One of the cleanest sites in this series: 38 requests, zero analytics and advertising. The only external element is Google reCAPTCHA on the contact form to the President — and it's precisely this one the policy stays silent about.
Timeline of the leak
Declared versus actual
Detected trackers
- Google reCAPTCHA v2
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e)Google reCAPTCHA is not declared as a data recipient. Meanwhile, the policy lists Hotjar, Google Analytics, Google Maps, Facebook, and Twitter — none of which appears in the HAR.
- GDPR Art. 13(1)(f)No data-transfer mechanism to the USA (SCC or otherwise) is stated. recaptcha.net — Google servers in the USA.
- GDPR Art. 6(1)Behavioral data and a browser fingerprint are transmitted to Google with no consent when filling out the contact form to the President.
- GDPR Art. 7There is no consent mechanism. There is no consent banner on the site at all.
- GDPR Chapter VData transfer to the USA with no legal instrument stated.
Context
The country’s highest state institution. The head of state signs laws, ratifies international treaties, and appoints senior officials. Through the contact form, citizens write petitions and personal appeals to the President — often on sensitive matters.
What is done correctly
The most compact HAR in this series after eesti.ee — only 38 requests. No Google Tag Manager, no Google Analytics, no DoubleClick, no Cloudflare Insights, no browser-update.org, no Google Fonts. Zero advertising networks, social media icons are local, and no external scripts load on the homepage. One of the cleanest sites in this series.
The one external element — reCAPTCHA
reCAPTCHA v2 (Google) appears only when navigating to the contact form to the President — at +251330 ms from the start, not on homepage load. A public Site Key is visible in the HTML. In total: 7 requests to recaptcha.net and 10 to gstatic.com.
Every time it runs, reCAPTCHA transmits to Google: the IP address, User-Agent, the _GRECAPTCHA cookie (a unique session identifier), behavioral patterns (mouse movements, click timings), a browser fingerprint, and interaction history with other Google services, if the user is logged into them.
Declaration versus fact
The privacy policy states that Hotjar and Google Analytics collect cookies, and that Google Maps, Facebook, and Twitter receive data. Not a single request to any of these services appears in the HAR. Meanwhile, reCAPTCHA — which genuinely runs and genuinely transmits data — is never mentioned in the policy.
This mirrors the situation at sotsiaalkindlustusamet.ee: there, the policy declared a dead service (AddThis); here, it declares services that don’t exist and says nothing about the one that does.
Separately, the policy states: “IP addresses are not linked to identifying information.” But reCAPTCHA transmits the IP address to Google, and Google links IP addresses to user profiles as a matter of course. What the President’s Office doesn’t link does not mean Google doesn’t link it. The same wording appears at oiguskantsler.ee and sotsiaalkindlustusamet.ee — a state-wide template.
reCAPTCHA versus alternatives
reCAPTCHA is not the only way to protect forms from spam. hCaptcha (European, GDPR-compliant), Friendly Captcha (German, data stays in the EU), and a simple honeypot (a hidden field, zero external requests — used on eesti.ee) all exist. Choosing Google reCAPTCHA specifically for the form used to write to the head of state is a deliberate decision to transmit citizens’ data to an American corporation at the moment they reach out.
Conclusion
Technically, the site is nearly exemplary — which makes the one problem all the more noticeable. A citizen writing a petition or personal appeal to the President transmits their behavioral data and fingerprint to Google at the moment of submission. The policy says nothing about it, despite listing in detail services that aren’t even on the site.
7b2fd437ab9cb43cf3781447540a8c3720c5eee330328f381860aed25ff8f9a0Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
To: Estonian Data Protection Inspectorate (AKI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website president.ee. 2. Circumstances I visited the website president.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 9 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Google reCAPTCHA is not declared as a data recipient. Meanwhile, the policy lists Hotjar, Google Analytics, Google Maps, Facebook, and Twitter — none of which appears in the HAR. 2) No data-transfer mechanism to the USA (SCC or otherwise) is stated. recaptcha.net — Google servers in the USA. 3) Behavioral data and a browser fingerprint are transmitted to Google with no consent when filling out the contact form to the President. 4) There is no consent mechanism. There is no consent banner on the site at all. 5) Data transfer to the USA with no legal instrument stated. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-president-ee/ 3. Provisions violated GDPR Art. 13(1)(e); GDPR Art. 13(1)(f); GDPR Art. 6(1); GDPR Art. 7; GDPR Chapter V 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]