The Estonian Defence Forces website — a single capture across 11 pages, 506 requests, 12 nodes. Hygiene is high: a strict content security policy, the Cookiebot consent platform loads first and correctly blocks the real counters — Google Analytics, Tag Manager, DoubleClick and the Facebook pixel are permitted in the configuration but do not fire without consent. The leak is narrow and goes around that blocking: the embedded Facebook (post images on the homepage) and YouTube (thumbnails on the conscription page) feeds load automatically and send the visitor's IP address to Meta and Google in the US, while reCAPTCHA and Google Fonts start before consent. The browser meanwhile sent DNT: 1. The data-protection principles describe Facebook and YouTube as external links the visitor navigates to themselves, and promise processing of the IP address 'only in anonymised form'.
Request timeline
Declared versus actual
Transfer timings
Cookiebot, first on every page, receives dnt=true.
reCAPTCHA Enterprise before consent. In the cookie declaration — necessary (rc::a).
Cookieless analytics beacon from the markup, before consent.
Images of the embedded Facebook feed on the homepage. IP address to Meta (US).
Playlist API and thumbnails of the embedded YouTube feed on /ajateenistus/. IP address to Google (US).
No exact timing
Detected trackers
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com) — consent management platform; loads first on every page and correctly blocks the script-based trackers until consent
- Google reCAPTCHA Enterprise (www.google.com/recaptcha, www.gstatic.com/recaptcha) — bot protection; loads at +352 ms before consent, transmits data to Google; marked as necessary in the cookie declaration (the rc::a cookie)
- Cloudflare (static.cloudflareinsights.com) — the cookieless beacon.min.js analytics beacon, fires from the page markup before consent; the __cf_bm bot cookie is marked necessary
- Google Fonts (fonts.gstatic.com) — web fonts, the IP address goes to Google
- Facebook / Meta (scontent.ftll3-1.fna.fbcdn.net, scontent.ftll3-2.fna.fbcdn.net) — post images from the embedded Facebook feed on the homepage; the IP address goes to Meta (US)
- YouTube / Google (www.googleapis.com/youtube/v3, i.ytimg.com) — playlist API and thumbnails of the embedded YouTube feed on the /ajateenistus/ page; the IP address goes to Google (US)
- The script-based trackers Google Analytics, Google Tag Manager, DoubleClick and the Facebook pixel are permitted in the CSP but did not fire in this capture — Cookiebot blocked them in the absence of consent
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — transfer of data to third-party recipients without consentThe Cookiebot consent platform loads first on every page and correctly blocks the script-based trackers: Google Analytics, Google Tag Manager, DoubleClick and the Facebook pixel are permitted in the content security policy but did not fire once across the entire capture (11 pages, 506 requests) — consent for statistics and marketing was not given. However, third-party content embedded as images bypasses this blocking. On the homepage, post images from the embedded Facebook feed (scontent.ftll3-1/2.fna.fbcdn.net) load automatically — the visitor's IP address goes to Meta (US). On the conscription page /ajateenistus/, an embedded YouTube feed loads: a request to the playlist API (www.googleapis.com/youtube/v3) and thumbnails (i.ytimg.com) — the IP address goes to Google (US). Additionally, before consent, at +352 ms, reCAPTCHA Enterprise (transmission to Google) and Google Fonts (IP address to Google) start, as does the cookieless Cloudflare analytics beacon. The browser meanwhile sent the DNT: 1 header (in 331 requests), and the Cookiebot platform received the dnt=true parameter — this had no effect on the loading of the embedded content. reCAPTCHA and Cloudflare are marked in the cookie declaration as necessary (distinguishing human from robot), which is defensible for a security tool; the Facebook and YouTube feeds are not security tools and load without consent nonetheless.
- GDPR Art. 5(1)(a) / Art. 13(1)(e) — transparency, recipients and accuracy of descriptionThe Kaitsevägi data-protection principles (updated 08.01.2025) describe Facebook, Instagram, X and YouTube as external pages the visitor navigates to via a link: 'kui liigute kaitseväe veebilehelt vastava lingi kaudu meie … lehele, kogub teie kohta andmeid kolmas pool' (if you navigate via a link from our website to our page, a third party collects data about you), and specify that visit information is received 'only in anonymised form'. In fact the Facebook and YouTube content is embedded in the pages and loads automatically on visit, sending the visitor's IP address to Meta and Google (US) without any link being followed. The document separately states: 'IP-aadresse ei seota teabega, mis võimaldab isikut tuvastada. Andmeid töötleme üksnes isikustamata kujul' (IP addresses are not linked to identifying information; we process data only in anonymised form) — but the transfer of the IP address to a third-party recipient in the US is not anonymisation from that recipient's side. Google reCAPTCHA and Cloudflare are not named in the data-protection principles at all — they appear only in the automatic cookie declaration (rc::a, __cf_bm). Finally, the document states that Google Analytics is used, whereas in this capture the counter is correctly blocked until consent.
Context
mil.ee is the official website of the Estonian Defence Forces (Kaitsevägi). The controller is Eesti Kaitsevägi; the data-protection contact is andmekaitse@mil.ee, with the general address mil@mil.ee. The site is served via Cloudflare and keeps a high bar at the header level: a strict Content-Security-Policy (default-src 'self', script-src 'self' with a narrow domain allowlist), HSTS, Referrer-Policy strict-origin-when-cross-origin, X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff. Consent is managed by the Cookiebot platform.
The capture is a single recording across 11 pages: the homepage, the personal-data-processing page, the cookie page, the general section, the accessibility notice, and the conscription page /ajateenistus/. In total 506 requests, 12 nodes, about twelve minutes, recorded on 6 September 2026. Processing is described by the Kaitsevägi data-protection principles (updated 08.01.2025) and an automatic Cookiebot-based cookie declaration.
By today’s standards the profile is clean: the real counters are blocked, and the set of external requests is short. That is precisely why this audit comes down to a few narrow points rather than systemic tracking.
Who receives data directly
Google (reCAPTCHA, Fonts, YouTube), Meta (Facebook feed images), Cloudflare (analytics beacon). The real counters — Google Analytics, Tag Manager, DoubleClick, the Facebook pixel — are blocked until consent and did not fire in this capture.
Declared vs. actual
The site is built carefully, and this is worth stating plainly: the Cookiebot consent platform loads first on every page, and the script-based trackers — Google Analytics, Google Tag Manager, DoubleClick, the Facebook pixel — although permitted in the content security policy, did not fire once across the capture. Consent for statistics and marketing was not given, and the blocking worked. Against this backdrop the discrepancies are pinpointed.
First — embedded content bypasses the blocking. Cookiebot blocks third-party scripts, but not images. On the homepage, post images from the embedded Facebook feed (scontent.ftll3-1/2.fna.fbcdn.net) load automatically — the visitor’s IP address goes to Meta in the US. On the conscription page /ajateenistus/ an embedded YouTube feed runs: a request to the playlist API (www.googleapis.com/youtube/v3) and video thumbnails (i.ytimg.com) — the IP address goes to Google in the US. Neither the Facebook pixel nor the youtube.com player loads: these are direct requests for images and playlist data, and that is exactly why they bypass the script-based blocking.
Second — the description does not match the mechanics. The data-protection principles describe Facebook, Instagram, X and YouTube as external pages the visitor navigates to via a link: a third party collects the data ‘if you navigate via a link’ to those pages. But the content is embedded in the site’s own pages and loads on an ordinary visit, without any navigation. The difference is material: the document describes an action the user takes, whereas in reality the transfer happens automatically.
Third — the promise of anonymisation does not cover the transfer outward. The document states plainly that IP addresses are not linked to identifying information and are processed only in anonymised form. From the site’s own side this may be so, but the IP address sent to Meta and Google is not anonymised for those recipients — it is personal data that has gone to a third-party recipient in the US. The wording ‘only in anonymised form’ does not describe such a transfer.
Fourth — two recipients are not named in the principles themselves. Google reCAPTCHA Enterprise and Cloudflare are absent from the data-protection principles; they appear only in the automatic cookie declaration (rc::a, __cf_bm), where they are marked as necessary — distinguishing human from robot. For a bot-protection tool, loading before consent is defensible, and it is not recorded here as a violation in itself. But reCAPTCHA Enterprise transmits data to Google at +352 ms, and the visitor learns of this recipient nowhere in the data-protection principles.
Separately: the document states that Google Analytics is used, whereas in this capture the counter is in fact correctly blocked until consent. This is not a discrepancy against the site — rather the document describes the ‘with consent’ state, and the capture was taken without it.
Consent: what is proven and what is not
Proven: the real counters are blocked. Across 11 pages and 506 requests there is not a single request to google-analytics.com, googletagmanager.com, doubleclick.net or the connect.facebook.net pixel — even though all of them are permitted in the content security policy. The Cookiebot platform loads first and gates them in the absence of consent.
Proven: the embedded content loads without consent. The Facebook feed images go out at +2948…+4216 ms on the homepage, the YouTube feed at +752…+1211 ms on the conscription page. There is no consent condition before these requests; the blocking does not extend to images.
Proven: the browser signalled a refusal to be tracked. The DNT: 1 header is present in 331 requests, and the Cookiebot platform received the dnt=true parameter. It had no effect on the embedded content.
Not proven, and not claimed: the operation of the real counters. How Google Analytics and its related scripts behave under this consent state, the capture cannot show — they did not load. The conclusion concerns only the content that actually loaded.
Observation boundaries
The capture covers 11 pages of the site and records browser behaviour, not the services’ internal workings: server-side processing and contracts with recipients are not verified by a browser-level capture. The recording contains one request to www.kv.ee (a price-statistics page) — this is a residual tab from a previous capture in the same browser; it has no relation to mil.ee and is not part of the audit. Service identification relies on domains and URL schemes: Google — by google.com/recaptcha, gstatic, googleapis/youtube and fonts.gstatic.com; Meta — by fbcdn.net; Cloudflare — by cloudflareinsights.com. The classification of reCAPTCHA and Cloudflare as necessary is taken from the site’s own cookie declaration.
The file is published redacted of personal data: cookie values in requests have been removed (Cookie headers are entirely absent from the recording, so the consent state is established not from cookies but from the fact that the script-based trackers were blocked). Response bodies and markup are preserved, so the load order, initiators and request parameters are verified directly against the published file.
The legal assessment is made by the competent authority — Andmekaitse Inspektsioon, to which the data-protection principles themselves refer.
Conclusion
The Defence Forces website is built carefully: a strict content security policy, and the Cookiebot consent platform loads first and genuinely blocks the real counters — Google Analytics, Tag Manager, DoubleClick and the Facebook pixel do not fire in the absence of consent. The problem is not with them, but with third-party content that is embedded as images and therefore bypasses the script-based blocking: the embedded Facebook feed on the homepage and the YouTube feed on the conscription page load automatically and send the visitor’s IP address to Meta and Google in the US. reCAPTCHA and Google Fonts start before consent, and the browser’s DNT: 1 is ignored.
At the same time the data-protection principles describe Facebook and YouTube as external pages the visitor navigates to themselves, and promise processing of the IP address ‘only in anonymised form’ — whereas the embedded content sends that address outward on an ordinary visit, without any navigation. Google reCAPTCHA and Cloudflare are not named in the principles themselves. For a government site, where a visitor to the conscription page is entitled to expect restraint, these points matter more than their short list would suggest.
Remediation: condition the loading of the embedded Facebook and YouTube feeds on consent (for example, via a facade placeholder that loads the content only on click), so that the IP address does not go to Meta and Google before consent; bring the data-protection principles into line with the mechanics — describe Facebook and YouTube as embedded content rather than as links, and disclose the transfer of the IP address to these recipients in the US; name Google reCAPTCHA and Cloudflare in the data-protection principles; and consider self-hosting fonts instead of fonts.gstatic.com so that the IP address does not go to Google.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
1b1214a035dc1e7073698aca401836f6869507a45454926bfc26a08d8679f40bWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — mil.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта mil.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Платформа согласия Cookiebot загружается первой на каждой странице и корректно блокирует скриптовые трекеры: Google Analytics, Google Tag Manager, DoubleClick и пиксель Facebook разрешены в политике безопасности контента, но за весь замер (11 страниц, 506 запросов) не сработали ни разу — согласие на статистику и маркетинг не давалось. Однако сторонний контент, встроенный как изображения, эту блокировку обходит. На главной странице автоматически подгружаются картинки постов из встроенной ленты Facebook (scontent.ftll3-1/2.fna.fbcdn.net) — адрес IP посетителя уходит в Meta (США). На странице срочной службы /ajateenistus/ загружается встроенная лента YouTube: обращение к API плейлиста (www.googleapis.com/youtube/v3) и превью (i.ytimg.com) — адрес IP уходит в Google (США). Дополнительно до согласия на +352 мс стартуют reCAPTCHA Enterprise (передача в Google) и Google Fonts (адрес IP в Google), а также бескуковый аналитический маяк Cloudflare. Браузер при этом отправлял заголовок DNT: 1 (в 331 запросе), и платформа Cookiebot получала параметр dnt=true — на загрузку встроенного контента это не повлияло. reCAPTCHA и Cloudflare помечены в декларации cookie как необходимые (различение человека и робота), что для средства защиты защитимо; ленты Facebook и YouTube к средствам защиты не относятся и тем не менее подгружаются без согласия. 2) Принципы защиты данных Kaitsevägi (обновлены 08.01.2025) описывают Facebook, Instagram, X и YouTube как внешние страницы, куда посетитель переходит по ссылке: «kui liigute kaitseväe veebilehelt vastava lingi kaudu meie … lehele, kogub teie kohta andmeid kolmas pool» (если вы переходите по ссылке на нашу страницу, данные о вас собирает третья сторона), и уточняют, что сведения о посещаемости получают «только в неперсонализированном виде». Фактически контент Facebook и YouTube встроен в страницы и подгружается автоматически при заходе, отправляя адрес IP посетителя в Meta и Google (США) без всякого перехода по ссылке. Документ отдельно утверждает: «IP-aadresse ei seota teabega, mis võimaldab isikut tuvastada. Andmeid töötleme üksnes isikustamata kujul» (адреса IP не связываются с идентифицирующей информацией; данные обрабатываем только в обезличенном виде) — но передача адреса IP стороннему получателю в США обезличиванием со стороны этого получателя не является. Google reCAPTCHA и Cloudflare в самих принципах защиты данных не названы вовсе — они присутствуют лишь в автоматической декларации cookie (rc::a, __cf_bm). Наконец, документ заявляет использование Google Analytics, тогда как в этом замере счётчик корректно заблокирован до согласия. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-mil-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — mil.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website mil.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The Cookiebot consent platform loads first on every page and correctly blocks the script-based trackers: Google Analytics, Google Tag Manager, DoubleClick and the Facebook pixel are permitted in the content security policy but did not fire once across the entire capture (11 pages, 506 requests) — consent for statistics and marketing was not given. However, third-party content embedded as images bypasses this blocking. On the homepage, post images from the embedded Facebook feed (scontent.ftll3-1/2.fna.fbcdn.net) load automatically — the visitor's IP address goes to Meta (US). On the conscription page /ajateenistus/, an embedded YouTube feed loads: a request to the playlist API (www.googleapis.com/youtube/v3) and thumbnails (i.ytimg.com) — the IP address goes to Google (US). Additionally, before consent, at +352 ms, reCAPTCHA Enterprise (transmission to Google) and Google Fonts (IP address to Google) start, as does the cookieless Cloudflare analytics beacon. The browser meanwhile sent the DNT: 1 header (in 331 requests), and the Cookiebot platform received the dnt=true parameter — this had no effect on the loading of the embedded content. reCAPTCHA and Cloudflare are marked in the cookie declaration as necessary (distinguishing human from robot), which is defensible for a security tool; the Facebook and YouTube feeds are not security tools and load without consent nonetheless. 2) The Kaitsevägi data-protection principles (updated 08.01.2025) describe Facebook, Instagram, X and YouTube as external pages the visitor navigates to via a link: 'kui liigute kaitseväe veebilehelt vastava lingi kaudu meie … lehele, kogub teie kohta andmeid kolmas pool' (if you navigate via a link from our website to our page, a third party collects data about you), and specify that visit information is received 'only in anonymised form'. In fact the Facebook and YouTube content is embedded in the pages and loads automatically on visit, sending the visitor's IP address to Meta and Google (US) without any link being followed. The document separately states: 'IP-aadresse ei seota teabega, mis võimaldab isikut tuvastada. Andmeid töötleme üksnes isikustamata kujul' (IP addresses are not linked to identifying information; we process data only in anonymised form) — but the transfer of the IP address to a third-party recipient in the US is not anonymisation from that recipient's side. Google reCAPTCHA and Cloudflare are not named in the data-protection principles at all — they appear only in the automatic cookie declaration (rc::a, __cf_bm). Finally, the document states that Google Analytics is used, whereas in this capture the counter is correctly blocked until consent. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-mil-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — mil.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi mil.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Nõusolekuplatvorm Cookiebot laadib kõigepealt igale lehele ja blokeerib korrektselt skriptide jälgijad: sisuturbepoliitikas on lubatud Google Analytics, Google Tag Manager, DoubleClick ja Facebooki piksel, kuid kogu mõõtmise (11 lehte, 506 päringut) ei töötanud üks kord - statistika ja turunduse nõusolekut ei antud. Kuid piltidena manustatud kolmanda osapoole sisu läheb sellest blokeerimisest mööda. Pealehel laaditakse automaatselt postituste pildid sisseehitatud Facebooki voost (scontent.ftll3-1/2 .fna. fbcdn.net ) - külastaja IP-aadress läheb Metale (USA). Kiireloomulisel teenuse lehel /ajateenistus / laadib alla sisseehitatud YouTube'i voo: juurdepääs esitusloendi API-le (www.googleapis.com/youtube/v3) ja eelvaatlusele (i. ytimg.com) - IP-aadress läheb Google'ile (USA). Lisaks sellele, enne +352 ms-ga nõustumist käivituvad reCAPTCHA Enterprise (edastus Google'ile) ja Google Fonts (IP-aadress Google'ile), samuti Cloudflare'i küpsisevaba analüütiline majakas. Samal ajal saatis brauser DNT päise: 1 (331 taotluses) ja Cookieboti platvorm sai dnt=true parameetri - see ei mõjutanud manustatud sisu laadimist. ReCAPTCHA ja Cloudflare on küpsiste deklaratsioonis märgitud kui vajalik (inimese ja roboti eristamine), mis on kaitstud kaitse eesmärgil; Facebooki ja YouTube'i kanalid ei ole kaitstud ja on sellest hoolimata ilma nõusolekuta alla laaditud. 2) Kaitseväe andmekaitse põhimõtetes (uuendatud 08.01.2025) kirjeldatakse Facebooki, Instagrami, X-i ja YouTube'i väliste lehtedena, kus külastaja klõpsab lingil: „kui liigute kaitseväe veebilehtt; link meie kaudu ... lehele, kogub teie kohta andmeid kolmas pool” (kui klõpsate lingil meie lehele, kogub teie kohta andmeid kolmas isik) ning täpsustatakse, et kohalviibimise teave saadakse „ainult isikustamata kujul”. Tegelikult on Facebooki ja YouTube'i sisu lehtedele integreeritud ja laaditakse automaatselt saabumisel, saates külastaja IP-aadressi Metale ja Google'ile (USA) ilma lingil klõpsamata. Dokumendis on eraldi kirjas: „IP-aadress ei seota teabega, mis võimaldab isikut tuvastada. Andmeid tötleme ainult isikustamata kujul (IP-aadresse ei seostata teabe identifitseerimisega; andmeid töödeldakse ainult anonüümsel kujul) - kuid see saaja ei anonümiseeri IP-aadressi edastamist kolmandast isikust vastuvõtjale Ameerika Ühendriikides. Google reCAPTCHA ja Cloudflare ei ole andmekaitse põhimõtetes ise mainitud – need on olemas ainult automaatses küpsisedeklaratsioonis (rc:::a, cf bm). Lõpuks on dokumendis märgitud Google Analyticsi kasutamine, samas kui selles mõõtmises on loendur õigesti blokeeritud kuni nõusoleku saamiseni. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-mil-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — mil.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом mil.ee. 2. Обстоятельства Я посетил сайт mil.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 06.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Платформа согласия Cookiebot загружается первой на каждой странице и корректно блокирует скриптовые трекеры: Google Analytics, Google Tag Manager, DoubleClick и пиксель Facebook разрешены в политике безопасности контента, но за весь замер (11 страниц, 506 запросов) не сработали ни разу — согласие на статистику и маркетинг не давалось. Однако сторонний контент, встроенный как изображения, эту блокировку обходит. На главной странице автоматически подгружаются картинки постов из встроенной ленты Facebook (scontent.ftll3-1/2.fna.fbcdn.net) — адрес IP посетителя уходит в Meta (США). На странице срочной службы /ajateenistus/ загружается встроенная лента YouTube: обращение к API плейлиста (www.googleapis.com/youtube/v3) и превью (i.ytimg.com) — адрес IP уходит в Google (США). Дополнительно до согласия на +352 мс стартуют reCAPTCHA Enterprise (передача в Google) и Google Fonts (адрес IP в Google), а также бескуковый аналитический маяк Cloudflare. Браузер при этом отправлял заголовок DNT: 1 (в 331 запросе), и платформа Cookiebot получала параметр dnt=true — на загрузку встроенного контента это не повлияло. reCAPTCHA и Cloudflare помечены в декларации cookie как необходимые (различение человека и робота), что для средства защиты защитимо; ленты Facebook и YouTube к средствам защиты не относятся и тем не менее подгружаются без согласия. 2) Принципы защиты данных Kaitsevägi (обновлены 08.01.2025) описывают Facebook, Instagram, X и YouTube как внешние страницы, куда посетитель переходит по ссылке: «kui liigute kaitseväe veebilehelt vastava lingi kaudu meie … lehele, kogub teie kohta andmeid kolmas pool» (если вы переходите по ссылке на нашу страницу, данные о вас собирает третья сторона), и уточняют, что сведения о посещаемости получают «только в неперсонализированном виде». Фактически контент Facebook и YouTube встроен в страницы и подгружается автоматически при заходе, отправляя адрес IP посетителя в Meta и Google (США) без всякого перехода по ссылке. Документ отдельно утверждает: «IP-aadresse ei seota teabega, mis võimaldab isikut tuvastada. Andmeid töötleme üksnes isikustamata kujul» (адреса IP не связываются с идентифицирующей информацией; данные обрабатываем только в обезличенном виде) — но передача адреса IP стороннему получателю в США обезличиванием со стороны этого получателя не является. Google reCAPTCHA и Cloudflare в самих принципах защиты данных не названы вовсе — они присутствуют лишь в автоматической декларации cookie (rc::a, __cf_bm). Наконец, документ заявляет использование Google Analytics, тогда как в этом замере счётчик корректно заблокирован до согласия. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-mil-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — передача данных сторонним получателям без согласия; GDPR Art. 5(1)(a) / Art. 13(1)(e) — прозрачность, получатели и точность описания 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — mil.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website mil.ee. 2. Circumstances I visited the website mil.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 September 2026 (open methodology, reproducible measurements) documents the following indications: 1) The Cookiebot consent platform loads first on every page and correctly blocks the script-based trackers: Google Analytics, Google Tag Manager, DoubleClick and the Facebook pixel are permitted in the content security policy but did not fire once across the entire capture (11 pages, 506 requests) — consent for statistics and marketing was not given. However, third-party content embedded as images bypasses this blocking. On the homepage, post images from the embedded Facebook feed (scontent.ftll3-1/2.fna.fbcdn.net) load automatically — the visitor's IP address goes to Meta (US). On the conscription page /ajateenistus/, an embedded YouTube feed loads: a request to the playlist API (www.googleapis.com/youtube/v3) and thumbnails (i.ytimg.com) — the IP address goes to Google (US). Additionally, before consent, at +352 ms, reCAPTCHA Enterprise (transmission to Google) and Google Fonts (IP address to Google) start, as does the cookieless Cloudflare analytics beacon. The browser meanwhile sent the DNT: 1 header (in 331 requests), and the Cookiebot platform received the dnt=true parameter — this had no effect on the loading of the embedded content. reCAPTCHA and Cloudflare are marked in the cookie declaration as necessary (distinguishing human from robot), which is defensible for a security tool; the Facebook and YouTube feeds are not security tools and load without consent nonetheless. 2) The Kaitsevägi data-protection principles (updated 08.01.2025) describe Facebook, Instagram, X and YouTube as external pages the visitor navigates to via a link: 'kui liigute kaitseväe veebilehelt vastava lingi kaudu meie … lehele, kogub teie kohta andmeid kolmas pool' (if you navigate via a link from our website to our page, a third party collects data about you), and specify that visit information is received 'only in anonymised form'. In fact the Facebook and YouTube content is embedded in the pages and loads automatically on visit, sending the visitor's IP address to Meta and Google (US) without any link being followed. The document separately states: 'IP-aadresse ei seota teabega, mis võimaldab isikut tuvastada. Andmeid töötleme üksnes isikustamata kujul' (IP addresses are not linked to identifying information; we process data only in anonymised form) — but the transfer of the IP address to a third-party recipient in the US is not anonymisation from that recipient's side. Google reCAPTCHA and Cloudflare are not named in the data-protection principles at all — they appear only in the automatic cookie declaration (rc::a, __cf_bm). Finally, the document states that Google Analytics is used, whereas in this capture the counter is correctly blocked until consent. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-mil-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — transfer of data to third-party recipients without consent; GDPR Art. 5(1)(a) / Art. 13(1)(e) — transparency, recipients and accuracy of description 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil mil.ee. 2. Asjaolud Külastasin veebisaiti mil.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 06.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Nõusolekuplatvorm Cookiebot laadib kõigepealt igale lehele ja blokeerib korrektselt skriptide jälgijad: sisuturbepoliitikas on lubatud Google Analytics, Google Tag Manager, DoubleClick ja Facebooki piksel, kuid kogu mõõtmise (11 lehte, 506 päringut) ei töötanud üks kord - statistika ja turunduse nõusolekut ei antud. Kuid piltidena manustatud kolmanda osapoole sisu läheb sellest blokeerimisest mööda. Pealehel laaditakse automaatselt postituste pildid sisseehitatud Facebooki voost (scontent.ftll3-1/2 .fna. fbcdn.net ) - külastaja IP-aadress läheb Metale (USA). Kiireloomulisel teenuse lehel /ajateenistus / laadib alla sisseehitatud YouTube'i voo: juurdepääs esitusloendi API-le (www.googleapis.com/youtube/v3) ja eelvaatlusele (i. ytimg.com) - IP-aadress läheb Google'ile (USA). Lisaks sellele, enne +352 ms-ga nõustumist käivituvad reCAPTCHA Enterprise (edastus Google'ile) ja Google Fonts (IP-aadress Google'ile), samuti Cloudflare'i küpsisevaba analüütiline majakas. Samal ajal saatis brauser DNT päise: 1 (331 taotluses) ja Cookieboti platvorm sai dnt=true parameetri - see ei mõjutanud manustatud sisu laadimist. ReCAPTCHA ja Cloudflare on küpsiste deklaratsioonis märgitud kui vajalik (inimese ja roboti eristamine), mis on kaitstud kaitse eesmärgil; Facebooki ja YouTube'i kanalid ei ole kaitstud ja on sellest hoolimata ilma nõusolekuta alla laaditud. 2) Kaitseväe andmekaitse põhimõtetes (uuendatud 08.01.2025) kirjeldatakse Facebooki, Instagrami, X-i ja YouTube'i väliste lehtedena, kus külastaja klõpsab lingil: „kui liigute kaitseväe veebilehtt; link meie kaudu ... lehele, kogub teie kohta andmeid kolmas pool” (kui klõpsate lingil meie lehele, kogub teie kohta andmeid kolmas isik) ning täpsustatakse, et kohalviibimise teave saadakse „ainult isikustamata kujul”. Tegelikult on Facebooki ja YouTube'i sisu lehtedele integreeritud ja laaditakse automaatselt saabumisel, saates külastaja IP-aadressi Metale ja Google'ile (USA) ilma lingil klõpsamata. Dokumendis on eraldi kirjas: „IP-aadress ei seota teabega, mis võimaldab isikut tuvastada. Andmeid tötleme ainult isikustamata kujul (IP-aadresse ei seostata teabe identifitseerimisega; andmeid töödeldakse ainult anonüümsel kujul) - kuid see saaja ei anonümiseeri IP-aadressi edastamist kolmandast isikust vastuvõtjale Ameerika Ühendriikides. Google reCAPTCHA ja Cloudflare ei ole andmekaitse põhimõtetes ise mainitud – need on olemas ainult automaatses küpsisedeklaratsioonis (rc:::a, cf bm). Lõpuks on dokumendis märgitud Google Analyticsi kasutamine, samas kui selles mõõtmises on loendur õigesti blokeeritud kuni nõusoleku saamiseni. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-mil-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus - direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koostoimes GDPRi artikli 6 lõike 1 punktiga a) - andmete edastamine kolmandatest isikutest vastuvõtjatele ilma nõusolekuta; GDPR artikli 5 lõike 1 punkt a/artikli 13 lõike 1 punkt e – läbipaistvus, vastuvõtjad ja kirjeldav täpsus 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]