RU EN
www.
Technical audit · 02.05.2026

oiguskantsler.ee

Constitutional Ombudsman, Protecting Citizens' Rights Against the State
EE

An institution that protects citizens' rights against state overreach — the last barrier before court. Technically, the site is nearly exemplary: zero Google Analytics, zero DoubleClick, a working CSP. But a single Google Fonts call transmits the visitor's IP address to the USA, and the privacy policy is one of the weakest in this series.

Request timeline

+233 ms · before consent
fonts.googleapis.com — status 200, 4 requests. Followed by fonts.gstatic.com (+261 ms, 8 requests): the Roboto Flex typeface from Google's servers in the USA. IP address, User-Agent, and Referer (oiguskantsler.ee) go to Google.
Consent banner
Completely absent. The transfer to Google happens automatically on the first page load, with no asking.
What is blocked
Cloudflare Insights — status 0, the CSP worked, no data got out (a rarity in this series). Matomo on statistika.rik.ee (RIK's state server) — data stays within Estonia. Social media icons — local.

Declared versus actual

✓ In abstract terms: 'a tool that collects general data' — with no names given — declared
✓ 'Data is available only in non-personalized form' — declared
+ Google Fonts — IP address to the USA, unnamed — not declared
+ Matomo / statistika.rik.ee — unnamed — not declared
+ No cookie policy whatsoever — not declared

Transfer timings

+233 ms fonts.googleapis.com

Google Fonts, 4 requests, status 200

+261 ms fonts.gstatic.com

The Roboto Flex typeface, 8 requests. IP address to Google (USA)

No exact timing

on load static.cloudflareinsights.comStatus 0 — the CSP worked, no data got out
per session statistika.rik.ee (Matomo)Matomo on RIK's state server (Estonia) — the correct choice

Detected trackers

Indicators of GDPR non-compliance

Context

oiguskantsler.ee is the website of Estonia’s Chancellor of Justice, the constitutional ombudsman. This institution exists for one purpose — to protect citizens’ rights against state overreach: verifying laws’ compliance with the Constitution, receiving complaints from people wronged by the state, advising parliament and government. The last internal barrier before court — the body people turn to when everything else has failed. HAR: 240 requests, 5 domains.

What is done correctly — and it deserves recognition

No Google Tag Manager, no Google Analytics, no DoubleClick, no browser-update.org — this alone sets the site apart from most government portals in this series. Analytics runs via Matomo on statistika.rik.ee (a server belonging to Estonia’s Information System Authority Registry Center) — visit data stays within the country. Cloudflare Insights attempted to load and was blocked by the CSP (status 0) — a rarity in this series; someone configured the CSP, and it works. Social media icons are local (.png and .svg served from the proprietary server), with no requests to Facebook, LinkedIn, or Twitter.

What is not done — Google Fonts

fonts.googleapis.com (+233 ms) and fonts.gstatic.com (+261 ms) load the Roboto Flex typeface from Google’s servers in the USA. Every request transmits the user’s IP address, User-Agent (browser, OS, version), Referer (oiguskantsler.ee), and the time of the request. In 2022, the CJEU, in a case against a German website, found this exact transfer to be a GDPR violation and ordered compensation to be paid — a precedent exists. There is no consent banner; the transfer to Google happens automatically on the first page load.

The policy — one of the weakest in this series

The policy states that data is available to the chancellery “only in non-personalized form” — yet an IP address transmitted to Google is, by definition, personal data (the Breyer case, C-582/14). Data recipients are not named at all: neither Google, nor Cloudflare, nor Matomo — only an abstract “a tool that collects general data” (Art. 13(1)(e)). Not a word about the transfer to the USA (Art. 13(1)(f)). There is no cookie policy whatsoever: no table, no list, no mention, despite the site using cookies via Matomo. By comparison, sotsiaalkindlustusamet.ee, within the same branch of government, has a full cookie table — a standard absent here.

Conclusion

Who visits the Chancellor of Justice’s website? Someone with a problem involving the state: an unlawful official decision, a violation of constitutional rights, a complaint against the police or the courts. The very fact of turning to the ombudsman says something about a person’s situation — and at that moment, their IP address goes to Google with no knowledge or consent. But the fix here is a single technical step: Roboto Flex can be self-hosted within a few hours, followed by updating the policy and naming recipients by name. The CSP already works, and Matomo on a state server is the right choice. One font and one policy separate this site from a clean architecture. The institution that teaches others how to protect citizens’ rights should start with its own website.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/oiguskantsler-ee-2026-05-02.har
SHA-256: a4bcfc21c4837711043bfc59063833cf440b5c68e4c96480f67e3eb567603991
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — oiguskantsler.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website oiguskantsler.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google Fonts (fonts.googleapis.com +233 ms, fonts.gstatic.com +261 ms) transmits the user's IP address to Google (USA) with no consent. In 2022, the CJEU found this exact transfer to be a violation.

2) There is no consent mechanism whatsoever. Not a single consent request in the session. The transfer to Google happens automatically on the first page load.

3) The policy states that data is available to the chancellery 'only in non-personalized form.' Yet an IP address (personal data per the Breyer ruling) goes to Google. A direct contradiction.

4) Data recipients are not named at all — neither Google, nor Cloudflare, nor Matomo/RIK. The policy is abstract. There is no cookie policy whatsoever, despite the site using cookies via Matomo.

5) Data transfer to the USA (Google Fonts) with no mechanism stated — neither SCC nor an adequacy decision. Privacy Shield was invalidated in 2020.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-oiguskantsler-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — oiguskantsler.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website oiguskantsler.ee.

2. Circumstances
I visited the website oiguskantsler.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 2 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Fonts (fonts.googleapis.com +233 ms, fonts.gstatic.com +261 ms) transmits the user's IP address to Google (USA) with no consent. In 2022, the CJEU found this exact transfer to be a violation.

2) There is no consent mechanism whatsoever. Not a single consent request in the session. The transfer to Google happens automatically on the first page load.

3) The policy states that data is available to the chancellery 'only in non-personalized form.' Yet an IP address (personal data per the Breyer ruling) goes to Google. A direct contradiction.

4) Data recipients are not named at all — neither Google, nor Cloudflare, nor Matomo/RIK. The policy is abstract. There is no cookie policy whatsoever, despite the site using cookies via Matomo.

5) Data transfer to the USA (Google Fonts) with no mechanism stated — neither SCC nor an adequacy decision. Privacy Shield was invalidated in 2020.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-oiguskantsler-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 5(1)(a); GDPR Art. 12(1), Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]