RU EN
www.
Technical audit · 03.05.2026

harno.ee

Education Programs, Exams, Scholarships
EE

An educational portal whose users are children and young people (GDPR Art. 8). DoubleClick and Google Analytics collect minors' data with no consent. Meanwhile, the same organization's sister site — rajaleidja.ee — runs with zero trackers. This means harno's choice was made deliberately.

Request timeline

+351 ms · before consent
Cloudflare Insights — status 200, transfer to the USA. cdnjs.cloudflare.com — status 404, but the user's IP address had already reached Cloudflare.
+507 ms · before consent
Google Tag Manager (GA4, ID G-8TVS280V6G) fires before any consent. Followed by 4 actual transfers to region1.analytics.google.com (status 204) and to DoubleClick (stats.g.doubleclick.net) carrying the same tracking ID.
Consent banner
Completely absent. Zero consent requests, zero Set-Cookie. The same template as aki.ee, riigikogu.ee, emta.ee, tai.ee — one contractor, one CMS (Drupal vp_distro).

Declared versus actual

+ Google Analytics (GA4) — G-8TVS280V6G, 4 transfers — not declared
+ DoubleClick — children's data on an educational portal — not declared
+ Google Tag Manager, Cloudflare Insights, browser-update.org — not declared

Transfer timings

+351 ms static.cloudflareinsights.com

Cloudflare Insights, status 200. Data to the USA

+507 ms www.googletagmanager.com

GTM/GA4, ID G-8TVS280V6G, status 200

No exact timing

after region1.analytics.google.comGoogle Analytics — 4 transfers, status 204. IP address, ID, behavior
after stats.g.doubleclick.net/g/collectDoubleClick on a portal for minors. Same ID G-8TVS280V6G
after browser-update.orgA third-party American service, status 200, 3 times

Detected trackers

Indicators of GDPR non-compliance

Context

Harno is Estonia’s Education and Youth Board. Through this site, the state manages educational programs, exams, teacher training courses, and scholarships. The portal’s users are children and young people — minors, for whom GDPR Art. 8 establishes a special protection regime. HAR: 102 requests, 8 external domains, all in the USA.

A familiar pattern

Google Tag Manager (GA4, G-8TVS280V6G) fires 507 ms after loading, before any consent. region1.analytics.google.com records 4 actual transfers to Google Analytics per session (status 204): each carries an IP address, an identifier, and user behavior. stats.g.doubleclick.net/g/collect — DoubleClick collects data on an educational portal for minors, using the same tracking ID. Plus Cloudflare Insights (status 200) and browser-update.org. There is no consent banner, zero Set-Cookie, zero consent requests. This is the same template seen at aki.ee, riigikogu.ee, emta.ee, tai.ee — one contractor, one CMS (Drupal vp_distro), all trackers present by default.

A benchmark next door — rajaleidja.ee

Within the same state ecosystem sits a second site — rajaleidja.ee, a career-counseling portal for schoolchildren. 166 requests, one domain, zero trackers: no Google Analytics, no Cloudflare, no DoubleClick, no browser-update.org. WordPress on Apache, all resources local. No Set-Cookie and no consent requests — and none are needed, because there’s nothing to ask about. The same .ee domain, the same users, the same Board — but a fundamentally different architecture.

The main takeaway

rajaleidja.ee proves that the Education and Youth Board knows how to build sites with no external trackers. harno.ee shows that on its main portal, it chose not to. One site sends children’s data to DoubleClick; the other sends it to no one. This is an architectural choice made deliberately in each case: within a single organization, two teams, two contractors, two philosophies. There are no technical excuses.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/harno-ee-2026-05-03.har
SHA-256: d1d18d95f2da8026faf27d90867cf54a34e49f7e3d85f177dfe2727574e67edf
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — harno.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website harno.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Processing children's data requires special protection. DoubleClick and Google Analytics on an educational portal whose users are minors is a violation given the context.

2) GTM, Cloudflare Insights, and browser-update.org fire mere milliseconds before any consent. No consent banner exists.

3) There is no consent mechanism whatsoever. Zero consent requests, zero Set-Cookie.

4) Data recipients (Google, Cloudflare, DoubleClick, browser-update.org) are not declared.

5) No transfer mechanism to the USA is stated for any recipient. Privacy Shield was invalidated by the CJEU in 2020.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-harno-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — harno.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website harno.ee.

2. Circumstances
I visited the website harno.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 3 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Processing children's data requires special protection. DoubleClick and Google Analytics on an educational portal whose users are minors is a violation given the context.

2) GTM, Cloudflare Insights, and browser-update.org fire mere milliseconds before any consent. No consent banner exists.

3) There is no consent mechanism whatsoever. Zero consent requests, zero Set-Cookie.

4) Data recipients (Google, Cloudflare, DoubleClick, browser-update.org) are not declared.

5) No transfer mechanism to the USA is stated for any recipient. Privacy Shield was invalidated by the CJEU in 2020.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-harno-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 8; GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]