RU EN
www.
Technical audit · 16.04.2026

id.ee

Information Portal for the ID Card, Mobile-ID, and Smart-ID
EE

A portal explaining to citizens how to use their digital identity — the ID card, Mobile-ID, Smart-ID. A person comes here to authenticate via eID. In that same session, 0.63 seconds in and before any consent, Matomo has already transmitted data about their visit.

Request timeline

+0.42 sec · before consent
Cloudflare Insights — an attempted request (blocked by the browser, but the IP address reached Cloudflare's servers in the USA).
+0.63 sec · before consent
Matomo (matomo.ria.ee) — status 200, then at +0.66 sec status 204: the request carries the page name, idsite=49, and a timestamp. An actual transfer, before the user had time to read the banner.
Consent banner
Two buttons: 'Read the terms' and 'Agree.' There is no decline button. The banner loads in parallel with the trackers — by the time the user sees it, the data has already gone out.

Declared versus actual

✓ Collected: IP address, pages, browser, OS, time, device, language, region — declared
✓ 'The IP address is not linked to identifying information' — declared
+ Matomo — an actual transfer (status 200/204), recipient not named — not declared
+ Cloudflare Insights — an attempt on every page, data to the USA — not declared
+ antirobot.smit.ee — 9 requests, not mentioned at all — not declared

Transfer timings

+0.42 sec static.cloudflareinsights.com

The Cloudflare beacon. Blocked by the browser, but the IP address reached servers in the USA

+0.63 sec matomo.ria.ee

Analytics on the Estonian RIA domain — but before consent. Status 200

+0.66 sec matomo.ria.ee (collect)

Status 204. Page URL, idsite=49, timestamp. An actual transfer

+1.37 sec antirobot.smit.ee

SMIT's anti-bot service. An Estonian domain, 9 requests. Not mentioned in the policy

Detected trackers

Indicators of GDPR non-compliance

Context

id.ee is the official information portal for the ID card, Mobile-ID, and Smart-ID, run by the Estonian Information System Authority (RIA). This is the entry point for citizens trying to understand how their electronic identity works. HAR: 128 requests, 3 external domains. Someone visiting id.ee is most likely about to authenticate via eID or trying to understand their digital identity credentials.

What happens before the banner

0.63 seconds after the page loads — before the user has had physical time to read the banner — Matomo (matomo.ria.ee) sends visit data (status 204). The next request, at +0.66 sec, already carries the page name, the site identifier idsite=49, and a timestamp in its URL. The consent banner loads in parallel: by the time the user sees it, the data has already gone out. Of the three external domains, two are Estonian — Matomo on RIA’s server and the anti-bot service antirobot.smit.ee (SMIT); this is a plus for localization, but both fire before consent. The third — static.cloudflareinsights.com (USA) — was blocked by the browser, but the request is initiated on every page, and the IP address reached Cloudflare’s servers.

CSP — a lock is there, but the door is open

The site has a Content Security Policy set — better than most sites reviewed. But the list is written such that any inline script executes without restriction: a strict CSP doesn’t work that way. Additionally, a second header, content-security-policy-report-only, was found, reporting to csp-reporting.cloudflare.com — data about RIA site CSP events being transmitted to the USA. The portal itself runs on WordPress (banner plugin cookie-law-info 3.2.8, from third-party developer WebToffee) — a public CMS with a broad attack surface, where every plugin is a potential entry point.

Declaration versus fact

The policy declares collection of IP address, pages, browser, OS, time, device, language, and region — but names not a single data recipient. It also states that the IP address is “not linked to identifying information,” which is legally incorrect under the CJEU’s ruling: an IP address is personal data, and Matomo transmits it. The actual recipients — Matomo, Cloudflare Insights, and antirobot.smit.ee — are not stated in the policy (Art. 13(1)(e)).

Conclusion

This is the portal that explains to citizens how to use the card the entire country trusts. Context sharpens the picture: the physical ID card was made by France’s IDEMIA (a €40 million contract), and before that by the Netherlands’ Gemalto, whose contract ended in a scandal over generating citizens’ private keys on its own servers. The very portal explaining this card runs on WordPress and transmits visitor data 0.63 seconds after the page opens — before a person has had time to even read the banner. Estonia calls this a digital state.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/id-ee-2026-04-16.har
SHA-256: d90b0990449f4e4873549879b4b759ce133b97bdbd43a0c2190795be4f9a52a4
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — id.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website id.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Matomo fires 0.63 seconds before any consent — an actual data transfer (status 200/204). Cloudflare Insights initiates a request on every page before consent.

2) There is no equivalent 'Decline' button. The banner offers only 'Read the terms' and 'Agree' — declining in one click is not possible.

3) Matomo, Cloudflare Insights, and antirobot.smit.ee are not declared in the privacy policy as data recipients. No recipients are named at all.

4) The policy states that the IP address is 'not linked to identifying information.' Under the CJEU's 2016 Breyer ruling, an IP address is personal data. The claim is legally incorrect.

5) Data transfer to Cloudflare (USA) with no legal mechanism stated. Additionally, CSP reporting goes to csp-reporting.cloudflare.com — data about RIA site events transmitted to the USA.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-id-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — id.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website id.ee.

2. Circumstances
I visited the website id.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) Matomo fires 0.63 seconds before any consent — an actual data transfer (status 200/204). Cloudflare Insights initiates a request on every page before consent.

2) There is no equivalent 'Decline' button. The banner offers only 'Read the terms' and 'Agree' — declining in one click is not possible.

3) Matomo, Cloudflare Insights, and antirobot.smit.ee are not declared in the privacy policy as data recipients. No recipients are named at all.

4) The policy states that the IP address is 'not linked to identifying information.' Under the CJEU's 2016 Breyer ruling, an IP address is personal data. The claim is legally incorrect.

5) Data transfer to Cloudflare (USA) with no legal mechanism stated. Additionally, CSP reporting goes to csp-reporting.cloudflare.com — data about RIA site events transmitted to the USA.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-id-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7(3); GDPR Art. 13(1)(e); GDPR Art. 5(1)(a); GDPR Chapter V

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]