Estonia's largest telecom operator transmits a customer's isikukood in plaintext in the URL string. Grafana Faro fires from the first millisecond — 24 seconds before the consent banner appears. The policy declares no data transfer outside the EU. The HAR shows the opposite.
Timeline of the leak
Declared versus actual
Transfer timings
14 requests per session. session_start, errors, traces. USA
Chat widget, a tracking event. USA
TeliaRum — 11 requests. Traces and metrics
Cookiebot loads — 24 seconds after the session starts
GTM-5G2M3L — status 0
A GET request carrying personalCode in the URL — status 200
Detected trackers
- Grafana Faro (faro-collector-prod-eu-west-0.grafana.net)
- TeliaRum (rum.estpak.ee)
- Google Tag Manager (GTM-5G2M3L)
- Sentry (sentry-ingress.estpak.ee)
- ultimate.ai (chat widget)
- Cloudinary (res.cloudinary.com)
Indicators of GDPR non-compliance
- GDPR Art. 5(1)(f), Art. 25The isikukood (national identification number) is transmitted in plaintext as a GET parameter in the URL: personalCode=XXXXXXXXXXX. Visible in server logs, browser history, and third-party analytics systems.
- GDPR Art. 6(1), Art. 7Grafana Faro initiates requests from the very first millisecond of the session — before the Cookiebot consent banner loads, which only appears at +24483 ms. TeliaRum also fires before consent.
- GDPR Art. 5(1)(a), Art. 13(1)(e)Telia's privacy policy declares no data transfer outside the EU. The HAR records requests to faro-collector-prod-eu-west-0.grafana.net — Grafana's servers in the USA.
- GDPR Art. 13(1)(e)GTM (GTM-5G2M3L), Grafana Faro, and ultimate.ai are not mentioned in the privacy policy as data recipients.
- GDPR Art. 13(1)(f), Chapter VNo transfer mechanism to the USA (Grafana) is stated.
- GDPR Art. 5(1)(c)Grafana Faro initiates 14 requests per session, TeliaRum — 11 requests. The scope of monitoring exceeds the data-minimization principle.
Context
Telia Eesti AS is Estonia’s largest telecommunications operator, a subsidiary of the Swedish group Telia Company AB (Nasdaq Stockholm). It provides mobile, home internet, TV, and business services. As a telecom operator, it processes some of the most sensitive personal data: the isikukood, payment history, and service usage data. HAR: 199 requests, 14 domains, a session within a customer’s personal account.
The key finding — the isikukood in the URL
The HAR records a GET request to iseteenindus.telia.ee carrying the customer’s isikukood in plaintext in the URL string:
/myse-frontend/api/v1/dashboard/grouped-overviews/B2C?customerId=1000001082&countryCode=EE&personalCode=XXXXXXXXXXX
The isikukood is Estonia’s national identification number, analogous to a passport number. Transmitting it as a GET parameter means: the number is visible in Telia’s server logs and in every intermediate system, in the user’s browser history, and potentially in third-party analytics systems loaded on the site. Under Art. 5(1)(f), data must be processed with adequate security. Under Art. 25 — privacy by design: the system’s architecture must minimize risk from the design stage onward.
Grafana before consent
The first requests to faro-collector-prod-eu-west-0.grafana.net (Grafana Faro) are initiated from the zero mark of the session — literally at the moment the page loads. Grafana records session_start, browser errors, and traces. Grafana’s servers are located in the USA. Telia’s privacy policy declares no data transfer outside the EU — the HAR disproves this.
Cookiebot (the consent banner) only loads at +24483 ms — 24 seconds after the session starts. By this point, Grafana has already initiated 6 requests. TeliaRum (rum.estpak.ee) fired at +3163 ms — also before the banner.
GTM and the other trackers
GTM (container GTM-5G2M3L) is wired into the code and initiates requests at +28689 ms — status 0, no data got out. ultimate.ai (a chat widget) fires at +150 ms with a tracking event before consent. res.cloudinary.com — an image CDN, 7 requests, servers in the USA. sentry-ingress.estpak.ee — error monitoring, 3 requests.
Not one of these services is mentioned in Telia’s privacy policy as a data recipient.
Conclusion
The isikukood in a URL’s GET parameter is not an analytics setting or a consent banner. It is an architectural decision that transmits a customer’s national identifier in plaintext on every click within their personal account. In parallel, Grafana initiates monitoring before consent, transmitting data to the USA despite the privacy policy’s declaration. Telia processes data belonging to hundreds of thousands of customers — and the B2C portal’s architecture does not reflect that responsibility.
After a formal complaint was filed with AKI, the isikukood was removed from the URL’s GET parameters. This technical fix is noted — but it does not undo the violation documented in the HAR from March 13, 2026. Data transmitted in plaintext does not disappear along with a patch. The HAR remains evidence of what occurred.
6fa52dc5516ae84fb2fa6a7e7ec057b6ae93ae706d5dbabd0774b8e760e7a686Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
To: Estonian Data Protection Inspectorate (AKI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website telia.ee. 2. Circumstances I visited the website telia.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 March 2026 (open methodology, reproducible measurements) documents the following indications: 1) The isikukood (national identification number) is transmitted in plaintext as a GET parameter in the URL: personalCode=XXXXXXXXXXX. Visible in server logs, browser history, and third-party analytics systems. 2) Grafana Faro initiates requests from the very first millisecond of the session — before the Cookiebot consent banner loads, which only appears at +24483 ms. TeliaRum also fires before consent. 3) Telia's privacy policy declares no data transfer outside the EU. The HAR records requests to faro-collector-prod-eu-west-0.grafana.net — Grafana's servers in the USA. 4) GTM (GTM-5G2M3L), Grafana Faro, and ultimate.ai are not mentioned in the privacy policy as data recipients. 5) No transfer mechanism to the USA (Grafana) is stated. 6) Grafana Faro initiates 14 requests per session, TeliaRum — 11 requests. The scope of monitoring exceeds the data-minimization principle. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-telia-ee/ 3. Provisions violated GDPR Art. 5(1)(f), Art. 25; GDPR Art. 6(1), Art. 7; GDPR Art. 5(1)(a), Art. 13(1)(e); GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 5(1)(c) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]