RU EN
www.
Technical audit · 01.05.2026

tootukassa.ee

Unemployment insurance, work capacity assessment
EE

The Unemployment Insurance Fund assesses the work capacity of people with disabilities — health data, a special category under Art. 9. The site embeds Genesys with a Cobrowse feature (shared screen viewing), which in turn pulls in New Relic. Analytics are 'in-house' but proxied via Cloudflare in the USA. And the banner simply has no 'Reject' button.

Request timeline

+265–775 ms · before consent
Google Fonts (+265 ms, IP sent to Google, USA). Matomo (+766 ms) — subdomain matomo.tootukassa.ee, but the server runs on a Cloudflare IP (172.66.166.87, USA). Genesys (+775 ms, apps.mypurecloud.com, AWS USA).
Banner — a decoy
A grey bar with buttons 'Sain aru' and 'Rohkem infot'. No 'Reject' button, no category checkboxes. Clicking 'Understood' closes the banner — it is not consent. A notice disguised as a consent mechanism.
+972–1514 ms · actual transmission
Matomo (+972 ms, status 204): _id, page, screen resolution, browser, OS, device. Genesys Messenger + Cobrowse (+1514 ms) — technical capability to view the user's screen. 26 requests to Genesys in the first 4 seconds. New Relic is loaded by Genesys from within its own scripts.

Declared versus actual

✓ Matomo — the only entry in the cookie list — declared
✓ Microsoft Teams, EAS, EESSI — mentioned in general terms — declared
✓ '_pk_id does not contain data identifying the person' — declared
+ Genesys — 26 requests, cookies on apps.mypurecloud.de — not declared
+ New Relic — sub-processor loaded by Genesys — not declared
+ Google Fonts — IP sent to USA — not declared
+ Cloudflare — de facto processor for the in-house Matomo — not declared

Transfer timings

+265 ms fonts.gstatic.com

Google Fonts, IP sent to Google (USA).

+766 ms matomo.tootukassa.ee

Own subdomain, but Cloudflare server (172.66.166.87, USA).

+775 ms apps.mypurecloud.com (Genesys)

Contact centre platform, AWS USA. Status 304.

+972 ms matomo.tootukassa.ee (collect)

Status 204. _id (13 months), IP, OS, browser, page history.

+1514 ms Genesys Messenger + Cobrowse

Cobrowse — shared viewing of the user's screen.

Detected trackers

Indicators of GDPR non-compliance

Context

Eesti Töötukassa is Estonia’s Unemployment Insurance Fund. It pays unemployment insurance and benefits, assesses the work capacity of people with disabilities, and makes decisions on the employment of foreign nationals. In the course of work capacity assessments it processes health data — a special category under GDPR Art. 9. It is partly funded by EU funds (NextGenerationEU). HAR: 163 requests, 6 unique domains. Site server located in Estonia (84.50.110.60, Telia Eesti).

At the bottom of the homepage sits a grey bar: “This site uses cookies. You can opt out at any time by changing your browser settings.” Two buttons: “Sain aru” (Understood) and “Rohkem infot” (More information). No “Reject” button, no category checkboxes — there is no way to refuse cookies on the site itself. Under Recital 32, consent must be an active affirmative act; clicking “Understood” does not give consent — it closes an information notice. This practice is explicitly prohibited by EDPB Guidelines 05/2020: a notice passed off as consent.

The sub-processor chain

At first glance, analytics appear to be in-house — the subdomain is matomo.tootukassa.ee. But the server responds from a Cloudflare IP (172.66.166.87), confirmed by the server: cloudflare response header: Töötukassa’s analytics are proxied through a US company’s infrastructure. Then there is Genesys (apps.mypurecloud.com, AWS USA): a contact centre platform, 26 requests in the first 4 seconds, embedded with a Cobrowse feature that enables shared viewing of the user’s screen. And within Genesys’s scripts, New Relic — a US monitoring service — is loaded. Töötukassa embeds Genesys; Genesys pulls in New Relic. Under Art. 28(2) the controller must give prior written authorisation for each sub-processor; under Art. 13(1)(e) the data subject must be informed of all recipients. Neither Genesys nor New Relic appears in the policy.

The anonymity claim

The policy states: “_pk_id does not contain data identifying the person.” In the HAR, Matomo receives a unique 16-character identifier (valid for 13 months), an IP address, OS, browser version, screen resolution, device form factor, and URLs of visited pages — including tootuna-registreerimine (unemployment registration) and the Referer header. Under the CJEU Breyer ruling (C-582/14), an IP address constitutes personal data; a unique 13-month identifier combined with IP and browsing history even more so. The statement is legally incorrect.

Conclusion

Töötukassa hosts its site in Estonia and set Matomo up on its own subdomain — the right architectural choices. But Matomo is proxied through Cloudflare USA, Genesys is embedded with the ability to view the user’s screen and pulls in New Relic, Google Fonts operates before consent, and there is no rejection option on the site. The policy is a detailed bilingual document, but its processor list is incomplete. eesti.ee and riigihanked.riik.ee demonstrate that operating without external domains is possible. Here, during an unemployment registration session — a moment when a person is already vulnerable — undisclosed US processors are running.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: ee/tootukassa-ee-2026-05-01.har
SHA-256: d9a1c63ba2c5722f27918d027dfe8b030a45c4359adc7668f963dcc2143872c3
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — tootukassa.ee

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website tootukassa.ee.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) No consent mechanism exists. The buttons 'Sain aru' (Understood) and 'Rohkem infot' (More information) constitute neither consent nor refusal. There is no 'Reject' button — the site instructs users to adjust their browser settings. This practice is explicitly prohibited by EDPB Guidelines 05/2020.

2) Google Fonts (+265 ms), Matomo via Cloudflare (+766 ms), Genesys (+775 ms), and New Relic all fire before any interaction with the banner.

3) Genesys, New Relic, Google Fonts, and Cloudflare (as the de facto processor for Matomo) are not disclosed. Only Matomo is listed in the cookie notice.

4) Sub-processor chain: Töötukassa embeds Genesys; Genesys pulls in New Relic. The engagement of New Relic as a sub-processor is undocumented; prior written authorisation from the controller is absent.

5) The policy states that _pk_id 'does not contain data identifying the person'. In the HAR, Matomo receives a unique identifier (valid for 13 months), IP address, OS, browser, screen resolution, and page history. Under the CJEU Breyer ruling (C-582/14) this constitutes personal data — the statement is legally incorrect.

6) No data transfer mechanism to the USA is stated for any US recipient (Genesys/AWS, Matomo/Cloudflare, Google, New Relic).

7) During the unemployed person's registration session via Web eID, undisclosed US processors operate without a separate legal basis. Work capacity data is a special category.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-tootukassa-ee/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — tootukassa.ee

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website tootukassa.ee.

2. Circumstances
I visited the website tootukassa.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 1 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) No consent mechanism exists. The buttons 'Sain aru' (Understood) and 'Rohkem infot' (More information) constitute neither consent nor refusal. There is no 'Reject' button — the site instructs users to adjust their browser settings. This practice is explicitly prohibited by EDPB Guidelines 05/2020.

2) Google Fonts (+265 ms), Matomo via Cloudflare (+766 ms), Genesys (+775 ms), and New Relic all fire before any interaction with the banner.

3) Genesys, New Relic, Google Fonts, and Cloudflare (as the de facto processor for Matomo) are not disclosed. Only Matomo is listed in the cookie notice.

4) Sub-processor chain: Töötukassa embeds Genesys; Genesys pulls in New Relic. The engagement of New Relic as a sub-processor is undocumented; prior written authorisation from the controller is absent.

5) The policy states that _pk_id 'does not contain data identifying the person'. In the HAR, Matomo receives a unique identifier (valid for 13 months), IP address, OS, browser, screen resolution, and page history. Under the CJEU Breyer ruling (C-582/14) this constitutes personal data — the statement is legally incorrect.

6) No data transfer mechanism to the USA is stated for any US recipient (Genesys/AWS, Matomo/Cloudflare, Google, New Relic).

7) During the unemployed person's registration session via Web eID, undisclosed US processors operate without a separate legal basis. Work capacity data is a special category.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-tootukassa-ee/

3. GDPR provisions I ask you to examine
GDPR Art. 7(3), Recital 32; GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 13(1)(e); GDPR Art. 28(2)–(4); GDPR Art. 5(1)(a); GDPR Art. 13(1)(f), Chapter V; GDPR Art. 9

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]