RU EN
www.
Technical audit · 2026-04-21

kriis.ee

Civil Defense, Evacuation, Emergency Situations
EE

A portal that people turn to when the siren sounds — to find out where to go and how to protect their family. Within 342 milliseconds, Microsoft Clarity starts recording their every mouse movement. Meanwhile, the cookie policy declares the placeholder www.domeen.ee — an unfinished template that has been up for four years.

Timeline of the leak

+342 ms · before consent
Microsoft Clarity (www.clarity.ms) — the session recorder loads. Followed by Cloudflare Insights (+348 ms) and GTM (+820 ms, ID G-D4XXWR7F52). All before any consent.
+1995 ms · the recorder is active
y.clarity.ms — 28 requests, continuous transmission of behavioral data (mouse movements, clicks, scrolling, session video recordings) to Microsoft, USA.
+2666 ms · before consent
Google Analytics (region1, status 204, 7 requests) and DoubleClick (stats.g.doubleclick.net) record the visit and add an event to the advertising profile. There is no 'Reject all' banner.

Declared versus actual

✓ AddThis (__atuvc, __atuvs) — absent from the HAR — заявлен
✓ Facebook, LinkedIn, Twitter — absent from the HAR — заявлен
✓ Cookie source: www.domeen.ee — a placeholder, not the actual domain — заявлен
+ Microsoft Clarity — a session recorder, 28 requests to the USA — не заявлен
+ Google Analytics (_ga_D4XXWR7F52), GTM, DoubleClick — не заявлен
+ Cloudflare Insights, browser-update.org, _cf_bm / cf_clearance — не заявлен

Transfer timings

+342 ms www.clarity.ms

Microsoft Clarity — a session recorder. Data to the USA

+820 ms www.googletagmanager.com

GTM, ID G-D4XXWR7F52

+1995 ms y.clarity.ms

28 requests, session data transfer to Microsoft. Status 0 — the response is blocked, but the requests went out

+2666 ms region1.analytics.google.com

Google Analytics, status 204, 7 requests. Data transmitted

+2667 ms stats.g.doubleclick.net

DoubleClick — an advertising tracker, status 204

Detected trackers

Indicators of GDPR non-compliance

Context

kriis.ee is Estonia’s official crisis-preparedness portal, run by the Government Office (Riigikantselei): civil defense, evacuation, emergency situations. This is where people come when the siren sounds, when they need to know what to do, where to go, how to protect their family. HAR: 176 requests, 13 external domains.

A placeholder policy

The cookie policy is published under the Riigikantselei’s name, last updated 07.01.2022, more than four years ago. But more significant than the date: in the cookie table’s “Allikas” (source) column, every row reads www.domeen.ee. This is not a real domain — domeen.ee is Estonian for “domain.” It’s a template placeholder. The Government Office published a template document without replacing www.domeen.ee with the actual site name, and this document has been sitting on the country’s crisis-preparedness portal for four years running.

Microsoft Clarity — a session recorder

Three components of a single product (www.clarity.ms → scripts.clarity.ms → y.clarity.ms) make up Microsoft Clarity, a session recorder. It records every mouse movement, every click, scroll depth, and builds heatmaps and session video recordings. 28 requests to y.clarity.ms per session — a continuous transmission of behavioral data to Microsoft (USA), on a crisis-preparedness portal, and this service is absent from the cookie policy. The cookie-agreed-categories cookie holds the value ["functional"] — meaning the user gave no consent for analytics or marketing, yet _ga and _ga_D4XXWR7F52 are set regardless, and data has been transmitted.

The eID context

Electronic identification (Web eID, token-signing-page-script.js) is integrated into the site. In the same session where a citizen may authenticate via ID card, Microsoft Clarity records the session (28 requests), GTM is active, DoubleClick has transmitted data, and browser-update.org has loaded. This requires separate legal justification under GDPR Art. 9.

Conclusion

A person opens the crisis-preparedness portal to find out what to do during an evacuation, where the nearest shelter is, how to protect their children. Within 342 milliseconds, Microsoft begins recording their every mouse movement. Within two seconds, Google Analytics records the visit, and DoubleClick adds an event to the advertising profile. Meanwhile, the cookie policy declares www.domeen.ee — a placeholder that’s been sitting there for four years. A crisis portal should be a place where the state tells its citizens: we’re protecting you. For now, it’s a place where Microsoft records their session without their knowledge.

Evidence
Original (audit)
HAR file: ee/kriis-ee-2026-04-21.har
SHA-256: ca059d81fdbf62b9fa2730c01bb6aaf449f4b77e043f1df723e0fd6116894fb2
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website kriis.ee.

2. Circumstances
I visited the website kriis.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 21 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) Microsoft Clarity (+342 ms), Cloudflare Insights (+348 ms), GTM (+820 ms), browser-update.org (+2020 ms), Google Analytics (+2666 ms), and DoubleClick (+2667 ms) fire before any user consent.

2) The cookie policy contains www.domeen.ee (Estonian for 'domain') instead of the actual domain in every row of the table. The document is an unfinished template, unchanged since 07.01.2022. The transparency principle is structurally violated.

3) There is no equivalent 'Reject all' button.

4) Coerced consent: the 'Necessary cookies' category is locked, and vendors are not named. The cookie-agreed-categories cookie reads ["functional"], yet _ga and _ga_D4XXWR7F52 are set, and data has been transmitted.

5) The actual recipients are not declared: Microsoft Clarity, GTM, DoubleClick, Cloudflare Insights, browser-update.org, and the _cf_bm/cf_clearance cookies. What is declared — AddThis, Facebook, LinkedIn, Twitter — is absent from the HAR.

6) No transfer mechanism to the USA (Microsoft, Google, Cloudflare) is stated for any recipient.

7) Web eID integration (token-signing-page-script.js). In the same session where a citizen authenticates via ID card, undeclared trackers are running. This requires separate legal justification.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-kriis-ee/

3. Provisions violated
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 5(1)(a); GDPR Art. 7(3); GDPR Art. 7(4), Recital 32; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 9 (eID context)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]