at.gov.lv

Context

at.gov.lv is the website of the Supreme Court of Latvia (Augstākā tiesa), the site’s administrator, at Brīvības bulvāris 36, Riga, LV-1511, contact at@at.gov.lv. The site is built on Laravel and is protected by an F5 automated-traffic protection system (a challenge under the /TSPD/ paths).

Several documents are attached to the material. The one directly concerning the site is the Supreme Court’s cookie policy (bilingual, Latvian and English, confirmed on 18 August 2025 by the head of the court’s communication division). The other attached documents do not relate directly to this domain: the “TA politika” data-processing policy is a document of the Court Administration (Tiesu administrācija, ta.gov.lv, Antonijas iela 6), a different body of the judicial system; Cabinet of Ministers Regulation No. 445 is a normative act on posting information on the internet, referenced by the accessibility notice. There is no separate consolidated privacy policy specifically for at.gov.lv in the material; processing on visiting the site is governed by the cookie policy.

The measurement consists of one recording: the home page with a transition to the language version /lv. Seventy requests, three nodes. The recording was made on 15 June 2026.

Who data goes to directly

Only code.jquery.com (the Fastly CDN) — for the functional jQuery UI library. There are no stand-alone analytics or advertising recipients in the recording.

Declared versus actual

The Supreme Court’s cookie policy is exceedingly narrow and definite: the site uses only technically necessary cookies, for which consent is not required, and exactly two are listed — XSRF-TOKEN (protection against cross-site request forgery) and laravel_session (session maintenance); information related to cookies is not used for personal identification. On third-party resources, the policy states that the site may contain links to other sites with their own policies, for which the court is not responsible.

The recording confirms this. Across 70 requests, the only third-party node is code.jquery.com, from which the stylesheet and script of the jQuery UI 1.13.1 library are loaded (the CDN is served via Fastly), initiated by the markup of the page itself. There is no Google Analytics, no Google Tag Manager, no advertising services, no social networks and no RTB infrastructure in the recording — not a single request. A check against the names of known analytics and advertising platforms and against measurement identifiers (properties of the form G-, AW-, UA-, GTM-) yielded not a single match. The application, meanwhile, keeps its own session (laravel_session, js.cookie.js in the markup) — exactly what the policy describes.

A significant share of the requests falls to the F5 bot-protection system: the /TSPD/ sequence is its challenge, issuing and verifying a session token. This is the site’s own protective infrastructure, first-party by domain, not a third-party recipient of data. Separately, burp/favicon.ico in the recording is a service request, unrelated to the site and not counted in the findings.

The measurement revealed no discrepancy between the declared and the actual.

Consent: what is proven and what is not

Proven: there is no third-party analytics, advertising or tracking in the recording. Across 70 requests the only external node is the public CDN of the jQuery UI library; it carries no analytics or advertising payload. No requests to Google or to any other analytics or advertising recipient arise.

Proven: no consent mechanism is required given the cookie composition. The policy declares only technically necessary cookies, and the recording confirms this — there is no consent-management platform in it, but there is nothing to consent to either: neither analytics nor marketing cookies are observed.

Not proven and not assessed: the state of cookies on the device. Cookie values and the Cookie/Set-Cookie headers have been removed in the redaction of the file; the presence of XSRF-TOKEN and laravel_session specifically is, for this file, confirmed by the markup and the application’s logic rather than by response headers.

Separately: during capture the browser sent a DNT: 1 header. Since there are no third-party transmissions in the recording, this signal could have had no effect on anything.

Bounds of observation

The measurement covers a single page — the home page with a transition to the language version. Observation captures the browser’s behaviour, not the internal side of the services: server-side processing and contractual relationships with the CDN provider are not verified by a browser measurement. The legal assessment is made by the competent authority — in Latvia, Datu valsts inspekcija.

The file is published redacted under a “lean” profile: cookie values in requests have been removed, the Cookie and Set-Cookie headers stripped, response bodies and static resources cut. The redaction also thinned the other response headers: on most responses only service fields survive, and of the security headers only X-Frame-Options, X-Content-Type-Options and X-XSS-Protection are visible in the recording, and only on the F5 system’s responses. For this reason the presence or absence of strict transport (HSTS) and a content security policy (CSP) on the pages themselves is not established from this file and is not recorded as a caveat — this is a limitation of the recording, not a property of the site.

Identification relies on domains and address patterns: jQuery — by code.jquery.com and the path /ui/1.13.1; bot protection — by the /TSPD/ paths characteristic of F5; the service request — by the burp node; the absence of third-party analytics — by the absence of requests to google-analytics.com, googletagmanager.com, googlesyndication.com and to any other analytics or advertising nodes, and by the absence of measurement identifiers in the addresses. The attached “TA politika” data-processing policy relates to the Court Administration (ta.gov.lv), not to the Supreme Court, and was not used to assess the at.gov.lv site; the site corresponds to the Supreme Court’s cookie policy.

Conclusion

The website of the Supreme Court of Latvia, when browsed, transmits data to no stand-alone third-party recipient. Across 70 requests, the only external resource going out is the jQuery UI library from a public CDN — functional and with no analytics payload; everything else is served by the domain itself, including the F5 bot-protection system. There is no Google analytics, no advertising services, no social networks and no RTB infrastructure in the recording at all. The cookie policy declares only technically necessary session cookies, for which consent is not required and which are not used for identification — and this corresponds exactly to what is observed; the declared matches the actual. The only thing that can be noted as a soft caveat is that the jQuery UI library is loaded from a third-party CDN, as a result of which the visitor’s IP address becomes visible to its operator; the cookie policy itself acknowledges the possibility of third-party resources, and hosting the library on the court’s own domain would remove this too.