www.rik.ee

Context

www.rik.ee is the site of the Estonian Centre of Registers and Information Systems (Registrite ja Infosüsteemide Keskus, RIK), a state institution maintaining the business register, the registers of courts, punishments and other state registers. The controller is RIK (info@rik.ee); the base infrastructure is serviced by the State Information and Communication Technology Centre (RIT). The sites are served through Cloudflare (server: cloudflare).

The recording consists of two captures. The first — the main site www.rik.ee: 169 requests, 5 nodes, a length of 42.5 seconds. The second — the business-register open-data portal avaandmed.ariregister.rik.ee: 92 requests, 5 nodes, a length of 27.1 seconds. Both taken on 16 August 2026. On both sites, outside the own infrastructure, only Google Fonts, Cloudflare Insights and the Matomo counter on statistika.rik.ee run.

The processing is described by a document with RIK’s data-protection terms (Andmekaitsetingimused). The text of the Public Information Act (Avaliku teabe seadus) is also attached to the materials as the legislative context of the register’s activity.

Who receives data directly

Google (Fonts), Cloudflare Insights.

Declared versus actual

Both sites behave with restraint. This should be said at once: on neither the main site nor the open-data portal is there any advertising, advertising networks or third-party trackers. The visit counter — Matomo — is hosted on the centre’s own infrastructure (statistika.rik.ee), not at an external provider. For a state register this is the right architecture.

Cloudflare is disclosed, but its analytics is not. The policy names Cloudflare directly and in detail: the service sets two cookies (_cf_bm, _cfuvid) to regulate load and prevent cyber-incidents, with the legal basis indicated — the cybersecurity act. This is an honest disclosure of the protective function. But static.cloudflareinsights.com also runs on the sites — performance analytics, separate from the protection against attacks — and it is not mentioned in the policy.

Statistics is described, but the tool is not named. The policy describes the collection of statistics: which part of the site was visited and for how long, for developing the resource, with retention of three months and without linking the IP address to a specific visitor. This is an accurate description of how Matomo works, but the tool itself — statistika.rik.ee — is not named individually, nor is its location.

The fonts carry the IP address to Google. On both sites the fonts are loaded directly from fonts.googleapis.com and fonts.gstatic.com, so that the visitor’s IP address goes to Google on every visit. They can be hosted on the own infrastructure — as is already done with the statistics counter. The direct loading of Google Fonts is not disclosed in the policy.

There is no consent mechanism. On neither of the two sites was a consent-management platform or banner found. The Matomo counter and Cloudflare Insights start from the markup in the first few hundred milliseconds, before any user choice.

Security headers are set well. Both sites set strict transport, the frame-embedding ban SAMEORIGIN, the content-type-sniffing ban and a content-security-policy with report-uri. The open-data portal has a stricter referrer policy — no-referrer.

Consent: what is proven and what is not

Proven: there is no consent mechanism on either site. Across 169 and 92 requests there is not a single request to a consent-management platform and not a single script bearing the marks of a banner.

Proven: analytics and fonts start from the markup, without the user’s choice. Google Fonts, Cloudflare Insights and Matomo are initiated by the page markup and run when the browser parses it, at +174…+345 ms.

Proven: the IP address goes to Google on loading the fonts. The requests to fonts.googleapis.com and fonts.gstatic.com are present on both sites; the IP address is transmitted by the very fact of the request to Google’s external domain.

Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published files during sanitisation.

Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.

Boundaries of observation

The recording covers several pages of each of the two sites. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.

The Matomo counter on statistika.rik.ee is hosted on RIK infrastructure and is not treated as a third-party commercial recipient; it is noted only that it is not named individually in the policy. The social-media channels (Facebook, LinkedIn, Instagram) mentioned in the policy did not activate in the browser recording of either site and do not enter the analysis of data transmission.

The files are published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that there is no consent mechanism rests on the absence of requests to consent platforms and of scripts bearing their marks.

The identification of services rests on domains and address patterns: Google Fonts — by fonts.googleapis.com and fonts.gstatic.com; Cloudflare Insights — by cloudflareinsights.com; Matomo — by statistika.rik.ee; the serving provider — by the server: cloudflare header.

Conclusion

The Estonian Centre of Registers and Information Systems, on both measured sites — the main one and the open-data portal — behaves with restraint: there is no advertising or third-party trackers, and the Matomo statistics counter is hosted on the own infrastructure. Of the external recipients, only the direct loading of Google Fonts, which carries the visitor’s IP address to Google, and the third-party performance analytics Cloudflare Insights remain.

The policy, meanwhile, honestly discloses the protective Cloudflare function with the cookies and legal basis indicated, and describes the collection of statistics, but names neither Google Fonts, nor the Matomo counter, nor the Cloudflare Insights analytics individually. There is no consent mechanism on either of the sites, although analytics cookies, per the regulator’s practice, require prior consent.

Remediation: move the fonts to the own infrastructure, eliminating the transmission of the IP address to Google; name all recipients of web data in the policy individually — the Matomo counter, the Cloudflare Insights analytics, the direct loading of Google Fonts — with the purposes indicated; introduce a consent mechanism that actually governs the loading of the analytics scripts, with the option to refuse before they start; if Cloudflare Insights is retained — distinguish in the policy between the protective Cloudflare function and the performance analytics.