valimised.ee

Context

valimised.ee is the Estonian elections portal. The controller is the State Electoral Office (Riigi Valimisteenistus), a structural unit of the Chancellery of the Riigikogu operating on the basis of the election acts; address Lossi plats 1a, 15165 Tallinn. The data-protection specialist’s contact is andmekaitse@riigikogu.ee. Supervision is named directly in the terms themselves — Andmekaitse Inspektsioon. The site is built on Drupal and delivered via Cloudflare (cf-ray with the CDG label — Paris). Security headers are set out in part: there is HSTS, X-Frame-Options DENY and X-Content-Type-Options nosniff; the site does not set its own Content-Security-Policy, Referrer-Policy or Permissions-Policy.

Processing is described by the document “Data protection terms of the State Electoral Office” (revision of 6 May 2025), to which, in the same file, a separate privacy notice for the internet-voting application is appended. The site itself is addressed directly by paragraph 5, “Visiting the home page.”

The measurement consists of one recording, four navigations: the home page, the Estonian version /et, a reminder about the presidential election, and /et again. Two hundred and four requests, two nodes. The recording was made on 12 May 2026.

Who data goes to directly

Only Cloudflare — the site’s delivery provider (RUM telemetry). There are no stand-alone third-party recipients in the recording.

Declared versus actual

Paragraph 5 of the terms describes processing on visiting the site narrowly and in server terms: the IP address, the name and address of the internet service provider and the time of the visit are collected, along with information on which sections were visited and for how long; all of this feeds visit statistics and analysis of the site’s development, and is stored for no longer than one year. The document declares no external recipients, no advertising, no third-party analytics and no transfer to any parties.

The recording confirms this. Across four navigations and 204 requests, the only third-party node is static.cloudflareinsights.com, the RUM telemetry of that same Cloudflare that delivers the site; the request is initiated by the page’s own markup. There is no Google Analytics, no Google Tag Manager, no advertising services, no social networks and no RTB vendors in the recording — not a single request. A check against the names of known analytics and advertising platforms and against measurement identifiers (properties of the form G-, AW-, UA-, GTM-) yielded not a single match.

The consent mechanism is worth noting separately. The markup loads the cookiesjsr consent-management system (the Drupal cookies module) together with its loader and configuration, as well as the cookies_ga integration — a stub for conditional loading of Google Analytics only after consent. At +348633 ms a request to /et/cookies/consent/callback.json occurs — an interaction with the banner. Yet there is no Google Analytics identifier in the configuration, and analytics never loads — not before interaction with the banner, not after, and not on the subsequent navigations. In other words, the conditional analytics the site provides for is in fact disabled: the consent infrastructure is present, but there is no recipient behind it.

The measurement revealed no discrepancy between the declared and the actual.

Consent: what is proven and what is not

Proven: a consent-management mechanism is present on the site and operates. The recording shows the loading of the cookiesjsr system and its loader on every navigation, as well as the request to /et/cookies/consent/callback.json at +348633 ms — the consent system’s response to a user action.

Proven: third-party analytics does not load and no data goes out. The cookies_ga stub for conditional loading of Google Analytics is present in the markup, but it has no measurement identifier, and not a single request to Google or to any other analytics or advertising recipient arises in the recording — including the period after interaction with the banner and the three subsequent navigations.

Not proven and not required: the content of the user’s choice in the banner. What exactly the user selected in the consent window is not unambiguously established by the network recording, and is immaterial to the conclusion: even if consent for analytics had been given, there would be nothing to load — no recipient is configured.

Separately: during capture the browser sent a DNT: 1 header. Since there are no transmissions to third-party recipients in the recording, this signal could have had no effect on anything.

Bounds of observation

The measurement covers four pages of the portal. Observation captures the browser’s behaviour, not the internal side of the services: the server-side processing of visit logs referred to in paragraph 5 of the terms takes place beyond the reach of a browser measurement and is not assessed from this recording — all that is visible is that no third-party analytics or advertising recipients are loaded into the browser. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon, whose supervision is named directly in the terms themselves.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped, response bodies and static resources cut. Therefore the state of cookies on the device and the content of the consent system’s response are not assessed from this file; the conclusion about the presence of a consent mechanism and the absence of third-party transmissions rests on the composition of nodes, the addresses, the initiators and the timings of the requests, which are fully legible in the recording.

Identification relies on domains and address patterns: Cloudflare — by cloudflareinsights.com and the /cdn-cgi/ paths; the consent system — by the cookiesjsr module and the consent/callback.json request; the absence of Google — by the absence of requests to google-analytics.com, googletagmanager.com and googlesyndication.com and by the absence of measurement identifiers in the addresses.

Conclusion

The Estonian elections portal, when browsed, transmits data to no stand-alone third-party recipient. Across four navigations and 204 requests, the only thing going out is Cloudflare telemetry — of the provider that delivers the site itself. There is no Google analytics, no advertising services, no social networks and no RTB infrastructure in the recording at all. The data-protection terms describe processing on a visit narrowly — server-side visit statistics with a retention period of up to one year — and promise nothing that is not observed in the recording; the declared matches the actual. A consent-management mechanism operates on the site, and the conditional loading of Google Analytics it provides for is in fact not activated — no recipient is configured behind it. The only thing that can be noted as a soft caveat is that the site does not set a Content-Security-Policy, Referrer-Policy or Permissions-Policy, although the basic headers (HSTS, frame-embedding denial, content-type sniffing denial) are present; and there are, in any case, no transmissions in the recording that these policies would protect.