RU EN
www.
Technical audit · 06.05.2026

politsei.ee

Passports, Visas, Residence Permits, Investigations
EE

One of the best government sites in this series in terms of its own architecture: state-run Matomo, a state-run chatbot, zero Google, zero advertising networks. And yet — three layers of Cloudflare at entry, on the page, and in the content. The core problem isn't the site itself, but RIA's decision to put the entire country behind an American gateway.

Request timeline

+797 ms · layer 1, entry
challenges.cloudflare.com — Cloudflare Bot Management (Turnstile, a replacement for Google reCAPTCHA), 16 requests, status 200. A 'Verifying you are human' challenge page appears before the site loads. IP address, browser, and fingerprint go to Cloudflare in the USA instantly, before any consent.
Consent banner
Absent. The entry-point check happens before any interaction. This is not politsei.ee's own decision — every Estonian government site sits behind this same gateway.
Layers 2 and 3
static.cloudflareinsights.com (behavioral analytics) and cdnjs.cloudflare.com (JS libraries). On first visit, the CSP blocks Insights (status 0), but on a repeat visit, it fires consistently (status 200).

Declared versus actual

✓ Google Maps, Facebook, LinkedIn, Twitter — all with zero requests in the HAR — declared
✓ 'We do not transfer data to third parties' — declared
✓ 'IP is not linked to identity' — declared
+ Cloudflare at three levels — 19 transfers, not a word in the policy — not declared

Transfer timings

+797 ms challenges.cloudflare.com

Bot Management / Turnstile, 16 requests. Fingerprint to the USA before consent

+642386 ms static.cloudflareinsights.com

The first attempts are blocked (status 0), then it fires (200)

No exact timing

on a repeat visit static.cloudflareinsights.comStatus 200 immediately — no coincidence, consistent
per session piwik.smit.ee (Matomo)Matomo on SMIT's state server (Estonia) — a plus

Detected trackers

Indicators of GDPR non-compliance

Context

politsei.ee is the website of Estonia’s Police and Border Guard Board (PPA). It issues passports, visas, and residence permits, investigates crimes, and registers foreign nationals — one of the largest departments with direct citizen contact. HAR: 217 requests, 6 domains.

A systemic finding — three layers of Cloudflare

For the first time in this series, a government site shows an explicit challenge page: “Verifying you are human. This website uses a security service to protect against malicious bots.” This is Cloudflare Bot Management, and every Estonian government site sits behind it. Cloudflare operates at three levels. Level 1 — entry: challenges.cloudflare.com (16 requests, +797 ms) checks every visitor before the page loads, before any consent; the IP address, browser, and fingerprint reach Cloudflare in the USA instantly. Level 2 — the page: static.cloudflareinsights.com, behavioral analytics. Level 3 — content: cdnjs.cloudflare.com, JS libraries. This is not three separate decisions by three developers, but a single unified state IT policy: one decision, the entire country behind an American intermediary.

Why the CSP doesn’t hold

Two products from the same vendor work in tandem. challenges.cloudflare.com (Bot Management / Turnstile, a replacement for Google reCAPTCHA) checks the visitor and, on success, issues a pass. That pass opens the door for static.cloudflareinsights.com — Cloudflare’s second product. The CSP, which blocked Insights on the first visit (status 0, twice), stops working once Turnstile has issued its permission: on a repeat visit, Insights fires immediately (status 200). This is Cloudflare’s whitelisting mechanism — once Bot Management is passed, Cloudflare’s own scripts get automatic clearance. One vendor, two products: the first opens the door for the second, and the CSP becomes decorative.

What is done correctly — and there’s quite a bit

Analytics run through Matomo on the state server piwik.smit.ee (SMIT); data stays within Estonia. The chatbot buerokratt.politsei.ee runs on state servers, so conversations don’t go to American clouds. There is no Google Fonts, no Google Tag Manager, no DoubleClick, no browser-update.org, no advertising networks, zero unknown external domains. Among all the government sites in this series with violations, politsei.ee is one of the best in terms of its own architecture.

Declaration versus fact — four discrepancies

The policy states: “We do not disclose or transfer personal data to third parties” — yet Cloudflare receives every visitor’s data at three levels. This is the fourth time this exact wording has appeared in this series (president.ee, oiguskantsler.ee, sotsiaalkindlustusamet.ee) — a state-wide template that systemically ignores transfer via external services. The policy declares Google Maps, Facebook, LinkedIn, and Twitter — all with zero requests in the HAR; not a word about Cloudflare (19 actual transfers). It states “IP is not linked to identity” — but what the Police don’t link, Cloudflare might. And it implies control via a CSP that, in fact, doesn’t hold.

Conclusion

The Police consider their site clean — and by its own architecture, they’re almost right: state-run Matomo, a state-run chat, no Google, no advertising networks. The core problem lies elsewhere. The core problem is RIA’s decision to put the entire country behind Cloudflare’s American gateway, at three layers, before any consent. Knowing this is one thing; proving it publicly and factually is another. The HAR does exactly that.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/politsei-ee-2026-05-06.har
SHA-256: 236c24719e88fc24eab3a15f3f86c1faa1e5c8dadbe8a422cd8f4acbf7f04183
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — politsei.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website politsei.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Cloudflare receives every visitor's data at three levels (entry, page, content) with no consent and no legal basis.

2) There is no consent mechanism. Cloudflare's entry-point check happens before any consent or interaction.

3) Cloudflare (19 actual transfers) is not declared as a recipient. Meanwhile, the policy declares Google Maps, Facebook, LinkedIn, and Twitter — all with zero requests in the HAR.

4) No data-transfer mechanism to the USA (Cloudflare) is stated. The transfer occurs with no SCC.

5) The policy implies control, but the CSP is unstable: on a repeat visit, Cloudflare Insights fires consistently (status 200) after Bot Management has been passed.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-politsei-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — politsei.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website politsei.ee.

2. Circumstances
I visited the website politsei.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 6 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Cloudflare receives every visitor's data at three levels (entry, page, content) with no consent and no legal basis.

2) There is no consent mechanism. Cloudflare's entry-point check happens before any consent or interaction.

3) Cloudflare (19 actual transfers) is not declared as a recipient. Meanwhile, the policy declares Google Maps, Facebook, LinkedIn, and Twitter — all with zero requests in the HAR.

4) No data-transfer mechanism to the USA (Cloudflare) is stated. The transfer occurs with no SCC.

5) The policy implies control, but the CSP is unstable: on a repeat visit, Cloudflare Insights fires consistently (status 200) after Bot Management has been passed.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-politsei-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 5(1)(a) — CSP stability

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]