The Estonian State Information System Authority, responsible for the state's cybersecurity, — 173 requests, 7 nodes, a 107-second recording. On its own site the authority loads a third-party script from the browser-update.org domain and fonts from the third-party CDN use.fontawesome.com, to which the visitor's IP address and referrer are sent, and includes both domains in its own content-security-policy. Third-party Cloudflare Insights analytics and the own Matomo counter also run. There is no consent mechanism, and none of the third-party recipients is named individually in the cookie policy.
Request timeline
Declared versus actual
Transfer timings
CDN for fonts and icons, the referrer and IP address go out, 24 requests.
Own Matomo counter, cookies _pk_id, _pk_ses.
Cloudflare performance analytics, five requests.
Third-party update.min.js script; the www.ria.ee referrer and IP address go out, five requests.
Detected trackers
- browser-update.org (update.min.js) — third-party widget script, carries the visitor's IP address and the www.ria.ee referrer to an external domain, 5 requests
- use.fontawesome.com — third-party CDN for fonts and icons, 24 requests, carries the visitor's IP address and referrer
- Cloudflare Insights (static.cloudflareinsights.com) — third-party performance analytics, 5 requests
- Matomo (matomo.ria.ee) — visit counter on the own infrastructure, cookies _pk_id and _pk_ses
- Bürokratt (buerokratt.ria.ee, ruuter.buerokratt.ria.ee) — state chatbot, own infrastructure
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e) — disclosure of recipientsThe authority responsible for the state's cybersecurity loads on its site a third-party script from the browser-update.org domain and fonts from the third-party CDN use.fontawesome.com, as well as the third-party counter Cloudflare Insights. All three receive the IP address and referrer of the www.ria.ee visitor. The cookie policy describes analytics cookies (_pk_id, _pk_ses of the Matomo counter) and mentions third-party sites in general terms, but neither browser-update.org, nor use.fontawesome.com, nor Cloudflare Insights, nor Matomo itself is named individually.
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))There is no consent mechanism on the site: across 173 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The Matomo counter starts from the markup at +200 ms, the third-party browser-update.org script at +607 ms, the third-party CDN fonts at +180 ms, all before any user choice. The cookie policy describes analytics cookies as set to collect statistics, but provides no mechanism for obtaining consent to them.
- GDPR Art. 5(1)(c) — minimisation and control over the supply chainThe site of the state cybersecurity authority includes the domains browser-update.org and use.fontawesome.com in its own content-security-policy and loads executable code and fonts from them. The browser-update.org domain, as a separate analysis shows, deploys an advertising stack on pages with an ad slot; here the widget delivered only update.min.js, but the inclusion of an external mutable source in the trusted list means that the composition of the loaded code is determined by a third party. The fonts and icons, moreover, can be hosted on the own infrastructure, as is done with other resources.
Context
www.ria.ee is the site of the Estonian State Information System Authority (Riigi Infosüsteemi Amet, RIA), the state body responsible for the development and protection of the digital-state infrastructure and for the country’s cybersecurity. The site is served through Cloudflare (cf-ray, server: cloudflare); the content is in Estonian and Russian.
The recording: 173 requests, 7 nodes, a recording length of 106.8 seconds, taken on 16 August 2026. Of the seven nodes, some are the own infrastructure: the main domain, Matomo on matomo.ria.ee, the chatbot on buerokratt.ria.ee and ruuter.buerokratt.ria.ee. The third-party recipients outside the ria.ee domain are use.fontawesome.com (font CDN, 24 requests), static.cloudflareinsights.com (analytics, 5 requests) and browser-update.org (third-party script, 5 requests). The session runs across several pages of the electronic-identity section.
The processing is described by the RIA cookie policy together with the terms of personal-data processing: categories of cookies (strictly necessary, analytics, marketing, unclassified), a section on third-party cookies, a section on visiting the site.
Who receives data directly
browser-update.org, use.fontawesome.com, Cloudflare Insights.
Declared versus actual
The state cybersecurity authority loads a third-party script from an advertising domain. The first request to browser-update.org/update.min.js goes out at +607 ms, the initiator being the site’s own combined script file. The request transmits the referrer https://www.ria.ee/ and the visitor’s IP address. This is the same domain that features in a separate analysis as a site deploying an advertising stack on pages with an ad slot. Here the widget delivered only update.min.js, but what is essential is that the browser-update.org domain is entered in the script-src of the site’s own content-security-policy: the authority has, in a trusted manner, allowed an external mutable source to execute code on its page.
Fonts and icons are loaded from a third-party CDN. use.fontawesome.com — a third-party Font Awesome CDN — serves 24 requests over the session, starting first, at +180 ms. Each transmits the referrer https://www.ria.ee/ and the visitor’s IP address. Fonts and icons can be hosted on the own infrastructure; external loading transmits the visitor’s data to a third-party node without necessity.
Analytics is partially disclosed. The cookie policy describes the analytics cookies _pk_id and _pk_ses — this is the Matomo counter — with the source ria.ee and the purpose of collecting statistics. That is, analytics as a function is disclosed, but the tool Matomo itself is not named individually. Marketing cookies are declared by the policy to be unused outright. However, the third-party performance analytics Cloudflare Insights running on the site does not appear in the list.
Not a single third-party recipient is named individually. The section on third-party cookies is worded in general terms: the site may use content from other sites (an example being Google Maps) and redirect to other resources that set their own cookies. But this is about external links and embedded content, not about an actively loaded third-party script and font CDN. Neither browser-update.org, nor use.fontawesome.com, nor Cloudflare Insights is named in the policy.
Security headers are set solidly, but with a caveat. The site sets strict transport, the frame-embedding ban DENY, the content-type-sniffing ban and a detailed content-security-policy. But the allow-list includes not only the own nodes and Matomo, but also browser-update.org, use.fontawesome.com, and — as declared, though not fired in this recording — Google Analytics, Google Tag Manager, DoubleClick, Siteimprove, jsDelivr. There is no permissions policy, and the referrer policy origin-when-cross-origin leaves the source www.ria.ee in the referrer header of third-party requests.
Consent: what is proven and what is not
Proven: there is no consent mechanism on the site. Across 173 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header.
Proven: the third-party scripts start from the markup, without the user’s choice. The third-party CDN fonts are requested at +180 ms, Matomo at +200 ms, browser-update.org at +607 ms — all initiated by the markup and scripts of the page itself.
Proven: the IP address and referrer go to browser-update.org and use.fontawesome.com. The referrer header in the requests to both contains https://www.ria.ee/; the IP address is transmitted by the very fact of the network request. Both domains are entered in the content-security-policy.
Not proven and not asserted: the deployment of the browser-update.org advertising stack on the ria.ee site. In this recording the widget delivered only update.min.js; no requests to advertising recipients from the ria.ee domain were recorded. What is recorded is the fact of loading the third-party script and transmitting the referrer and IP address to it.
Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation.
Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.
Boundaries of observation
The recording covers several pages of the site. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording.
A number of nodes are entered in the content-security-policy but did not fire in this recording: Google Analytics, Google Tag Manager, DoubleClick, Siteimprove, YouTube. They are recorded as CSP-declared dependencies, but not as actually transmitting data, and do not enter the analysis of violations on the basis of actual transmission. Matomo and Bürokratt are hosted on RIA infrastructure and are not treated as third-party commercial recipients.
The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that there is no consent mechanism rests on the network level — the composition, addresses and initiators of all 173 requests are read from the recording, and among them there is neither a consent platform nor its marks; the loading of the third-party scripts is initiated by the markup and precedes any user choice.
The identification of services rests on domains and address patterns: browser-update.org — by the domain and the update.min.js file included in script-src; use.fontawesome.com — by the domain and the paths releases/v6.4.0/css; Cloudflare Insights — by cloudflareinsights.com; Matomo — by matomo.ria.ee and the cookies _pk_id, _pk_ses; Bürokratt — by buerokratt.ria.ee; the serving provider — by the cf-ray and server: cloudflare headers.
Conclusion
The site of the Estonian authority responsible for the state’s cybersecurity loads on its pages a third-party script from the browser-update.org domain and fonts from the third-party CDN use.fontawesome.com, to which the visitor’s IP address and referrer are sent on every load, and enters both domains in its own content-security-policy. Third-party Cloudflare Insights performance analytics and the own Matomo counter also run.
The cookie policy discloses the Matomo analytics cookies by file name and states outright that marketing cookies are not used, but names neither browser-update.org, nor use.fontawesome.com, nor Cloudflare Insights, nor Matomo itself individually. There is no consent mechanism on the site at all, although analytics cookies, per the regulator’s practice, require prior consent.
Remediation: remove the third-party browser-update.org script and remove that domain from the trusted content-security-policy list; move the Font Awesome fonts and icons to the own infrastructure, eliminating the transmission of the referrer and IP address to a third-party CDN; abandon the third-party Cloudflare Insights analytics in favour of the own Matomo, or disclose it as a recipient; name all actual recipients of web data in the cookie policy individually, including Matomo; introduce a consent mechanism that actually governs the loading of analytics and third-party scripts, with the option to refuse before they start; review the content-security-policy allow-list, excluding external sources not used for their purpose.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
f274e8569269c67f6ff43d79048244992126e4f3b19c18d0d00362d7d353f9bfWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — ria.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта ria.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Департамент, отвечающий за кибербезопасность государства, загружает на своём сайте сторонний скрипт с домена browser-update.org и шрифты со стороннего CDN use.fontawesome.com, а также сторонний счётчик Cloudflare Insights. Все три получают адрес IP и реферер посетителя www.ria.ee. Cookie-политика описывает аналитические cookie (_pk_id, _pk_ses счётчика Matomo) и в общем виде упоминает сторонние сайты, но ни browser-update.org, ни use.fontawesome.com, ни Cloudflare Insights, ни сам Matomo поимённо не названы. 2) Механизма согласия на сайте нет: за 173 обращения не встречается ни одного обращения к платформе управления согласием, ни одного сценария с признаками баннера, ни одного заголовка Set-Cookie. Счётчик Matomo стартует из разметки на +200 мс, сторонний скрипт browser-update.org — на +607 мс, шрифты стороннего CDN — на +180 мс, все до какого-либо выбора пользователя. Cookie-политика описывает аналитические cookie как устанавливаемые для сбора статистики, но механизма получения согласия на них не предоставляет. 3) Сайт государственного органа по инфобезопасности включает домены browser-update.org и use.fontawesome.com в собственную политику безопасности содержимого и загружает с них исполняемый код и шрифты. Домен browser-update.org, как показывает отдельный разбор, на страницах с рекламным слотом разворачивает рекламный стек; здесь виджет отдал только update.min.js, однако включение внешнего изменяемого источника в доверенный список означает, что состав загружаемого кода определяется третьей стороной. Шрифты и иконки при этом можно разместить на собственной инфраструктуре, как это сделано с другими ресурсами. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-ria-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — ria.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website ria.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The authority responsible for the state's cybersecurity loads on its site a third-party script from the browser-update.org domain and fonts from the third-party CDN use.fontawesome.com, as well as the third-party counter Cloudflare Insights. All three receive the IP address and referrer of the www.ria.ee visitor. The cookie policy describes analytics cookies (_pk_id, _pk_ses of the Matomo counter) and mentions third-party sites in general terms, but neither browser-update.org, nor use.fontawesome.com, nor Cloudflare Insights, nor Matomo itself is named individually. 2) There is no consent mechanism on the site: across 173 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The Matomo counter starts from the markup at +200 ms, the third-party browser-update.org script at +607 ms, the third-party CDN fonts at +180 ms, all before any user choice. The cookie policy describes analytics cookies as set to collect statistics, but provides no mechanism for obtaining consent to them. 3) The site of the state cybersecurity authority includes the domains browser-update.org and use.fontawesome.com in its own content-security-policy and loads executable code and fonts from them. The browser-update.org domain, as a separate analysis shows, deploys an advertising stack on pages with an ad slot; here the widget delivered only update.min.js, but the inclusion of an external mutable source in the trusted list means that the composition of the loaded code is determined by a third party. The fonts and icons, moreover, can be hosted on the own infrastructure, as is done with other resources. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-ria-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — ria.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi ria.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Riigi küberturvalisuse eest vastutav ministeerium laadib oma veebisaidilt alla kolmanda osapoole skripti domeenist browser-update.org ja fonte kolmanda osapoole CDN-i kasutamisest. fontawesome.com ja Cloudflare Insights. Kõik kolm saavad IP-aadressi ja külastaja viite www.ria.ee. Küpsiste poliitika kirjeldab analüütilisi küpsiseid (Matomo loenduri pk id, pk ses) ja mainib üldiselt kolmandate osapoolte saite, kuid ei browser-update.org ega kasutamist. fontawesome.com, ei Cloudflare Insights ega Matomo nimesid. 2) Saidil puudub nõusoleku mehhanism: 173 rakenduse puhul puudub juurdepääs nõusoleku haldamise platvormile, puudub bännerimärkidega skript, Set-Cookie päis. Matomo loendur algab +200 ms märgistusest, kolmanda osapoole skriptist browser-update.org +607 ms-l, kolmanda osapoole CDN-fontidest +180 ms-l, kõik enne kasutaja valikut. Küpsiste poliitika kirjeldab analüütilisi küpsiseid statistika kogumiseks, kuid ei paku mehhanismi nõusoleku saamiseks. 3) Riigi infoturbeameti veebilehel on domeenid browser-update.org ja kasutamine. fontawesome.com sisestab oma sisuturbepoliitika ja laadib neist alla käivitatava koodi ja fonte. Domeen browser-update.org, nagu eraldi analüüs näitab, kasutab reklaamipesaga lehtedel reklaami pinu; siin andis vidin ainult update.min.js, kuid välise muutujaallika lisamine usaldusnimekirja tähendab, et allalaaditud koodi koosseisu määrab kolmas osapool. Fonte ja ikoone saab paigutada oma infrastruktuuri, nagu tehakse teiste ressurssidega. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-ria-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — ria.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом ria.ee. 2. Обстоятельства Я посетил сайт ria.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 16.08.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Департамент, отвечающий за кибербезопасность государства, загружает на своём сайте сторонний скрипт с домена browser-update.org и шрифты со стороннего CDN use.fontawesome.com, а также сторонний счётчик Cloudflare Insights. Все три получают адрес IP и реферер посетителя www.ria.ee. Cookie-политика описывает аналитические cookie (_pk_id, _pk_ses счётчика Matomo) и в общем виде упоминает сторонние сайты, но ни browser-update.org, ни use.fontawesome.com, ни Cloudflare Insights, ни сам Matomo поимённо не названы. 2) Механизма согласия на сайте нет: за 173 обращения не встречается ни одного обращения к платформе управления согласием, ни одного сценария с признаками баннера, ни одного заголовка Set-Cookie. Счётчик Matomo стартует из разметки на +200 мс, сторонний скрипт browser-update.org — на +607 мс, шрифты стороннего CDN — на +180 мс, все до какого-либо выбора пользователя. Cookie-политика описывает аналитические cookie как устанавливаемые для сбора статистики, но механизма получения согласия на них не предоставляет. 3) Сайт государственного органа по инфобезопасности включает домены browser-update.org и use.fontawesome.com в собственную политику безопасности содержимого и загружает с них исполняемый код и шрифты. Домен browser-update.org, как показывает отдельный разбор, на страницах с рекламным слотом разворачивает рекламный стек; здесь виджет отдал только update.min.js, однако включение внешнего изменяемого источника в доверенный список означает, что состав загружаемого кода определяется третьей стороной. Шрифты и иконки при этом можно разместить на собственной инфраструктуре, как это сделано с другими ресурсами. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-ria-ee/ 3. Положения GDPR, соблюдение которых прошу проверить GDPR Art. 13(1)(e) — раскрытие получателей; ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 5(1)(c) — минимизация и контроль над цепочкой поставки 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — ria.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website ria.ee. 2. Circumstances I visited the website ria.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 16 August 2026 (open methodology, reproducible measurements) documents the following indications: 1) The authority responsible for the state's cybersecurity loads on its site a third-party script from the browser-update.org domain and fonts from the third-party CDN use.fontawesome.com, as well as the third-party counter Cloudflare Insights. All three receive the IP address and referrer of the www.ria.ee visitor. The cookie policy describes analytics cookies (_pk_id, _pk_ses of the Matomo counter) and mentions third-party sites in general terms, but neither browser-update.org, nor use.fontawesome.com, nor Cloudflare Insights, nor Matomo itself is named individually. 2) There is no consent mechanism on the site: across 173 requests there is not a single request to a consent-management platform, not a single script bearing the marks of a banner, not a single Set-Cookie header. The Matomo counter starts from the markup at +200 ms, the third-party browser-update.org script at +607 ms, the third-party CDN fonts at +180 ms, all before any user choice. The cookie policy describes analytics cookies as set to collect statistics, but provides no mechanism for obtaining consent to them. 3) The site of the state cybersecurity authority includes the domains browser-update.org and use.fontawesome.com in its own content-security-policy and loads executable code and fonts from them. The browser-update.org domain, as a separate analysis shows, deploys an advertising stack on pages with an ad slot; here the widget delivered only update.min.js, but the inclusion of an external mutable source in the trusted list means that the composition of the loaded code is determined by a third party. The fonts and icons, moreover, can be hosted on the own infrastructure, as is done with other resources. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-ria-ee/ 3. GDPR provisions I ask you to examine GDPR Art. 13(1)(e) — disclosure of recipients; ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 5(1)(c) — minimisation and control over the supply chain 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil ria.ee. 2. Asjaolud Külastasin veebisaiti ria.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 16.08.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Riigi küberturvalisuse eest vastutav ministeerium laadib oma veebisaidilt alla kolmanda osapoole skripti domeenist browser-update.org ja fonte kolmanda osapoole CDN-i kasutamisest. fontawesome.com ja Cloudflare Insights. Kõik kolm saavad IP-aadressi ja külastaja viite www.ria.ee. Küpsiste poliitika kirjeldab analüütilisi küpsiseid (Matomo loenduri pk id, pk ses) ja mainib üldiselt kolmandate osapoolte saite, kuid ei browser-update.org ega kasutamist. fontawesome.com, ei Cloudflare Insights ega Matomo nimesid. 2) Saidil puudub nõusoleku mehhanism: 173 rakenduse puhul puudub juurdepääs nõusoleku haldamise platvormile, puudub bännerimärkidega skript, Set-Cookie päis. Matomo loendur algab +200 ms märgistusest, kolmanda osapoole skriptist browser-update.org +607 ms-l, kolmanda osapoole CDN-fontidest +180 ms-l, kõik enne kasutaja valikut. Küpsiste poliitika kirjeldab analüütilisi küpsiseid statistika kogumiseks, kuid ei paku mehhanismi nõusoleku saamiseks. 3) Riigi infoturbeameti veebilehel on domeenid browser-update.org ja kasutamine. fontawesome.com sisestab oma sisuturbepoliitika ja laadib neist alla käivitatava koodi ja fonte. Domeen browser-update.org, nagu eraldi analüüs näitab, kasutab reklaamipesaga lehtedel reklaami pinu; siin andis vidin ainult update.min.js, kuid välise muutujaallika lisamine usaldusnimekirja tähendab, et allalaaditud koodi koosseisu määrab kolmas osapool. Fonte ja ikoone saab paigutada oma infrastruktuuri, nagu tehakse teiste ressurssidega. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-ria-ee/ 3. Sätted, mille järgimist palun kontrollida GDPR – artikli 13 lõike 1 punkt e – vastuvõtjate avalikustamine; e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a); GDPR artikli 5 lõike 1 punkt c – tarneahela minimeerimine ja kontroll 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]