RU EN
www.
Technical audit · 2026-05-13

who.int

WHO — the UN's Specialized Agency for International Public Health
GLOBAL

WHO — 21 domains, 202 requests. fndrsp.net fires at +0 ms. Two Clarity tags, Monsido heatmaps, FundRaiseUp, Facebook SDK, UA discontinued in 2024 — all with no consent banner. An organization that publishes data-protection guidance for healthcare.

Timeline of the leak

+0 ms · first request
fndrsp.net/tb — the FundRaiseUp tracker. Before the page loads.
+220 ms · without consent
Microsoft Clarity (y.clarity.ms/collect) — the first of two tags. Data to Microsoft, USA.
+237 ms · without consent
Google Fonts — Noto Sans, Source Sans Pro, Roboto. 5 requests. USA.
+237 ms · without consent
FontAwesome CDN (use.fontawesome.com) — v5.15.4. USA.
+240 ms · without consent
Facebook SDK (connect.facebook.net). USA.
+241 ms · without consent
Telerik Kendo CDN (kendo.cdn.telerik.com) — a JS UI framework. USA.
+315 ms · without consent
GTM (GTM-5QFSQRT) and the FundRaiseUp widget (AMEEWKFZ).
+648 ms · without consent
UA analytics.js — discontinued July 2024, continues running.
+651 ms · without consent
A second Microsoft Clarity tag (ktuyny0n5d) + the Monsido script.
+4623 ms
Monsido heatmaps.js + tracking — heatmap and session recording.

Declared versus actual

+ FundRaiseUp (fndrsp.net) — not declared
+ Microsoft Clarity (two tags) — not declared
+ Monsido heatmaps — not declared
+ Google Analytics UA (discontinued) — not declared
+ Facebook SDK — not declared
+ Telerik Kendo CDN — not declared
+ FontAwesome CDN — not declared
+ Google Fonts — not declared
+ cdnjs.cloudflare.com — not declared

Transfer timings

+0 ms fndrsp.net

FundRaiseUp — before the page loads

+220 ms y.clarity.ms

Microsoft Clarity tag 1

+240 ms connect.facebook.net

Facebook SDK

+315 ms www.googletagmanager.com

GTM-5QFSQRT

+648 ms www.google-analytics.com

UA analytics.js — discontinued 2024

+4623 ms heatmaps.monsido.com

Heatmap & session recording

Detected trackers

Indicators of GDPR non-compliance

Context

The World Health Organization (WHO) is a UN specialized agency, headquartered in Geneva. It publishes data-protection guidance for healthcare and information-security standards for medical systems. As a UN agency, it enjoys immunity, sitting outside GDPR jurisdiction. The HAR was captured on the European regional office (who.int/europe). 202 requests, 21 domains.

fndrsp.net — the first request of the session

fndrsp.net belongs to FundRaiseUp, an American online-donation platform. The first request in the HAR fires at the +0 ms mark — before the browser has even started loading the page. It repeats twice more (+968 ms, +4251 ms). FundRaiseUp powers WHO’s donation widget. 15 requests to static.fundraiseup.com per session — payment infrastructure activates on every page load.

Two Microsoft Clarity tags

www.clarity.ms/tag/ekg7xazin3 and www.clarity.ms/tag/ktuyny0n5d — two separate Clarity tags on the same site. Both load with no consent. Clarity records mouse movements, clicks, and scrolling. Duplicate tags mean data for every session is sent to Microsoft twice.

Monsido — heatmaps and tracking

heatmaps.monsido.com (+4623 ms) and tracking.monsido.com (+4623 ms) — Monsido, a Danish web-analytics and accessibility platform. It loads a heatmap configuration (settings/hLJ4OK61Ms4s7WsE4AzSsQ.json) — this records visitor heatmaps. With no consent. As with EFTA’s Matomo HeatmapSessionRecording — recording user behavior requires explicit consent.

UA after retirement — the third instance in the series

UA’s analytics.js (+648 ms) loads and sends a pageview. The third instance in this series, after eua.eu and frontex.europa.eu. GA4 (G-WKG4M0MSB8) runs in parallel. Two GA counters, one of them discontinued.

Telerik Kendo — a corporate JS CDN

kendo.cdn.telerik.com/2021.1.119 — the Telerik CDN (Progress Software, USA), for Kendo UI, a corporate JavaScript UI framework. Loads kendo.all.min.js and kendo.timezones.min.js — large libraries (several MB). Visitors’ IP addresses are transmitted to Telerik/Progress Software (USA).

WHO, as a UN agency, enjoys immunity under the Convention on the Privileges and Immunities of the Specialized Agencies (1947). GDPR technically does not apply. Nonetheless, WHO publishes guidance on protecting personal data in healthcare and calls on member states to uphold privacy principles — including in the processing of medical data.

Conclusion

WHO — 21 domains, fndrsp.net at +0 ms, two Clarity tags, Monsido heatmaps, UA discontinued in 2024, a Facebook SDK, the Telerik Kendo CDN. An organization that publishes healthcare data-protection guidance itself deploys a full stack of American trackers with no consent banner. UN immunity does not remove the ethical dimension of the question.

Evidence
Original (audit)
HAR file: global/who-int-2026-05-13.har
SHA-256: 8805252f41be7b6fb24ea4719e0bd42aaea4629572b301545f296a5ea322d06a
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Jurisdiction determined under Art. 3(2) GDPR — 

To: Jurisdiction determined under Art. 3(2) GDPR
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website who.int.

2. Circumstances
I visited the website who.int and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 13 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) fndrsp.net (+0 ms, FundRaiseUp) — the first request of the session, before the page even loads. Microsoft Clarity (+220 ms) fires immediately. GTM (+315 ms), UA (+648 ms), Facebook SDK (+240 ms) — all with no consent. No banner is present.

2) Two Microsoft Clarity tags (ekg7xazin3 and ktuyny0n5d) — duplication. UA, discontinued since July 2024, continues running. Monsido heatmaps (+4623 ms) — heatmap recording with no consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/who-int/

3. Provisions violated
GDPR Art. 7 / an analogous standard for WHO; Additionally

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]