RU EN
www.
Technical audit · 13.05.2026

who.int

WHO — the United Nations specialised agency for international public health
GLOBAL

WHO — 21 domains, 202 requests. fndrsp.net fires at +0 ms. Two Clarity tags, Monsido heatmaps, FundRaiseUp, Facebook SDK, UA shut down in 2024 — all without a consent banner. An organisation that publishes data protection guidance for the healthcare sector.

Request timeline

+0 ms · first request
fndrsp.net/tb — FundRaiseUp tracker. Before the page loads.
+220 ms · no consent
Microsoft Clarity (y.clarity.ms/collect) — first of two tags. Data sent to Microsoft, USA.
+237 ms · no consent
Google Fonts — Noto Sans, Source Sans Pro, Roboto. 5 requests. USA.
+237 ms · no consent
FontAwesome CDN (use.fontawesome.com) — v5.15.4. USA.
+240 ms · no consent
Facebook SDK (connect.facebook.net). USA.
+241 ms · no consent
Telerik Kendo CDN (kendo.cdn.telerik.com) — JS UI framework. USA.
+315 ms · no consent
GTM (GTM-5QFSQRT) and FundRaiseUp widget (AMEEWKFZ).
+648 ms · no consent
UA analytics.js — shut down July 2024, continues to operate.
+651 ms · no consent
Microsoft Clarity second tag (ktuyny0n5d) + Monsido script.
+4623 ms
Monsido heatmaps.js + tracking — heatmap and session recording.

Declared versus actual

+ FundRaiseUp (fndrsp.net) — not declared
+ Microsoft Clarity (two tags) — not declared
+ Monsido heatmaps — not declared
+ Google Analytics UA (deprecated) — not declared
+ Facebook SDK — not declared
+ Telerik Kendo CDN — not declared
+ FontAwesome CDN — not declared
+ Google Fonts — not declared
+ cdnjs.cloudflare.com — not declared

Transfer timings

+0 ms fndrsp.net

FundRaiseUp — before the page loads.

+220 ms y.clarity.ms

Microsoft Clarity tag 1.

+240 ms connect.facebook.net

Facebook SDK.

+315 ms www.googletagmanager.com

GTM-5QFSQRT.

+648 ms www.google-analytics.com

UA analytics.js — shut down 2024.

+4623 ms heatmaps.monsido.com

Heatmap and session recording.

Detected trackers

Indicators of GDPR non-compliance

Context

The World Health Organization (WHO) is a United Nations specialised agency headquartered in Geneva. It publishes guidance on data protection in healthcare and standards for information security in medical systems. As a UN agency, it holds immunity and falls outside GDPR jurisdiction. The HAR was recorded on the European regional office page (who.int/europe). 202 requests, 21 domains.

fndrsp.net — the first request of the session

fndrsp.net is a domain belonging to FundRaiseUp, a US online donation platform. The first request in the HAR appears at +0 ms — before the browser has begun loading the page. It repeats twice more (+968 ms, +4251 ms). FundRaiseUp powers the WHO donation widget. 15 requests to static.fundraiseup.com per session — the payment infrastructure activates every time the page opens.

Two Microsoft Clarity tags

www.clarity.ms/tag/ekg7xazin3 and www.clarity.ms/tag/ktuyny0n5d — two separate Clarity tags on the same site. Both load without consent. Clarity records mouse movements, clicks, and scrolling. The duplication of tags means that data from every session is sent to Microsoft twice.

Monsido — heatmaps and tracking

heatmaps.monsido.com (+4623 ms) and tracking.monsido.com (+4623 ms) — Monsido, a Danish web analytics and accessibility platform. It loads a heatmap configuration (settings/hLJ4OK61Ms4s7WsE4AzSsQ.json) — this is visitor heatmap recording. Without consent. As with EFTA and Matomo HeatmapSessionRecording — recording user behaviour requires explicit consent.

UA after shutdown — the third time in the series

UA analytics.js (+648 ms) loads and sends a pageview. The third occurrence in the series, following eua.eu and frontex.europa.eu. GA4 (G-WKG4M0MSB8) runs in parallel. Two GA counters, one of them deprecated.

Telerik Kendo — corporate JS CDN

kendo.cdn.telerik.com/2021.1.119 — Telerik (Progress Software, USA) CDN for Kendo UI, a corporate JavaScript UI framework. Loads kendo.all.min.js and kendo.timezones.min.js — large libraries (several MB). Visitor IP addresses are transmitted to Telerik/Progress Software (USA).

As a UN agency, WHO holds immunity under the Convention on the Privileges and Immunities of the Specialised Agencies (1947). GDPR does not technically apply. Nevertheless, WHO publishes guidance on the protection of personal data in healthcare and calls on member states to uphold privacy principles — including in the processing of medical data.

Conclusion

WHO — 21 domains, fndrsp.net at +0 ms, two Clarity tags, Monsido heatmaps, UA shut down in 2024, Facebook SDK, Telerik Kendo CDN. An organisation that publishes data protection guidance for the healthcare sector itself runs a full suite of US trackers with no consent banner. UN immunity does not cancel the ethical dimension of the question.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: global/who-int-2026-05-13.har
SHA-256: 8805252f41be7b6fb24ea4719e0bd42aaea4629572b301545f296a5ea322d06a
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — who.int

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website who.int.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) fndrsp.net (+0 ms, FundRaiseUp) — first request of the session, before the page loads. Microsoft Clarity (+220 ms) fires immediately. GTM (+315 ms), UA (+648 ms), Facebook SDK (+240 ms) — all without consent. No banner.

2) Two Microsoft Clarity tags (ekg7xazin3 and ktuyny0n5d) — duplication. UA was shut down in July 2024 and continues to operate. Monsido heatmaps (+4623 ms) — session and heatmap recording without consent.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/who-int/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Jurisdiction determined under Art. 3(2) GDPR —

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — who.int

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website who.int.

2. Circumstances
I visited the website who.int and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) fndrsp.net (+0 ms, FundRaiseUp) — first request of the session, before the page loads. Microsoft Clarity (+220 ms) fires immediately. GTM (+315 ms), UA (+648 ms), Facebook SDK (+240 ms) — all without consent. No banner.

2) Two Microsoft Clarity tags (ekg7xazin3 and ktuyny0n5d) — duplication. UA was shut down in July 2024 and continues to operate. Monsido heatmaps (+4623 ms) — session and heatmap recording without consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/who-int/

3. GDPR provisions I ask you to examine
GDPR Art. 7 / equivalent for WHO; Additional

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]