers, only Estonian law and accountability, the way a bank or a hospital would handle it. The second is this: Google, Amazon, Cloudflare, a test server no one bothered to shut down, and six data recipients that appear in not a single document. There is no middle ground: either a child’s data is protected, or it already belongs to someone else. eKool made its choice — the parents just weren’t told about it.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/ekool-eu-2026-04-16.har
SHA-256: e42555aad6a9ddbae0192fac4b3eb263873f10e8886c59617d9343dabfd9c6c8
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — ekool.eu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website ekool.eu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) There is no consent mechanism whatsoever. Not a single script related to consent, a cookie banner, or GDPR. Scripts fire immediately, before any interaction.

2) A platform whose users are children operates with no mechanism for obtaining parental consent. Special protection for minors' data is not provided.

3) GTM, Cloudflare Insights, Amazon CloudFront, and Google Fonts fire with no consent — because giving consent is not even possible.

4) Six external recipients (Google Tag Manager, Cloudflare Insights, Amazon CloudFront, cdn.jsdelivr.net, cdnjs.cloudflare.com, ekool-test.workers.dev) are not declared. The policy mentions only Google Analytics.

5) Data transfer to the USA (Google, Amazon, Cloudflare) with no legal mechanism stated.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-ekool-eu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — ekool.eu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ekool.eu.

2. Circumstances
I visited the website ekool.eu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) There is no consent mechanism whatsoever. Not a single script related to consent, a cookie banner, or GDPR. Scripts fire immediately, before any interaction.

2) A platform whose users are children operates with no mechanism for obtaining parental consent. Special protection for minors' data is not provided.

3) GTM, Cloudflare Insights, Amazon CloudFront, and Google Fonts fire with no consent — because giving consent is not even possible.

4) Six external recipients (Google Tag Manager, Cloudflare Insights, Amazon CloudFront, cdn.jsdelivr.net, cdnjs.cloudflare.com, ekool-test.workers.dev) are not declared. The policy mentions only Google Analytics.

5) Data transfer to the USA (Google, Amazon, Cloudflare) with no legal mechanism stated.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-ekool-eu/

3. GDPR provisions I ask you to examine
GDPR Art. 7; GDPR Art. 8; GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]