RU EN
www.

Estonia

Most common findings
Undisclosed data recipients
66%
Stated policy contradicts actual practice
60%
Tracking before consent
49%
Undisclosed transfers outside the EEA
31%
Indicators of invalid consent
13%
Share of this country's audits where the finding appears. Automatic count across 174 published audits; one audit can appear in several rows.
Audits
174

Sites used in this country, including international ones. The prefix in an audit address (for example, ee-) is the country the measurement was made from, not the company's country; the company's country is given in the audit itself.

Context and how to file a complaint

Context

Estonia is the first country in this audit. The choice is not accidental: a small country with ambitious digital infrastructure, mandatory ID-card for every citizen, e-residency programmes attracting international attention. If GDPR violations work on infrastructure with such density of digital identification, this is especially visible.

Working with the regulator: see Cases — correspondence with AKI is published there, including decisions to close cases against AdTech brokers and appeals.

Audits by category

The list below updates automatically as new audits are published. Currently only sites with completed technical analysis are shown.

How to get a response from the company and, if needed, file a complaint with AKI

A complaint to the regulator is the last step, not the first. AKI may refuse to handle a complaint if the person did not first try to resolve the matter directly with the company.

1. Start with a letter to the company. Every audit has a ready-made data access request letter (GDPR Art. 15) — fill in your name and email and it assembles automatically. Send it directly to the company.

2. Give the company 30 days to respond (GDPR Art. 12(3)). If the matter is resolved, no complaint is needed.

3. If there is no response, or it doesn’t fix the violation — file a complaint with AKI. Every audit with identified violations has a ready-made regulator letter at the bottom of the page with RU / EN / EST tabs — switch to the EST tab before sending: AKI only handles submissions in the state language, and the Estonian text is generated automatically, so there is no need to translate it yourself.

4. Sign the letter digitally. AKI only accepts official submissions with a digital signature. The easiest way is via an Estonian ID-card:

  • install the free ID-tarkvara software (includes the DigiDoc4 client) — once per computer;
  • insert your ID-card into a reader, open DigiDoc4, add the letter file, click “Allkirjasta” (sign), enter PIN2;
  • without a physical card or reader, you can sign via Mobiil-ID or Smart-ID instead — same software, same result;
  • the result is a file with the .asice (or .bdoc) extension — a digital signature legally equivalent to a handwritten one.

5. Send it. Attach the signed file to an email to info@aki.ee. If needed, the letter can also be encrypted using DigiDoc3/DigiDoc4.

6. Wait for a response. AKI handles complaints within 30 days, extendable by another 60. If there is still no response after that period, Article 78(2) GDPR gives you the right to go to court.