iizi.ee
An insurance broker handling clients' health and financial data explicitly declares no data transfer outside the EEA. The HAR records Google Analytics, Facebook SDK, and Google Ads — all before the consent banner, all in the USA.
Timeline of the leak
Declared versus actual
Transfer timings
Google Fonts Open Sans. IP address to the USA
SVG files from Google Storage. USA
The support chat. WebSocket at +956 ms
analytics.js loaded before the banner
Facebook SDK et_EE. Meta, USA
Cookiebot appears
GTM-3Z8T loads
Google Ads page_view
DoubleClick retargeting
Detected trackers
- Google Analytics (www.google-analytics.com, region1.google-analytics.com)
- Google Tag Manager (GTM-3Z8T)
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com)
- Google Storage (storage.googleapis.com)
- Google Ads / DoubleClick (pagead2.googlesyndication.com, ade.googlesyndication.com)
- Facebook SDK (connect.facebook.net)
- Crisp Chat (client.crisp.chat)
- Sentry (o4511375299903488.ingest.de.sentry.io)
- Cookiebot (consent.cookiebot.com)
Indicators of GDPR non-compliance
- GDPR Art. 6(1), Art. 5(1)(a)Google Fonts (+82 ms), Google Storage (+82 ms), Crisp Chat (+188 ms), Google Analytics (+354 ms), and the Facebook SDK (+355 ms) all fire before Cookiebot appears (+1345 ms). Data goes to the USA more than a second before the consent banner.
- GDPR Art. 7Cookiebot appears at 1345 ms. By this point, five external services are already active. After the banner appears, GTM (+6294 ms), Google Ads (+6459 ms), and GA collect (+6533 ms) activate — this may indicate default activation with no explicit consent required.
- GDPR Art. 13(1)(e)The privacy policy (version dated 31.12.2025) declares no data transfer outside the EEA. The HAR records transfers to the USA via Google Analytics, Facebook SDK, Google Ads, Crisp Chat, Google Fonts, and Google Storage. Not one of these recipients is mentioned.
- GDPR Art. 5(1)(a), Art. 13(1)(f), Chapter VThe policy states directly: 'Me ei edasta isikuandmeid väljapoole EL/EMP piire' (we do not transfer personal data outside the EU/EEA). The HAR disproves this for at least six American domains.
- GDPR Art. 9 (potentially)IIZI processes clients' health data (medical insurance, policy section 3.16). An insurance broker handling health data — with a Facebook SDK on its homepage and no consent.
Context
IIZI Kindlustusmaakler AS is Estonia’s largest insurance broker, part of the Austrian GrECo group. It processes insurance contracts across all categories: motor comprehensive, liability, medical insurance, property insurance. The privacy policy explicitly mentions processing clients’ health data (section 3.16). A DPO is appointed (andmekaitse@iizi.ee). Policy updated 31.12.2025. HAR: 167 requests, 17 domains.
Two documents, one contradiction
IIZI has two versions of its privacy policy: a 2024 version (detailed, 5 pages) and the current one dated 31.12.2025 (condensed, 4 pages). Both declare the same thing: data is not transferred outside the EU/EEA.
The current policy (31.12.2025) contains a direct statement: “Me ei edasta isikuandmeid väljapoole Euroopa Liidu/Euroopa Majanduspiirkonna piire” — we do not transfer personal data outside the EU/EEA. The HAR from June 3, 2026, disproves this for at least six American domains, including Google Analytics, Facebook SDK, and Google Ads.
Trackers before consent
Cookiebot appears at +1345 ms. By this point, the following are already active:
+82 ms — Google Fonts (fonts.googleapis.com) and Google Storage (storage.googleapis.com) — SVG icons for insurance products are stored in Google Cloud. The user’s IP address goes to Google, USA.
+188 ms — Crisp Chat (client.crisp.chat) — the support chat. A WebSocket connection is established at +956 ms, before the banner.
+354 ms — Google Analytics (analytics.js) — the older UA version loads before consent.
+355 ms — Facebook SDK (connect.facebook.net/et_EE/sdk.js) — data to Meta (USA). Estonian locale, but American servers.
After Cookiebot appears, GTM (+6294 ms), Google Ads (+6459 ms), and Google DoubleClick retargeting (+6644 ms) activate. This may mean they fire by default with no explicit consent given — or that Cookiebot is configured with categories pre-selected.
Sensitivity context
IIZI sells medical insurance and processes clients’ health data — an Art. 9 GDPR category. A Facebook SDK on the homepage of an insurance broker handling such data is not a matter of technical carelessness. It is a matter of architectural choice that contradicts the declared processing standard.
Sentry — the exception
The one external service in this HAR that meets the EEA declaration: Sentry uses European servers (ingest.de.sentry.io — Germany). This is a deliberate choice — the EU instance of Sentry, not the American one. The same choice could have been made for analytics.
Conclusion
IIZI has a DPO, a current privacy policy, and Cookiebot. The documentation appears to have been prepared in good faith. But the policy declares no data transfer outside the EEA — and the HAR records Google Analytics, Facebook SDK, and Google Ads, all American, all before consent. The gap between the document and reality here is not technical — it is direct and specific. The choice of Sentry with EU servers shows the team knows how to make this distinction. The question is whether the same principle is applied to the rest of the services.
0800cb9c069dbdbffa1735df81887410850635100af06fd4f7aeb7c259d046c6Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
To: Estonian Data Protection Inspectorate (AKI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website iizi.ee. 2. Circumstances I visited the website iizi.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 3 June 2026 (open methodology, reproducible measurements) documents the following indications: 1) Google Fonts (+82 ms), Google Storage (+82 ms), Crisp Chat (+188 ms), Google Analytics (+354 ms), and the Facebook SDK (+355 ms) all fire before Cookiebot appears (+1345 ms). Data goes to the USA more than a second before the consent banner. 2) Cookiebot appears at 1345 ms. By this point, five external services are already active. After the banner appears, GTM (+6294 ms), Google Ads (+6459 ms), and GA collect (+6533 ms) activate — this may indicate default activation with no explicit consent required. 3) The privacy policy (version dated 31.12.2025) declares no data transfer outside the EEA. The HAR records transfers to the USA via Google Analytics, Facebook SDK, Google Ads, Crisp Chat, Google Fonts, and Google Storage. Not one of these recipients is mentioned. 4) The policy states directly: 'Me ei edasta isikuandmeid väljapoole EL/EMP piire' (we do not transfer personal data outside the EU/EEA). The HAR disproves this for at least six American domains. 5) IIZI processes clients' health data (medical insurance, policy section 3.16). An insurance broker handling health data — with a Facebook SDK on its homepage and no consent. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-iizi-ee/ 3. Provisions violated GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 5(1)(a), Art. 13(1)(f), Chapter V; GDPR Art. 9 (potentially) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]