RU EN
www.
Technical audit · 09.05.2026

president.ee

Office of the President of Estonia
EE

One of the cleanest sites in this series: 38 requests, zero analytics and advertising. The only external element is Google reCAPTCHA on the contact form to the President — and it's precisely this one the policy stays silent about.

Request timeline

Homepage load
Zero external trackers. No Google Analytics, Tag Manager, DoubleClick, Cloudflare Insights, or Google Fonts. Social media icons — local.
Consent banner
Completely absent. Zero consent requests, zero Set-Cookie.
+251330 ms · the contact form
reCAPTCHA v2 activates when navigating to the contact form: 7 requests to recaptcha.net, 10 to gstatic.com. The IP address, User-Agent, cookie _GRECAPTCHA, mouse movements, and fingerprint go to Google.

Declared versus actual

✓ Hotjar (absent from the HAR) — declared
✓ Google Analytics (absent from the HAR) — declared
✓ Google Maps (absent from the HAR) — declared
✓ Facebook (absent from the HAR) — declared
✓ Twitter (absent from the HAR) — declared
+ Google reCAPTCHA v2 — genuinely running, transmitting data, not mentioned once — not declared

Detected trackers

Indicators of GDPR non-compliance

Context

The country’s highest state institution. The head of state signs laws, ratifies international treaties, and appoints senior officials. Through the contact form, citizens write petitions and personal appeals to the President — often on sensitive matters.

What is done correctly

The most compact HAR in this series after eesti.ee — only 38 requests. No Google Tag Manager, no Google Analytics, no DoubleClick, no Cloudflare Insights, no browser-update.org, no Google Fonts. Zero advertising networks, social media icons are local, and no external scripts load on the homepage. One of the cleanest sites in this series.

The one external element — reCAPTCHA

reCAPTCHA v2 (Google) appears only when navigating to the contact form to the President — at +251330 ms from the start, not on homepage load. A public Site Key is visible in the HTML. In total: 7 requests to recaptcha.net and 10 to gstatic.com.

Every time it runs, reCAPTCHA transmits to Google: the IP address, User-Agent, the _GRECAPTCHA cookie (a unique session identifier), behavioral patterns (mouse movements, click timings), a browser fingerprint, and interaction history with other Google services, if the user is logged into them.

Declaration versus fact

The privacy policy states that Hotjar and Google Analytics collect cookies, and that Google Maps, Facebook, and Twitter receive data. Not a single request to any of these services appears in the HAR. Meanwhile, reCAPTCHA — which genuinely runs and genuinely transmits data — is never mentioned in the policy.

This mirrors the situation at sotsiaalkindlustusamet.ee: there, the policy declared a dead service (AddThis); here, it declares services that don’t exist and says nothing about the one that does.

Separately, the policy states: “IP addresses are not linked to identifying information.” But reCAPTCHA transmits the IP address to Google, and Google links IP addresses to user profiles as a matter of course. What the President’s Office doesn’t link does not mean Google doesn’t link it. The same wording appears at oiguskantsler.ee and sotsiaalkindlustusamet.ee — a state-wide template.

reCAPTCHA versus alternatives

reCAPTCHA is not the only way to protect forms from spam. hCaptcha (European, GDPR-compliant), Friendly Captcha (German, data stays in the EU), and a simple honeypot (a hidden field, zero external requests — used on eesti.ee) all exist. Choosing Google reCAPTCHA specifically for the form used to write to the head of state is a deliberate decision to transmit citizens’ data to an American corporation at the moment they reach out.

Conclusion

Technically, the site is nearly exemplary — which makes the one problem all the more noticeable. A citizen writing a petition or personal appeal to the President transmits their behavioral data and fingerprint to Google at the moment of submission. The policy says nothing about it, despite listing in detail services that aren’t even on the site.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/president-ee-2026-05-09.har
SHA-256: 7b2fd437ab9cb43cf3781447540a8c3720c5eee330328f381860aed25ff8f9a0
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — president.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website president.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Google reCAPTCHA is not declared as a data recipient. Meanwhile, the policy lists Hotjar, Google Analytics, Google Maps, Facebook, and Twitter — none of which appears in the HAR.

2) No data-transfer mechanism to the USA (SCC or otherwise) is stated. recaptcha.net — Google servers in the USA.

3) Behavioral data and a browser fingerprint are transmitted to Google with no consent when filling out the contact form to the President.

4) There is no consent mechanism. There is no consent banner on the site at all.

5) Data transfer to the USA with no legal instrument stated.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-president-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — president.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website president.ee.

2. Circumstances
I visited the website president.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 9 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google reCAPTCHA is not declared as a data recipient. Meanwhile, the policy lists Hotjar, Google Analytics, Google Maps, Facebook, and Twitter — none of which appears in the HAR.

2) No data-transfer mechanism to the USA (SCC or otherwise) is stated. recaptcha.net — Google servers in the USA.

3) Behavioral data and a browser fingerprint are transmitted to Google with no consent when filling out the contact form to the President.

4) There is no consent mechanism. There is no consent banner on the site at all.

5) Data transfer to the USA with no legal instrument stated.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-president-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e); GDPR Art. 13(1)(f); GDPR Art. 6(1); GDPR Art. 7; GDPR Chapter V

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]