tervisekassa.ee

Getting to the substance

Tervisekassa handles data that its own policy classifies as a special category: health data, financial data, special categories of personal data under GDPR Art. 9. I opened the site, recorded the traffic, and analyzed the HAR file. 300 requests per session, 6 unique domains. And on this health-related site, undeclared American processors run before the user can click anything at all.

The banner: almost correct, but with a hole

The consent banner here is better than the ones at mil.ee, transpordiamet.ee, or valitsus.ee. Three buttons: settings, “reject all,” and “accept all.” A reject option exists. The category structure is correct — non-essential categories are off by default, as GDPR Art. 7 requires.

But there’s a detail. The “necessary cookies” category includes _grecaptcha — Google reCAPTCHA with a 180-day lifespan. The category is marked “always active” and cannot be turned off. This is the same dark pattern recorded at mil.ee. Google reCAPTCHA is not an Estonian service — it’s an American corporation, and technical alternatives exist. Placing Google in “necessary” with rejection blocked is a violation of Art. 7(4): consent is not freely given if it cannot be withdrawn without consequence.

What happens before consent

The page start is logged. From there — by the timings.

At +214 ms, cdn.jsdelivr.net loads — the script of the consent-banner plugin itself, hosted on a Cloudflare server in the USA. The load happens before the banner has even appeared on screen. Status 200, an actual transfer. cdn.jsdelivr.net is not declared in the policy.

At +229 ms — fonts.googleapis.com. Google Fonts requests the Open Sans and Noto Sans typefaces. Each such request transmits the user’s IP address to Google LLC, USA. Status 200. Google Fonts is not mentioned in the policy.

At +282 ms — fonts.gstatic.com, Google’s CDN for font files, a server in the USA. Status 200.

All of this happened before the user clicked any button. With no consent. On a site that calls itself a health-data processor.

Hosting architecture

The tervisekassa.ee server — IP 172.67.183.114 — is Cloudflare, USA. Every HTTP request to the Estonian Health Insurance Fund’s website passes through the American company’s infrastructure. Cloudflare sees the user’s IP address, User-Agent, visited URLs, and visit time. In the response headers, the server returns server: cloudflare, a cf-ray request identifier, and report-to pointing to a.nel.cloudflare.com — network error reports go to the USA. Cloudflare, as a data processor, is not mentioned in the policy, and no legal transfer mechanism to the USA is stated.

What the site permits itself

In the Content-Security-Policy header, the site lists which external resources it permits itself to load. Among them: Meta (*.facebook.net, *.facebook.com), Google Analytics, Google Tag Manager, Cloudflare Insights, Siteimprove (Denmark), AWS eu-north-1, Tableau (Salesforce), US CDNs (unpkg.com, cdnjs.cloudflare.com, npmcdn.com), as well as Estonia’s own TEHIK and the crossword site ristsonad.ee. The CSP is applied in enforce mode — block-all-mixed-content is present, and there is no Report-Only suffix. In other words, this is not a theoretical possibility, but active permission to load everything listed at any moment.

The homepage’s HTML, via the cookiesjsr configuration, discloses a Google Analytics identifier, G-0FEP5VSTYR, with the parameter consentMode:false — GA activates only after consent. In the captured session, no consent was given, so no transfers to Google Analytics appear in the HAR. This is correct behavior — but only on the condition that the declared list of recipients matches reality. Here, it doesn’t.

Discrepancy between policy and reality

The policy (last updated 06.03.2026) declares SSESS, cookiesjsr, hc, _grecaptcha under necessary cookies; Siteimprove/nmstat under analytics, with a Danish address stated; Google Tag Manager and Facebook Pixel under marketing; YouTube under video; and Power BI is mentioned in passing, with no note that data may go to Microsoft.

Not declared are actually running or permitted recipients: Google Fonts, cdn.jsdelivr.net, Cloudflare as hosting and NEL, AWS eu-north-1, Tableau, TEHIK as a separate recipient, Insights in the CSP, unpkg.com, cdnjs.cloudflare.com, npmcdn.com. This is a violation of Art. 13(1)(e): the data subject must know all recipients of their data.

reCAPTCHA leads to Google

At the bottom of the policy page and beneath the contact form is a note that the site is protected by reCAPTCHA, and that Google’s privacy policy and terms of service apply. The words “privacy policy” and “terms” are clickable links leading directly to google.com. This is the same pattern recorded at inforegister.ee: a user trying to learn how their own data is processed is redirected to Google. The browser sends a Referer header carrying the address of Tervisekassa’s policy page — Google learns who came, from where, when, and what they were reading.

Context that changes everything

Tervisekassa is not an online store. It is an organization that processes data on every insured person’s medical cases, prescribed medications, dental treatment, pregnancy and child health, medical services received abroad, sick leave, and insurance payments. In its own policy, it explicitly classifies this as a special category of personal data under GDPR Art. 9 — the highest level of protection provided by law.

The homepage has a section titled “My Data: Health Portal” — a direct link to a citizen’s personal medical data. In a session where a citizen authenticates via ID card or Mobile-ID, undeclared American processors are running: Cloudflare as hosting, Google Fonts, AWS in the CSP. This requires separate legal justification under Art. 9 — which does not exist.

Conclusion

On the banner, Tervisekassa is making an effort: there’s a reject option, categories are off by default, Google Analytics doesn’t fire without consent. But all of this is undone by what happens before any click. Google fonts, the consent-banner plugin from a US CDN, and the Cloudflare hosting itself all transmit visitor data to the USA before consent — on a site that, by its own definition, processes a special category of health data.