www.kohus.ee

Context

www.kohus.ee is the official portal of the Estonian courts. The data-protection specialist is andmekaitse@kohus.ee. The portal is served through Cloudflare (headers cf-ray, server: cloudflare) over Varnish (x-adv-varnish, x-pass-varnish); the content is in Estonian.

The recording: 420 requests, 19 nodes, a recording length of 116.4 seconds, taken on 17 August 2026. Of the 420 requests, 116 fall on the kohus.ee domain itself and 304 go outward. However, the greater part of the external requests (272) relates to the LinkedIn page the user navigated to via a link midway through the recording; directly on the kohus.ee pages, 32 external requests to seven nodes are at work. The session runs across several internal sections of the portal, departs midway to an external company page on LinkedIn and returns.

The processing is described by one document — “Processing of personal data in the courts” (Isikuandmete töötlemine kohtutes), with the file last edited on 17 August 2026. The document is detailed: definitions, grounds for processing, court proceedings, disclosure of data online, judicial registers, the rights of the data subject. No separate cookie document for the portal was found.

Who receives data directly

Google (Analytics, Tag Manager, Fonts), Matomo, AddToAny, Cloudflare.

Declared versus actual

The document describes anonymised collection; the page behaves otherwise. The policy sets out the processing of a site visit in one paragraph: IP address, browser and operating-system version, time and duration of the visit are collected. And then — a direct guarantee: this information is not linked to data identifying you and is used only in anonymised form, data is collected only on which part of the page was visited and how long was spent there, and it serves only technical-security purposes and compiling visit statistics.

The recording shows five external measurement and sharing services. Google Tag Manager (container gtm 4e68d0) pulls in the Universal Analytics counter — a model built around a client identifier in a cookie, that is, data tied to the device. Matomo on statistika.rik.ee is a visit counter. AddToAny is a set of share buttons that call an external domain on every page. Cloudflare Insights is performance measurement. The anonymity declared in the document is incompatible with analytics that rely on a persistent identifier.

Not a single recipient of web data is named. The document thoroughly lists controllers and processors for the judicial registers — the Ministry of Justice, RIK, the Maritime Administration. But with respect to the data collected when visiting the site, there are no recipients: Google, Matomo, AddToAny and Cloudflare are absent from the text. The words “cookie” (küpsis) and “analytics” (analüütika) do not appear in the document even once.

The basis is not declared, yet consent is required by law. Analytics and advertising cookies, per the guidance of the Estonian regulator Andmekaitse Inspektsioon and the CJEU judgment C-673/17, require prior freely given consent from the user. The portal does not request such consent: across all requests to kohus.ee there was neither a consent-management platform nor a script bearing the marks of a banner. The analytics scripts — Google Tag Manager, the analytics.js counter, Matomo — start straight from the page markup within the first few hundred milliseconds, without any preceding choice.

A running counter that is defunct. The property UA-57253013-1 is Universal Analytics. Data processing in standard Universal Analytics properties was stopped by Google on 1 July 2023. Requests to www.google-analytics.com nonetheless keep going out on every page, and Google Tag Manager keeps pulling in the counter. Transmission to a defunct property serves none of the declared purposes.

The fonts carry the IP address to Google. The Montserrat fonts are loaded directly from fonts.googleapis.com and fonts.gstatic.com, so that the visitor’s IP address goes to Google on every visit. They can be hosted on the site’s own infrastructure — there is no technical need for external loading.

Security headers are set in part. The portal sets strict transport with a one-year term, the frame-embedding ban SAMEORIGIN, the content-type-sniffing ban, and also a detailed Content-Security-Policy with a domain allow-list — this is noticeably better than average. But there is no referrer policy and no permissions policy.

Consent: what is proven and what is not

Proven: there is no consent mechanism on the portal. Across 116 requests to kohus.ee there is not a single request to a consent-management platform and not a single script bearing the marks of a banner. The names of known platforms and general markers in addresses and initiators were checked; zero matches.

Proven: the loading of analytics does not depend on the user’s choice. The scripts for Google Tag Manager, the analytics.js counter, Matomo, AddToAny and Cloudflare Insights are initiated by the page markup itself and run when the browser parses it, at +184…+717 ms. There is no condition before them; on every new internal page the bundle runs again.

Proven: the running analytics property is defunct. The property identifier UA-57253013-1 is readable in the addresses of requests to Google Tag Manager and to the counter. This is a Universal Analytics property that stopped processing data in 2023.

Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation. All conclusions rest on addresses, initiators, response codes and the composition of requests.

Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.

Boundaries of observation

The recording covers several internal pages of the portal and one departure to an external company page on LinkedIn. Resources loaded after that departure — the LinkedIn page itself (licdn.com, linkedin.com), the protechts.net anti-bot protection with transmission to Microsoft, a Google sign-in button and Azure WAF — belong to LinkedIn’s territory, not kohus.ee, and do not enter the analysis of the portal’s violations. They are listed in the timeline only for the completeness of the session picture.

The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. Because response bodies are absent, checks against page markup — the insertion of counters, the presence of a hidden consent banner in the code — are impossible with this file; the conclusion that there is no consent mechanism rests on the absence of requests to consent platforms and of scripts bearing their marks. Full identifiers are not reproduced in the analysis.

The identification of services rests on domains and address patterns: Google Analytics — by google-analytics.com and the property number UA-57253013-1; Google Tag Manager — by googletagmanager.com and the container number; Matomo — by statistika.rik.ee and the matomo.js file; AddToAny — by addtoany.com; Cloudflare Insights — by cloudflareinsights.com; the serving provider — by the cf-ray, server: cloudflare and x-adv-varnish headers.

Conclusion

The official portal of the Estonian courts collects visitor data through five external services — Google Analytics, Google Tag Manager, Matomo, AddToAny and Cloudflare Insights — none of which is named in the data-processing policy. Meanwhile the policy itself states outright that visit data is collected only in anonymised form and serves only technical security and statistics. Google’s analytics, relying on an identifier in a cookie, contradicts this statement.

There is no consent mechanism on the portal: the analytics scripts start from the page markup before any user choice, whereas placing analytics cookies, per the regulator’s guidance and CJEU practice, requires prior freely given consent. The words “cookie” and “analytics” do not appear in the document at all. The Universal Analytics property running on the site has been defunct since 2023, yet requests to it keep going out on every page. The fonts are loaded directly from Google, carrying the visitor’s IP address outward without necessity.

Remediation: name all recipients of web data in the policy, with the fields transmitted and the purposes; introduce a consent mechanism that actually governs the loading of analytics and advertising services, with the option to refuse before they start; bring the paragraph on anonymised collection into line with actual practice, or abandon analytics that rely on identifiers; remove the defunct Universal Analytics property UA-57253013-1; move the fonts to the site’s own infrastructure; add a referrer policy and a permissions policy.