RU EN
www.
Technical audit · 13.03.2026

telia.ee

Estonia's Largest Telecommunications Operator
EE

Estonia's largest telecom operator transmits a customer's isikukood in plaintext in the URL string. Grafana Faro fires from the first millisecond — 24 seconds before the consent banner appears. The policy declares no data transfer outside the EU. The HAR shows the opposite.

Request timeline

+0 ms · before consent
Grafana Faro (faro-collector-prod-eu-west-0.grafana.net) — the first requests fire from the zero mark, with session_start data going to the USA. Status 0 — blocked, but initiated.
+150 ms · before consent
widget-api.ultimate.ai — a chat widget, a tracking event. USA.
+601 ms · before consent
res.cloudinary.com — Telia's image CDN. USA.
+3163 ms · before consent
rum.estpak.ee (TeliaRum) — Telia's monitoring agent. Traces and metrics for the entire session.
+24483 ms · banner
Cookiebot loads — consent.cookiebot.com. The banner appears 24 seconds after the session starts.
+28689 ms · after the banner
GTM (GTM-5G2M3L) — status 0, blocked.
+30449 ms
iseteenindus.telia.ee — a GET request carrying personalCode=XXXXXXXXXXX in the URL. The isikukood in plaintext.

Declared versus actual

+ Grafana Faro (faro-collector-prod-eu-west-0.grafana.net) — USA — not declared
+ GTM-5G2M3L (www.googletagmanager.com) — not declared
+ ultimate.ai (widget-api.ultimate.ai) — not declared
+ TeliaRum (rum.estpak.ee) — not declared
+ Cloudinary (res.cloudinary.com) — not declared

Transfer timings

+0 ms faro-collector-prod-eu-west-0.grafana.net

14 requests per session. session_start, errors, traces. USA

+150 ms widget-api.ultimate.ai

Chat widget, a tracking event. USA

+3163 ms rum.estpak.ee

TeliaRum — 11 requests. Traces and metrics

+24483 ms consent.cookiebot.com

Cookiebot loads — 24 seconds after the session starts

+28689 ms www.googletagmanager.com

GTM-5G2M3L — status 0

+30449 ms iseteenindus.telia.ee

A GET request carrying personalCode in the URL — status 200

Detected trackers

Indicators of GDPR non-compliance

Context

Telia Eesti AS is Estonia’s largest telecommunications operator, a subsidiary of the Swedish group Telia Company AB (Nasdaq Stockholm). It provides mobile, home internet, TV, and business services. As a telecom operator, it processes some of the most sensitive personal data: the isikukood, payment history, and service usage data. HAR: 199 requests, 14 domains, a session within a customer’s personal account.

The key finding — the isikukood in the URL

The HAR records a GET request to iseteenindus.telia.ee carrying the customer’s isikukood in plaintext in the URL string:

/myse-frontend/api/v1/dashboard/grouped-overviews/B2C?customerId=1000001082&countryCode=EE&personalCode=XXXXXXXXXXX

The isikukood is Estonia’s national identification number, analogous to a passport number. Transmitting it as a GET parameter means: the number is visible in Telia’s server logs and in every intermediate system, in the user’s browser history, and potentially in third-party analytics systems loaded on the site. Under Art. 5(1)(f), data must be processed with adequate security. Under Art. 25 — privacy by design: the system’s architecture must minimize risk from the design stage onward.

The first requests to faro-collector-prod-eu-west-0.grafana.net (Grafana Faro) are initiated from the zero mark of the session — literally at the moment the page loads. Grafana records session_start, browser errors, and traces. Grafana’s servers are located in the USA. Telia’s privacy policy declares no data transfer outside the EU — the HAR disproves this.

Cookiebot (the consent banner) only loads at +24483 ms — 24 seconds after the session starts. By this point, Grafana has already initiated 6 requests. TeliaRum (rum.estpak.ee) fired at +3163 ms — also before the banner.

GTM and the other trackers

GTM (container GTM-5G2M3L) is wired into the code and initiates requests at +28689 ms — status 0, no data got out. ultimate.ai (a chat widget) fires at +150 ms with a tracking event before consent. res.cloudinary.com — an image CDN, 7 requests, servers in the USA. sentry-ingress.estpak.ee — error monitoring, 3 requests.

Not one of these services is mentioned in Telia’s privacy policy as a data recipient.

Conclusion

The isikukood in a URL’s GET parameter is not an analytics setting or a consent banner. It is an architectural decision that transmits a customer’s national identifier in plaintext on every click within their personal account. In parallel, Grafana initiates monitoring before consent, transmitting data to the USA despite the privacy policy’s declaration. Telia processes data belonging to hundreds of thousands of customers — and the B2C portal’s architecture does not reflect that responsibility.

After a formal complaint was filed with AKI, the isikukood was removed from the URL’s GET parameters. This technical fix is noted — but it does not undo the fact documented in the HAR from March 13, 2026. Data transmitted in plaintext does not disappear along with a patch. The HAR remains evidence of what occurred.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/telia-ee-2026-03-13.har
SHA-256: 6fa52dc5516ae84fb2fa6a7e7ec057b6ae93ae706d5dbabd0774b8e760e7a686
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — telia.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website telia.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The isikukood (national identification number) is transmitted in plaintext as a GET parameter in the URL: personalCode=XXXXXXXXXXX. Visible in server logs, browser history, and third-party analytics systems.

2) Grafana Faro initiates requests from the very first millisecond of the session — before the Cookiebot consent banner loads, which only appears at +24483 ms. TeliaRum also fires before consent.

3) Telia's privacy policy declares no data transfer outside the EU. The HAR records requests to faro-collector-prod-eu-west-0.grafana.net — Grafana's servers in the USA.

4) GTM (GTM-5G2M3L), Grafana Faro, and ultimate.ai are not mentioned in the privacy policy as data recipients.

5) No transfer mechanism to the USA (Grafana) is stated.

6) Grafana Faro initiates 14 requests per session, TeliaRum — 11 requests. The scope of monitoring exceeds the data-minimization principle.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-telia-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — telia.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website telia.ee.

2. Circumstances
I visited the website telia.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 March 2026 (open methodology, reproducible measurements) documents the following indications:

1) The isikukood (national identification number) is transmitted in plaintext as a GET parameter in the URL: personalCode=XXXXXXXXXXX. Visible in server logs, browser history, and third-party analytics systems.

2) Grafana Faro initiates requests from the very first millisecond of the session — before the Cookiebot consent banner loads, which only appears at +24483 ms. TeliaRum also fires before consent.

3) Telia's privacy policy declares no data transfer outside the EU. The HAR records requests to faro-collector-prod-eu-west-0.grafana.net — Grafana's servers in the USA.

4) GTM (GTM-5G2M3L), Grafana Faro, and ultimate.ai are not mentioned in the privacy policy as data recipients.

5) No transfer mechanism to the USA (Grafana) is stated.

6) Grafana Faro initiates 14 requests per session, TeliaRum — 11 requests. The scope of monitoring exceeds the data-minimization principle.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-telia-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 5(1)(f), Art. 25; GDPR Art. 6(1), Art. 7; GDPR Art. 5(1)(a), Art. 13(1)(e); GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 5(1)(c)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]