RU EN
www.
Technical audit · 12.04.2026

sotsiaalkindlustusamet.ee

Social Insurance Board
EE

A site visited by the country's most vulnerable citizens — pensioners, people with disabilities, families with children, crime victims. A cookie banner is present, but YouTube begins transmitting data 62 ms after the banner loads — before a person has even seen it.

Request timeline

+12696 ms · the banner loads
A cookie banner (eu_cookie_compliance) loads — but is not yet shown to the user. The first instance in this series where a banner exists at all.
+12758 ms · 62 ms later
YouTube begins transmitting data. 62 milliseconds after the banner loads, before it's shown to the user. No choice has been made — the data has already gone out.
Per session
YouTube — 50 requests, 5 POSTs carrying behavioral data, jnn-pa.googleapis.com (WAA anti-bot, identification). Google Fonts — 15 requests. The CSP blocks Cloudflare, DoubleClick, Siteimprove, browser-update.org (status 0).

Declared versus actual

✓ AddThis (__atuvc, __atuvs) — discontinued by Oracle in 2023, zero requests in the HAR — declared
✓ The principle of data-minimization processing — declared
✓ 'IP addresses are not linked to identifying information' — declared
+ YouTube — 50 requests, 5 POSTs carrying behavioral data — not declared
+ Google Fonts — 15 requests, IP address to the USA — not declared
+ Cloudflare CDN — cdnjs, Bootstrap-datepicker — not declared

Transfer timings

+12696 ms cookie-bar.js (eu_cookie_compliance)

The banner loads, but is not yet shown

+12758 ms youtube.com

Data transmission 62 ms after the banner. 50 requests per session

No exact timing

per session jnn-pa.googleapis.com/GenerateITYouTube WAA — user identification, 5 requests
per session fonts.gstatic.comThe Roboto typeface. IP address to Google (USA), 15 requests

Detected trackers

Indicators of GDPR non-compliance

Context

Estonia’s Social Insurance Board: pensions, benefits for families with children, disability payments, compensation for crime victims. The country’s most vulnerable citizens come here. HAR — two files, 14 domains.

What is done — and what isn’t

A cookie banner exists (eu_cookie_compliance) — the first instance in this series where a banner is present at all. The CSP blocks Cloudflare, DoubleClick, Siteimprove, and browser-update.org (all status 0). But YouTube is embedded in standard mode (standard youtube.com, not youtube-nocookie.com): 50 requests, five videos with no privacy-enhanced mode. The youtube.com/youtubei/v... requests aren’t loading video — they’re POST requests transmitting behavioral data back to YouTube, five times per session. Plus jnn-pa.googleapis.com/GenerateIT (YouTube WAA — device and environment identification), Google Fonts (15 requests), and Cloudflare CDN.

Damning timing

The cookie banner loads at +12696 ms. YouTube begins transmitting data at +12758 ms. The gap: 62 milliseconds. The banner has loaded, but is not yet shown to the user; the person has chosen nothing, and YouTube has already received data. A banner exists. Consent doesn’t. The data went out.

Declaration versus fact — five contradictions

The policy was updated 08.12.2025 — a recent document that should reflect reality. But: YouTube (50 requests) is never mentioned in the policy. The policy states that IP addresses are not linked to identity — yet an IP address is transmitted to Google with every font request and every YouTube frame. The policy declares AddThis (cookies __atuvc, __atuvs) — a service discontinued by Oracle in 2023, 30 months before this discontinuation date. The policy solemnly proclaims the principle of minimization — while YouTube WAA anti-bot identification runs on a page about pension payments.

Dead AddThis in a recently updated policy is not a technical error — it is proof that the policy is updated formally (dates changed, wording tweaked), but no real check is performed to verify the declaration against the site’s actual behavior. For a regulator or a court, this is a specific, dated fact: 30 months between the service’s discontinuation and an update to a policy that still lists it.

Conclusion

The more solemnly a policy is written, the harder the blow when the HAR shows the opposite. The site declares a minimization principle — and embeds YouTube with no privacy mode. It declares transparency — and doesn’t mention YouTube as a recipient. It declares that IP addresses aren’t linked to identity — and transmits the IP address to Google, which does exactly that, professionally. The policy records intent; the HAR records fact. Between them lies a gap, and that gap falls on the shoulders of the site’s most vulnerable users.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/sotsiaalkindlustusamet-ee-2026-04-12.har
SHA-256: dee75933e3b62371a9a0c61fa63bc8e55f9b5866ab33eabf5f6bc32388e1d4b3
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — sotsiaalkindlustusamet.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website sotsiaalkindlustusamet.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) YouTube (50 requests) and Google Fonts (15 requests) fire before genuine user consent is obtained.

2) A cookie banner is formally present, but YouTube data transmission fires 62 ms after the banner script loads — before the banner is shown to the user.

3) YouTube is not mentioned in the policy as a data recipient (50 requests in the HAR, 5 POST requests carrying behavioral data). Siteimprove and Google are declared incompletely. Meanwhile, AddThis is declared — a service discontinued by Oracle in 2023.

4) No data-transfer mechanism to the USA is stated. Privacy Shield has been invalidated.

5) The policy was updated on 08.12.2025, yet lists nonexistent AddThis as an active data recipient — 30 months after its discontinuation. The declaration is not checked against the site's actual behavior.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-sotsiaalkindlustusamet-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — sotsiaalkindlustusamet.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website sotsiaalkindlustusamet.ee.

2. Circumstances
I visited the website sotsiaalkindlustusamet.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 12 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) YouTube (50 requests) and Google Fonts (15 requests) fire before genuine user consent is obtained.

2) A cookie banner is formally present, but YouTube data transmission fires 62 ms after the banner script loads — before the banner is shown to the user.

3) YouTube is not mentioned in the policy as a data recipient (50 requests in the HAR, 5 POST requests carrying behavioral data). Siteimprove and Google are declared incompletely. Meanwhile, AddThis is declared — a service discontinued by Oracle in 2023.

4) No data-transfer mechanism to the USA is stated. Privacy Shield has been invalidated.

5) The policy was updated on 08.12.2025, yet lists nonexistent AddThis as an active data recipient — 30 months after its discontinuation. The declaration is not checked against the site's actual behavior.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-sotsiaalkindlustusamet-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 5(1)(a)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]