Technical audit · 2026-04-12

emta.ee

Tax and Customs Board — Tax Returns, Payments, Business Registration

The tax authority's website carries the financial data of every citizen and business in the country. On it, two Google Analytics accounts run in parallel — and the owner of the second cannot be identified from public data. The cookie policy is empty and has not been updated in 5 years.

Timeline of the leak

+0.92 sec · before consent

Cloudflare Insights — analytics, USA. Followed at +0.94 sec by GTM: the container fires before the banner, data to the USA.

+1.28 sec · before consent

Google Analytics actually sends data to region1.google-analytics.com. browser-update.org (+1.37 sec) transmits browser and device data. All before any button is clicked.

Declared versus actual

✓ Cookie policy: one introductory sentence and a feedback form, no vendors named — заявлен

+ Google Analytics — two GA4 accounts (G-0K12YCGWL9, G-1CLYN82137), 7 transfers — не заявлен

+ Google Tag Manager — не заявлен

+ Cloudflare Insights — не заявлен

+ browser-update.org — 5 requests, entirely absent — не заявлен

Transfer timings

+0.92 sec static.cloudflareinsights.com

Cloudflare Insights, data to the USA

+0.94 sec www.googletagmanager.com

GTM — the container fires before the consent banner

+1.28 sec region1.google-analytics.com

GA account G-0K12YCGWL9. 7 transfers per session

+6.58 sec region1.google-analytics.com

A second GA account, G-1CLYN82137 — owner unknown

+1.37 sec browser-update.org

A third-party service, update.min.js, 5 times per session. Absent from the policy

Detected trackers

Google Analytics (two GA4 accounts)
Google Tag Manager
Cloudflare Insights
browser-update.org

Indicators of GDPR non-compliance

GDPR Art. 6(1), Art. 5(1)(a)
GTM (+0.94 sec), Google Analytics (+1.28 sec), and browser-update.org (+1.37 sec) fire 0.92–1.37 seconds before any user consent.
GDPR Art. 13(1)(e)
Not a single vendor is declared — the cookie policy page is empty (one introductory sentence and a feedback form). browser-update.org is entirely absent.
GDPR Art. 5(1)(b)
Two GA4 accounts run in parallel (G-0K12YCGWL9 and G-1CLYN82137). The owner of the second one cannot be identified from public data — the processing purpose is undefined.
GDPR Art. 5(1)(a), Art. 7
A dark pattern via opacity: the 'Necessary cookies' category is locked but not disclosed, and there is no 'Reject All' button. Consent cannot be informed when there is no information.
GDPR Art. 12(1), Art. 13(1)(c)
Information is not provided in a transparent form: the cookie policy has not been updated since 05.10.2021 (5 years), and processing purposes for each category are not stated.
GDPR Art. 13(1)(f), Chapter V
No transfer mechanism to Google (USA) is stated.

Context

Maksu- ja Tolliamet is Estonia’s Tax and Customs Board. Through this site, citizens and businesses file tax returns, pay taxes, and register companies. This is the financial data of every taxpayer in the country. HAR: 133 requests, 7 external domains.

An empty policy and a dark pattern

The “Cookies” page was last updated on 05.10.2021 — five years ago. Its content: one introductory sentence and a feedback form. Not a single vendor name, not a single specific cookie, not a single data recipient. The banner offers three buttons — “Choose yourself,” “Allow necessary,” “Allow all” — with no “Reject All” button. Selecting “Choose yourself” locks the “Necessary cookies” category, but what exactly it contains is unknown, because the policy is empty. GTM and browser-update.org, which fire a second before the banner, may well be hidden inside it. This is a dark pattern via opacity: you cannot knowingly decline something you don’t know about.

Cloudflare Insights (+0.92 sec), GTM (+0.94 sec), Google Analytics (+1.28 sec), and browser-update.org (+1.37 sec) all fire before the user has clicked anything. Google Analytics genuinely sends data to region1.google-analytics.com.

Two Google Analytics accounts

Over the session, Google Analytics transmitted data 7 times through two different identifiers: G-0K12YCGWL9 (first transfer at +1.28 sec) and G-1CLYN82137 (first transfer at +6.58 sec). Two separate GA4 accounts run in parallel. Who owns the second one cannot be established from public data, and the cookie policy mentions neither. Separately, there’s browser-update.org: a third-party American service loading update.min.js on every page open (5 times per session) — on the tax authority’s website.

Conclusion

One country, one state — two fundamentally different approaches. eesti.ee knows how to build cleanly: a strict CSP, only Estonian domains, zero external trackers. emta.ee — right down the hall — has installed two Google Analytics accounts, added browser-update.org, and hasn’t updated its cookie policy in 5 years. emta.ee carries the financial data of the entire country, and Google knows who visits the tax authority’s site and when. A standard only exists where there’s a specific person responsible for upholding it; where there isn’t, the system follows the path of least resistance. This is precisely why an annual public audit of government sites isn’t an abstraction: if one existed, emta.ee wouldn’t still look like this five years on.

Evidence

Original (audit)

HAR file: ee/emta-ee-2026-04-12.har

SHA-256: 2964975936b31edc45914c4ebb1c9fb474bbc7fb5027452278db03a5fbbdfd81

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website emta.ee.

2. Circumstances
I visited the website emta.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 12 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) GTM (+0.94 sec), Google Analytics (+1.28 sec), and browser-update.org (+1.37 sec) fire 0.92–1.37 seconds before any user consent.

2) Not a single vendor is declared — the cookie policy page is empty (one introductory sentence and a feedback form). browser-update.org is entirely absent.

3) Two GA4 accounts run in parallel (G-0K12YCGWL9 and G-1CLYN82137). The owner of the second one cannot be identified from public data — the processing purpose is undefined.

4) A dark pattern via opacity: the 'Necessary cookies' category is locked but not disclosed, and there is no 'Reject All' button. Consent cannot be informed when there is no information.

5) Information is not provided in a transparent form: the cookie policy has not been updated since 05.10.2021 (5 years), and processing purposes for each category are not stated.

6) No transfer mechanism to Google (USA) is stated.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-emta-ee/

3. Provisions violated
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 13(1)(e); GDPR Art. 5(1)(b); GDPR Art. 5(1)(a), Art. 7; GDPR Art. 12(1), Art. 13(1)(c); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]