RU EN
www.
Technical audit · 21.04.2026

kriis.ee

Civil Defense, Evacuation, Emergency Situations
EE

A portal that people turn to when the siren sounds — to find out where to go and how to protect their family. Within 342 milliseconds, Microsoft Clarity starts recording their every mouse movement. Meanwhile, the cookie policy declares the placeholder www.domeen.ee — an unfinished template that has been up for four years.

Request timeline

+342 ms · before consent
Microsoft Clarity (www.clarity.ms) — the session recorder loads. Followed by Cloudflare Insights (+348 ms) and GTM (+820 ms, ID G-D4XXWR7F52). All before any consent.
+1995 ms · the recorder is active
y.clarity.ms — 28 requests, continuous transmission of behavioral data (mouse movements, clicks, scrolling, session video recordings) to Microsoft, USA.
+2666 ms · before consent
Google Analytics (region1, status 204, 7 requests) and DoubleClick (stats.g.doubleclick.net) record the visit and add an event to the advertising profile. There is no 'Reject all' banner.

Declared versus actual

✓ AddThis (__atuvc, __atuvs) — absent from the HAR — declared
✓ Facebook, LinkedIn, Twitter — absent from the HAR — declared
✓ Cookie source: www.domeen.ee — a placeholder, not the actual domain — declared
+ Microsoft Clarity — a session recorder, 28 requests to the USA — not declared
+ Google Analytics (_ga_D4XXWR7F52), GTM, DoubleClick — not declared
+ Cloudflare Insights, browser-update.org, _cf_bm / cf_clearance — not declared

Transfer timings

+342 ms www.clarity.ms

Microsoft Clarity — a session recorder. Data to the USA

+820 ms www.googletagmanager.com

GTM, ID G-D4XXWR7F52

+1995 ms y.clarity.ms

28 requests, session data transfer to Microsoft. Status 0 — the response is blocked, but the requests went out

+2666 ms region1.analytics.google.com

Google Analytics, status 204, 7 requests. Data transmitted

+2667 ms stats.g.doubleclick.net

DoubleClick — an advertising tracker, status 204

Detected trackers

Indicators of GDPR non-compliance

Context

kriis.ee is Estonia’s official crisis-preparedness portal, run by the Government Office (Riigikantselei): civil defense, evacuation, emergency situations. This is where people come when the siren sounds, when they need to know what to do, where to go, how to protect their family. HAR: 176 requests, 13 external domains.

A placeholder policy

The cookie policy is published under the Riigikantselei’s name, last updated 07.01.2022, more than four years ago. But more significant than the date: in the cookie table’s “Allikas” (source) column, every row reads www.domeen.ee. This is not a real domain — domeen.ee is Estonian for “domain.” It’s a template placeholder. The Government Office published a template document without replacing www.domeen.ee with the actual site name, and this document has been sitting on the country’s crisis-preparedness portal for four years running.

Microsoft Clarity — a session recorder

Three components of a single product (www.clarity.ms → scripts.clarity.ms → y.clarity.ms) make up Microsoft Clarity, a session recorder. It records every mouse movement, every click, scroll depth, and builds heatmaps and session video recordings. 28 requests to y.clarity.ms per session — a continuous transmission of behavioral data to Microsoft (USA), on a crisis-preparedness portal, and this service is absent from the cookie policy. The cookie-agreed-categories cookie holds the value ["functional"] — meaning the user gave no consent for analytics or marketing, yet _ga and _ga_D4XXWR7F52 are set regardless, and data has been transmitted.

The eID context

Electronic identification (Web eID, token-signing-page-script.js) is integrated into the site. In the same session where a citizen may authenticate via ID card, Microsoft Clarity records the session (28 requests), GTM is active, DoubleClick has transmitted data, and browser-update.org has loaded. This requires separate legal justification under GDPR Art. 9.

Conclusion

A person opens the crisis-preparedness portal to find out what to do during an evacuation, where the nearest shelter is, how to protect their children. Within 342 milliseconds, Microsoft begins recording their every mouse movement. Within two seconds, Google Analytics records the visit, and DoubleClick adds an event to the advertising profile. Meanwhile, the cookie policy declares www.domeen.ee — a placeholder that’s been sitting there for four years. A crisis portal should be a place where the state tells its citizens: we’re protecting you. For now, it’s a place where Microsoft records their session without their knowledge.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/kriis-ee-2026-04-21.har
SHA-256: ca059d81fdbf62b9fa2730c01bb6aaf449f4b77e043f1df723e0fd6116894fb2
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — kriis.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website kriis.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Microsoft Clarity (+342 ms), Cloudflare Insights (+348 ms), GTM (+820 ms), browser-update.org (+2020 ms), Google Analytics (+2666 ms), and DoubleClick (+2667 ms) fire before any user consent.

2) The cookie policy contains www.domeen.ee (Estonian for 'domain') instead of the actual domain in every row of the table. The document is an unfinished template, unchanged since 07.01.2022. The transparency principle is structurally violated.

3) There is no equivalent 'Reject all' button.

4) Coerced consent: the 'Necessary cookies' category is locked, and vendors are not named. The cookie-agreed-categories cookie reads ["functional"], yet _ga and _ga_D4XXWR7F52 are set, and data has been transmitted.

5) The actual recipients are not declared: Microsoft Clarity, GTM, DoubleClick, Cloudflare Insights, browser-update.org, and the _cf_bm/cf_clearance cookies. What is declared — AddThis, Facebook, LinkedIn, Twitter — is absent from the HAR.

6) No transfer mechanism to the USA (Microsoft, Google, Cloudflare) is stated for any recipient.

7) Web eID integration (token-signing-page-script.js). In the same session where a citizen authenticates via ID card, undeclared trackers are running. This requires separate legal justification.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-kriis-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — kriis.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website kriis.ee.

2. Circumstances
I visited the website kriis.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 21 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) Microsoft Clarity (+342 ms), Cloudflare Insights (+348 ms), GTM (+820 ms), browser-update.org (+2020 ms), Google Analytics (+2666 ms), and DoubleClick (+2667 ms) fire before any user consent.

2) The cookie policy contains www.domeen.ee (Estonian for 'domain') instead of the actual domain in every row of the table. The document is an unfinished template, unchanged since 07.01.2022. The transparency principle is structurally violated.

3) There is no equivalent 'Reject all' button.

4) Coerced consent: the 'Necessary cookies' category is locked, and vendors are not named. The cookie-agreed-categories cookie reads ["functional"], yet _ga and _ga_D4XXWR7F52 are set, and data has been transmitted.

5) The actual recipients are not declared: Microsoft Clarity, GTM, DoubleClick, Cloudflare Insights, browser-update.org, and the _cf_bm/cf_clearance cookies. What is declared — AddThis, Facebook, LinkedIn, Twitter — is absent from the HAR.

6) No transfer mechanism to the USA (Microsoft, Google, Cloudflare) is stated for any recipient.

7) Web eID integration (token-signing-page-script.js). In the same session where a citizen authenticates via ID card, undeclared trackers are running. This requires separate legal justification.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-kriis-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 5(1)(a); GDPR Art. 7(3); GDPR Art. 7(4), Recital 32; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 9 (eID context)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]