RU EN
www.
Technical audit · 12.04.2026

emta.ee

Tax and Customs Board — Tax Returns, Payments, Business Registration
EE

The tax authority's website carries the financial data of every citizen and business in the country. On it, two Google Analytics accounts run in parallel — and the owner of the second cannot be identified from public data. The cookie policy is empty and has not been updated in 5 years.

Request timeline

+0.92 sec · before consent
Cloudflare Insights — analytics, USA. Followed at +0.94 sec by GTM: the container fires before the banner, data to the USA.
+1.28 sec · before consent
Google Analytics actually sends data to region1.google-analytics.com. browser-update.org (+1.37 sec) transmits browser and device data. All before any button is clicked.
Consent banner
Three buttons: 'Choose yourself,' 'Allow necessary,' 'Allow all.' There is no 'Reject All' button. The 'Necessary' category is locked, but what it contains is unknown: the cookie policy is empty.

Declared versus actual

✓ Cookie policy: one introductory sentence and a feedback form, no vendors named — declared
+ Google Analytics — two GA4 accounts (G-0K12YCGWL9, G-1CLYN82137), 7 transfers — not declared
+ Google Tag Manager — not declared
+ Cloudflare Insights — not declared
+ browser-update.org — 5 requests, entirely absent — not declared

Transfer timings

+0.92 sec static.cloudflareinsights.com

Cloudflare Insights, data to the USA

+0.94 sec www.googletagmanager.com

GTM — the container fires before the consent banner

+1.28 sec region1.google-analytics.com

GA account G-0K12YCGWL9. 7 transfers per session

+6.58 sec region1.google-analytics.com

A second GA account, G-1CLYN82137 — owner unknown

+1.37 sec browser-update.org

A third-party service, update.min.js, 5 times per session. Absent from the policy

Detected trackers

Indicators of GDPR non-compliance

Context

Maksu- ja Tolliamet is Estonia’s Tax and Customs Board. Through this site, citizens and businesses file tax returns, pay taxes, and register companies. This is the financial data of every taxpayer in the country. HAR: 133 requests, 7 external domains.

An empty policy and a dark pattern

The “Cookies” page was last updated on 05.10.2021 — five years ago. Its content: one introductory sentence and a feedback form. Not a single vendor name, not a single specific cookie, not a single data recipient. The banner offers three buttons — “Choose yourself,” “Allow necessary,” “Allow all” — with no “Reject All” button. Selecting “Choose yourself” locks the “Necessary cookies” category, but what exactly it contains is unknown, because the policy is empty. GTM and browser-update.org, which fire a second before the banner, may well be hidden inside it. This is a dark pattern via opacity: you cannot knowingly decline something you don’t know about.

Cloudflare Insights (+0.92 sec), GTM (+0.94 sec), Google Analytics (+1.28 sec), and browser-update.org (+1.37 sec) all fire before the user has clicked anything. Google Analytics genuinely sends data to region1.google-analytics.com.

Two Google Analytics accounts

Over the session, Google Analytics transmitted data 7 times through two different identifiers: G-0K12YCGWL9 (first transfer at +1.28 sec) and G-1CLYN82137 (first transfer at +6.58 sec). Two separate GA4 accounts run in parallel. Who owns the second one cannot be established from public data, and the cookie policy mentions neither. Separately, there’s browser-update.org: a third-party American service loading update.min.js on every page open (5 times per session) — on the tax authority’s website.

Conclusion

One country, one state — two fundamentally different approaches. eesti.ee knows how to build cleanly: a strict CSP, only Estonian domains, zero external trackers. emta.ee — right down the hall — has installed two Google Analytics accounts, added browser-update.org, and hasn’t updated its cookie policy in 5 years. emta.ee carries the financial data of the entire country, and Google knows who visits the tax authority’s site and when. A standard only exists where there’s a specific person responsible for upholding it; where there isn’t, the system follows the path of least resistance. This is precisely why an annual public audit of government sites isn’t an abstraction: if one existed, emta.ee wouldn’t still look like this five years on.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/emta-ee-2026-04-12.har
SHA-256: 2964975936b31edc45914c4ebb1c9fb474bbc7fb5027452278db03a5fbbdfd81
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — emta.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website emta.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) GTM (+0.94 sec), Google Analytics (+1.28 sec), and browser-update.org (+1.37 sec) fire 0.92–1.37 seconds before any user consent.

2) Not a single vendor is declared — the cookie policy page is empty (one introductory sentence and a feedback form). browser-update.org is entirely absent.

3) Two GA4 accounts run in parallel (G-0K12YCGWL9 and G-1CLYN82137). The owner of the second one cannot be identified from public data — the processing purpose is undefined.

4) A dark pattern via opacity: the 'Necessary cookies' category is locked but not disclosed, and there is no 'Reject All' button. Consent cannot be informed when there is no information.

5) Information is not provided in a transparent form: the cookie policy has not been updated since 05.10.2021 (5 years), and processing purposes for each category are not stated.

6) No transfer mechanism to Google (USA) is stated.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-emta-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — emta.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website emta.ee.

2. Circumstances
I visited the website emta.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 12 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) GTM (+0.94 sec), Google Analytics (+1.28 sec), and browser-update.org (+1.37 sec) fire 0.92–1.37 seconds before any user consent.

2) Not a single vendor is declared — the cookie policy page is empty (one introductory sentence and a feedback form). browser-update.org is entirely absent.

3) Two GA4 accounts run in parallel (G-0K12YCGWL9 and G-1CLYN82137). The owner of the second one cannot be identified from public data — the processing purpose is undefined.

4) A dark pattern via opacity: the 'Necessary cookies' category is locked but not disclosed, and there is no 'Reject All' button. Consent cannot be informed when there is no information.

5) Information is not provided in a transparent form: the cookie policy has not been updated since 05.10.2021 (5 years), and processing purposes for each category are not stated.

6) No transfer mechanism to Google (USA) is stated.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-emta-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 13(1)(e); GDPR Art. 5(1)(b); GDPR Art. 5(1)(a), Art. 7; GDPR Art. 12(1), Art. 13(1)(c); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]