Corporate website of Latvia's electricity transmission system operator — one recording, 49 requests, five nodes. There is no active analytics or advertising: no Google Analytics, no Tag Manager, no advertising services, no social pixels. But three third-party nodes nonetheless receive the visitor's IP address without consent and without disclosure: Google Fonts (the Open Sans font), the AddToAny share-buttons widget, and Cloudflare telemetry. Meanwhile the privacy notice names only Google Analytics as a recipient — which is precisely what is absent from the recording — and does not mention the actual recipients. During capture the browser sent a DNT: 1 header.
Request timeline
Declared versus actual
Transfer timings
Open Sans font descriptor. The visitor's IP address is visible to Google.
Share-widget script. The IP address is visible to the AddToAny server; there is no outbound data carrying identifiers.
beacon.min.js — Cloudflare RUM, first-party by infrastructure.
Open Sans .woff2 font files. The visitor's IP address is visible to Google.
Detected trackers
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the Open Sans font; on loading, the visitor's IP address goes to Google
- AddToAny (static.addtoany.com) — a share-buttons widget; loads its own static assets, the visitor's IP address is visible to its server
- Cloudflare (static.cloudflareinsights.com, /cdn-cgi/rum, /cdn-cgi/challenge-platform) — RUM telemetry and bot protection of the delivery provider, first-party by infrastructure
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e) — disclosure of recipientsThe privacy notice names, out of third-party web recipients, only Google Analytics ("the website may contain third-party cookies, in particular google analytics"). In fact Google Analytics is absent from the recording entirely — not a single request to google-analytics.com or googletagmanager.com, not a single measurement identifier. Instead the recording contains three other external nodes, none of which is named in the document: Google Fonts (fonts.googleapis.com, fonts.gstatic.com), to which the visitor's IP address goes when the Open Sans font is loaded; AddToAny (static.addtoany.com), a share-buttons widget, whose server likewise sees the IP address when its script loads; and Cloudflare telemetry. The recipient named in the policy does not operate in the recording, and the actual web recipients are not disclosed.
- ePrivacy — Directive 2002/58/EC, Art. 5(3) / GDPR Art. 6(1)(a) — consent for third-party resourcesThe privacy notice states plainly that consent for cookies is not requested, because the site "does not track user habits." However, the third-party resources Google Fonts and AddToAny are loaded automatically from the page markup at +467…+561 ms, before any interaction with the user, and in doing so the visitor's IP address becomes available to Google and AddToAny. There is no consent mechanism or choice for these third-party requests on the site. This is not analytics tracking in itself, but the transmission of the IP address to third-party services occurs without consent and without disclosure.
- GDPR Art. 44 — transfer to a third country (as regards Google Fonts)The Open Sans font is loaded from Google servers (fonts.googleapis.com, fonts.gstatic.com), which entails the transmission of the visitor's IP address to Google. The privacy notice mentions a possible transfer of data outside the EU in general terms and with reference to standard contractual clauses, but as regards the loading of Google fonts this mechanism is not disclosed, and the recipient itself (Google Fonts) is not named. Hosting the font on the site's own domain would remove this transfer entirely.
Context
ast.lv is the corporate website of JSC Augstsprieguma tīkls (AST), Latvia’s electricity transmission operator (the high-voltage backbone grid). The controller’s address is Rīga, Dārzciema iela 86, LV-1073; the data-protection specialist’s contact is DPO@ast.lv. The site is built on Drupal 11 and delivered via Cloudflare (cf-ray with the TLL label — Tallinn). The set of security headers on the home page is decent: Referrer-Policy same-origin, X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection, Expect-CT in enforce mode; some responses carry a content security policy in report-only mode.
Processing is described by the AST privacy notice (bilingual, English and Latvian parts). The site itself is addressed directly by the “Cookies” and “Cookies of third parties” sections.
The measurement consists of one recording: the home page with a transition to the language version /lv. Forty-nine requests, five nodes. The recording was made on 15 June 2026.
Who data goes to directly
Google (Fonts), AddToAny; Cloudflare — as the delivery provider. There is no active analytics or advertising in the recording.
Declared versus actual
The cookie section of the notice describes the processing narrowly: cookies are used for functionality, visit statistics and improving efficiency; the server registers technical request data (address, device, browser, IP, time) for technical purposes; consent for cookies is not requested, since AST “does not track user habits.” A separate section on third-party cookies names exactly one external tool: “the website may contain third-party cookies, in particular google analytics,” noting that the tool belongs to Google Inc., US.
The measurement yields a discrepancy in both directions at once.
The named recipient does not operate in the recording. There is not a single request to google-analytics.com or googletagmanager.com, not a single measurement identifier (properties of the form G-, AW-, UA-, GTM-) in the recording. Google Analytics, the only third-party tool named by name in the policy, is in fact not engaged on the observed page.
The actual recipients are not named. Instead, the recording contains three other external nodes. The first is Google Fonts: at +467 ms the page markup requests the Open Sans font descriptor from fonts.googleapis.com, followed at +752…+1100 ms by three font files from fonts.gstatic.com. On these requests the visitor’s IP address becomes visible to Google. The second is AddToAny: at +561 ms the script of the share-buttons widget (static.addtoany.com/menu/page.js), its module and menu are loaded; the widget loads only its own static assets and makes no outbound requests carrying identifiers or pixels in the recording, but when its script loads the visitor’s IP address is visible to the AddToAny server. The third is Cloudflare telemetry (static.cloudflareinsights.com) and its bot protection (/cdn-cgi/challenge-platform, /cdn-cgi/rum), the delivery provider’s infrastructure. Neither Google Fonts, nor AddToAny, nor Cloudflare is mentioned in the privacy notice.
There is no consent for the third-party requests. The policy removes the question of consent outright, citing the absence of habit tracking. But the requests to Google Fonts and AddToAny go out automatically as the page is parsed, before any user action, and transmit the IP address to third-party services. There is no choice or consent mechanism for these requests on the site. This is not analytics tracking with a user identifier, but the transmission of the IP address to third parties without disclosure and without consent is present.
The internal requests to /lv/ajax/charts/imports-exports are the site’s own AJAX (data for the electricity import-export charts), first-party, and do not go out.
Consent: what is proven and what is not
Proven: there is no active third-party analytics or advertising in the recording. No requests to Google Analytics, Google Tag Manager, advertising services, social networks or RTB infrastructure arise; measurement identifiers are absent from the addresses.
Proven: the third-party resources load without consent. Google Fonts (+467 ms) and AddToAny (+561 ms) are requested from the page markup automatically, before the user could make any choice; there is no consent-management platform in the recording.
Proven: the visitor’s IP address becomes available to Google and AddToAny. This follows from the very fact of the browser’s requests to fonts.gstatic.com, fonts.googleapis.com and static.addtoany.com — on any network request the sender’s IP address is visible to the receiving server.
Not proven and not asserted: any analytics payload from AddToAny. In the recording the widget only loads its own static assets and sends no requests carrying identifiers. Whether AddToAny collects data by other means beyond the observed page is not established by a browser measurement and is not part of the conclusion.
Separately: during capture the browser sent a DNT: 1 header. This had no effect on the composition of the requests.
Bounds of observation
The measurement covers a single page — the home page with a transition to the language version. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with recipients are not verified by a browser measurement. The legal assessment is made by the competent authority — in Latvia, Datu valsts inspekcija.
The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped, response bodies and static resources cut. The response headers in this file are preserved, so the set of security headers and the composition of nodes are verified from the recording directly. Full addresses and identifiers are not reproduced in the analysis; the conclusion about the visibility of the IP address to third-party servers rests on the very fact of network requests to their domains.
The identification of services relies on domains and address patterns: Google Fonts — by fonts.googleapis.com and fonts.gstatic.com with the Open Sans font path; AddToAny — by static.addtoany.com and the widget paths /menu/; Cloudflare — by cloudflareinsights.com and the /cdn-cgi/ paths. The absence of Google Analytics is established by the absence of requests to its domains and of measurement identifiers in the addresses.
Conclusion
The corporate website of Latvia’s electricity transmission operator runs no active analytics or advertising: there is no Google Analytics, no Tag Manager, no advertising services and no social pixels in the recording. Nonetheless, three third-party nodes do receive the visitor’s IP address without consent and without disclosure: Google Fonts when the Open Sans font is loaded, the AddToAny share-buttons widget, and Cloudflare telemetry. The privacy notice, meanwhile, names Google Analytics as the sole third-party tool — which is precisely what is absent from the recording — and does not mention the actual web recipients at all; what is named is not what operates, and what operates is not named. Consent for the third-party requests is not sought, although they go out automatically when the page opens.
Remediation: host the Open Sans font on the site’s own domain to stop the transmission of the IP address to Google Fonts, or place its loading under consent management; name the actual third-party web recipients in the privacy notice — Google Fonts, AddToAny, Cloudflare — with the nature of the transmission stated, and remove Google Analytics, which is not used on the site, from the document, or bring the document into line with the actual set of services; for third-party resources that transmit the IP address, provide a consent mechanism or refrain from loading them before consent.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
4e34a2b537b3e15592eb37e683a1e0a917066140fe887a323bf3bef68bbf0bfeWant a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — ast.lv
Кому: [укажите адрес компании — DPO / поддержка / юридический отдел]
От: [Ваше имя], [контактный email]
Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта ast.lv.
1. Категории данных и цели обработки (ст. 15(1)(a)-(c))
На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки:
1) The privacy notice names, out of third-party web recipients, only Google Analytics ("the website may contain third-party cookies, in particular google analytics"). In fact Google Analytics is absent from the recording entirely — not a single request to google-analytics.com or googletagmanager.com, not a single measurement identifier. Instead the recording contains three other external nodes, none of which is named in the document: Google Fonts (fonts.googleapis.com, fonts.gstatic.com), to which the visitor's IP address goes when the Open Sans font is loaded; AddToAny (static.addtoany.com), a share-buttons widget, whose server likewise sees the IP address when its script loads; and Cloudflare telemetry. The recipient named in the policy does not operate in the recording, and the actual web recipients are not disclosed.
2) The privacy notice states plainly that consent for cookies is not requested, because the site "does not track user habits." However, the third-party resources Google Fonts and AddToAny are loaded automatically from the page markup at +467…+561 ms, before any interaction with the user, and in doing so the visitor's IP address becomes available to Google and AddToAny. There is no consent mechanism or choice for these third-party requests on the site. This is not analytics tracking in itself, but the transmission of the IP address to third-party services occurs without consent and without disclosure.
3) The Open Sans font is loaded from Google servers (fonts.googleapis.com, fonts.gstatic.com), which entails the transmission of the visitor's IP address to Google. The privacy notice mentions a possible transfer of data outside the EU in general terms and with reference to standard contractual clauses, but as regards the loading of Google fonts this mechanism is not disclosed, and the recipient itself (Google Fonts) is not named. Hosting the font on the site's own domain would remove this transfer entirely.
2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46)
Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/lv-ast-lv/
3. Автоматизированная обработка и профилирование (ст. 15(1)(h))
Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки.
С уважением,
[Ваше имя]
[контактный email]
[Страна]
[Дата]Subject: Data access request (GDPR Art. 15) — ast.lv
To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]
I request access to my personal data processed in connection with the website ast.lv.
1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:
1) The privacy notice names, out of third-party web recipients, only Google Analytics ("the website may contain third-party cookies, in particular google analytics"). In fact Google Analytics is absent from the recording entirely — not a single request to google-analytics.com or googletagmanager.com, not a single measurement identifier. Instead the recording contains three other external nodes, none of which is named in the document: Google Fonts (fonts.googleapis.com, fonts.gstatic.com), to which the visitor's IP address goes when the Open Sans font is loaded; AddToAny (static.addtoany.com), a share-buttons widget, whose server likewise sees the IP address when its script loads; and Cloudflare telemetry. The recipient named in the policy does not operate in the recording, and the actual web recipients are not disclosed.
2) The privacy notice states plainly that consent for cookies is not requested, because the site "does not track user habits." However, the third-party resources Google Fonts and AddToAny are loaded automatically from the page markup at +467…+561 ms, before any interaction with the user, and in doing so the visitor's IP address becomes available to Google and AddToAny. There is no consent mechanism or choice for these third-party requests on the site. This is not analytics tracking in itself, but the transmission of the IP address to third-party services occurs without consent and without disclosure.
3) The Open Sans font is loaded from Google servers (fonts.googleapis.com, fonts.gstatic.com), which entails the transmission of the visitor's IP address to Google. The privacy notice mentions a possible transfer of data outside the EU in general terms and with reference to standard contractual clauses, but as regards the loading of Google fonts this mechanism is not disclosed, and the recipient itself (Google Fonts) is not named. Hosting the font on the site's own domain would remove this transfer entirely.
2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/lv-ast-lv/
3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Data State Inspectorate of Latvia (DVI) — dvi.gov.lv
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — ast.lv
1. Предмет жалобы
Я подаю жалобу в отношении обработки моих персональных данных сайтом ast.lv.
2. Обстоятельства
Я посетил сайт ast.lv и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 29.08.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки:
1) The privacy notice names, out of third-party web recipients, only Google Analytics ("the website may contain third-party cookies, in particular google analytics"). In fact Google Analytics is absent from the recording entirely — not a single request to google-analytics.com or googletagmanager.com, not a single measurement identifier. Instead the recording contains three other external nodes, none of which is named in the document: Google Fonts (fonts.googleapis.com, fonts.gstatic.com), to which the visitor's IP address goes when the Open Sans font is loaded; AddToAny (static.addtoany.com), a share-buttons widget, whose server likewise sees the IP address when its script loads; and Cloudflare telemetry. The recipient named in the policy does not operate in the recording, and the actual web recipients are not disclosed.
2) The privacy notice states plainly that consent for cookies is not requested, because the site "does not track user habits." However, the third-party resources Google Fonts and AddToAny are loaded automatically from the page markup at +467…+561 ms, before any interaction with the user, and in doing so the visitor's IP address becomes available to Google and AddToAny. There is no consent mechanism or choice for these third-party requests on the site. This is not analytics tracking in itself, but the transmission of the IP address to third-party services occurs without consent and without disclosure.
3) The Open Sans font is loaded from Google servers (fonts.googleapis.com, fonts.gstatic.com), which entails the transmission of the visitor's IP address to Google. The privacy notice mentions a possible transfer of data outside the EU in general terms and with reference to standard contractual clauses, but as regards the loading of Google fonts this mechanism is not disclosed, and the recipient itself (Google Fonts) is not named. Hosting the font on the site's own domain would remove this transfer entirely.
Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/lv-ast-lv/
3. Положения GDPR, соблюдение которых прошу проверить
GDPR Art. 13(1)(e) — disclosure of recipients; ePrivacy — Directive 2002/58/EC, Art. 5(3) / GDPR Art. 6(1)(a) — consent for third-party resources; GDPR Art. 44 — transfer to a third country (as regards Google Fonts)
4. Требование
Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR.
5. Приложения
Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше.
С уважением,
[Ваше имя]
[контактный email]
[Страна]
[Дата]Subject: Complaint regarding personal data processing — ast.lv
1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ast.lv.
2. Circumstances
I visited the website ast.lv and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 August 2026 (open methodology, reproducible measurements) documents the following indications:
1) The privacy notice names, out of third-party web recipients, only Google Analytics ("the website may contain third-party cookies, in particular google analytics"). In fact Google Analytics is absent from the recording entirely — not a single request to google-analytics.com or googletagmanager.com, not a single measurement identifier. Instead the recording contains three other external nodes, none of which is named in the document: Google Fonts (fonts.googleapis.com, fonts.gstatic.com), to which the visitor's IP address goes when the Open Sans font is loaded; AddToAny (static.addtoany.com), a share-buttons widget, whose server likewise sees the IP address when its script loads; and Cloudflare telemetry. The recipient named in the policy does not operate in the recording, and the actual web recipients are not disclosed.
2) The privacy notice states plainly that consent for cookies is not requested, because the site "does not track user habits." However, the third-party resources Google Fonts and AddToAny are loaded automatically from the page markup at +467…+561 ms, before any interaction with the user, and in doing so the visitor's IP address becomes available to Google and AddToAny. There is no consent mechanism or choice for these third-party requests on the site. This is not analytics tracking in itself, but the transmission of the IP address to third-party services occurs without consent and without disclosure.
3) The Open Sans font is loaded from Google servers (fonts.googleapis.com, fonts.gstatic.com), which entails the transmission of the visitor's IP address to Google. The privacy notice mentions a possible transfer of data outside the EU in general terms and with reference to standard contractual clauses, but as regards the loading of Google fonts this mechanism is not disclosed, and the recipient itself (Google Fonts) is not named. Hosting the font on the site's own domain would remove this transfer entirely.
Full technical documentation is published at: https://gdpru.eu/en/audits/lv-ast-lv/
3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) — disclosure of recipients; ePrivacy — Directive 2002/58/EC, Art. 5(3) / GDPR Art. 6(1)(a) — consent for third-party resources; GDPR Art. 44 — transfer to a third country (as regards Google Fonts)
4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.
5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]