A site visited by the country's most vulnerable citizens — pensioners, people with disabilities, families with children, crime victims. A cookie banner is present, but YouTube begins transmitting data 62 ms after the banner loads — before a person has even seen it.
Timeline of the leak
Declared versus actual
Transfer timings
The banner loads, but is not yet shown
Data transmission 62 ms after the banner. 50 requests per session
No exact timing
Detected trackers
- YouTube (standard mode)
- Google Fonts
- Cloudflare CDN (cdnjs)
- browser-update.org (blocked by CSP)
Indicators of GDPR non-compliance
- GDPR Art. 6(1), Art. 5(1)(a)YouTube (50 requests) and Google Fonts (15 requests) fire before genuine user consent is obtained.
- GDPR Art. 7A cookie banner is formally present, but YouTube data transmission fires 62 ms after the banner script loads — before the banner is shown to the user.
- GDPR Art. 13(1)(e)YouTube is not mentioned in the policy as a data recipient (50 requests in the HAR, 5 POST requests carrying behavioral data). Siteimprove and Google are declared incompletely. Meanwhile, AddThis is declared — a service discontinued by Oracle in 2023.
- GDPR Art. 13(1)(f), Chapter VNo data-transfer mechanism to the USA is stated. Privacy Shield has been invalidated.
- GDPR Art. 5(1)(a)The policy was updated on 08.12.2025, yet lists nonexistent AddThis as an active data recipient — 30 months after its discontinuation. The declaration is not checked against the site's actual behavior.
Context
Estonia’s Social Insurance Board: pensions, benefits for families with children, disability payments, compensation for crime victims. The country’s most vulnerable citizens come here. HAR — two files, 14 domains.
What is done — and what isn’t
A cookie banner exists (eu_cookie_compliance) — the first instance in this series where a banner is present at all. The CSP blocks Cloudflare, DoubleClick, Siteimprove, and browser-update.org (all status 0). But YouTube is embedded in standard mode (standard youtube.com, not youtube-nocookie.com): 50 requests, five videos with no privacy-enhanced mode. The youtube.com/youtubei/v... requests aren’t loading video — they’re POST requests transmitting behavioral data back to YouTube, five times per session. Plus jnn-pa.googleapis.com/GenerateIT (YouTube WAA — device and environment identification), Google Fonts (15 requests), and Cloudflare CDN.
Damning timing
The cookie banner loads at +12696 ms. YouTube begins transmitting data at +12758 ms. The gap: 62 milliseconds. The banner has loaded, but is not yet shown to the user; the person has chosen nothing, and YouTube has already received data. A banner exists. Consent doesn’t. The data went out.
Declaration versus fact — five contradictions
The policy was updated 08.12.2025 — a recent document that should reflect reality. But: YouTube (50 requests) is never mentioned in the policy. The policy states that IP addresses are not linked to identity — yet an IP address is transmitted to Google with every font request and every YouTube frame. The policy declares AddThis (cookies __atuvc, __atuvs) — a service discontinued by Oracle in 2023, 30 months before this discontinuation date. The policy solemnly proclaims the principle of minimization — while YouTube WAA anti-bot identification runs on a page about pension payments.
Dead AddThis in a recently updated policy is not a technical error — it is proof that the policy is updated formally (dates changed, wording tweaked), but no real check is performed to verify the declaration against the site’s actual behavior. For a regulator or a court, this is a specific, dated fact: 30 months between the service’s discontinuation and an update to a policy that still lists it.
Conclusion
The more solemnly a policy is written, the harder the blow when the HAR shows the opposite. The site declares a minimization principle — and embeds YouTube with no privacy mode. It declares transparency — and doesn’t mention YouTube as a recipient. It declares that IP addresses aren’t linked to identity — and transmits the IP address to Google, which does exactly that, professionally. The policy records intent; the HAR records fact. Between them lies a gap, and that gap falls on the shoulders of the site’s most vulnerable users.
dee75933e3b62371a9a0c61fa63bc8e55f9b5866ab33eabf5f6bc32388e1d4b3Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
To: Estonian Data Protection Inspectorate (AKI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website sotsiaalkindlustusamet.ee. 2. Circumstances I visited the website sotsiaalkindlustusamet.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 12 April 2026 (open methodology, reproducible measurements) documents the following indications: 1) YouTube (50 requests) and Google Fonts (15 requests) fire before genuine user consent is obtained. 2) A cookie banner is formally present, but YouTube data transmission fires 62 ms after the banner script loads — before the banner is shown to the user. 3) YouTube is not mentioned in the policy as a data recipient (50 requests in the HAR, 5 POST requests carrying behavioral data). Siteimprove and Google are declared incompletely. Meanwhile, AddThis is declared — a service discontinued by Oracle in 2023. 4) No data-transfer mechanism to the USA is stated. Privacy Shield has been invalidated. 5) The policy was updated on 08.12.2025, yet lists nonexistent AddThis as an active data recipient — 30 months after its discontinuation. The declaration is not checked against the site's actual behavior. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-sotsiaalkindlustusamet-ee/ 3. Provisions violated GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 5(1)(a) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]