Project diary

The home page is lighter: the privacy-policy change calendar has moved to the Policy changes page. The home page keeps the map, the headline figures and the checks. The calendar is one click away from any page: a block in the footer links to it.

The new Company dossiers section brings together everything we have analysed for one company: its websites, its apps, the SDKs embedded in them and its privacy policy. It now covers 100 companies; for 41 of them a website and an app already sit on the same page. We treat a website and an app as one company only when the developer’s domain or the app’s signing certificate matches.

A new app source is connected: RuStore. We use it in guest mode, as section 3.6 of its rules allows: no sign-in and free apps only. From RuStore we take missing app files, app categories and developer details. Popular apps that are not yet in our catalogue now join the analysis queue automatically.

The privacy policy now names the controller: Igor Kuzmin, a private individual. It names Proton AG (Switzerland), which stores the project’s mail and HAR files; the transfer relies on the European Commission adequacy decision. Readers’ letters are kept for 5 years after the last letter. The wording on browser storage has been corrected: a check found the gdpru-theme key in localStorage, which holds the chosen colour theme, and it is now named in the “ePrivacy, Art. 5(3)” section.

The app catalogue queue now includes lists for 34 new countries (268 apps) and 10 thematic lists (117 apps): health, mental health, dating, children, VPN, smart home, cars, religion, politics.

• The HAR check now has a connection graph. It is built from the recording: which code loaded what, and which companies received the data.
• On the graph, services of one company are merged into a single node and large fan-outs are collapsed. Nodes are coloured by the company’s country.
• Recording playback with a timer was added: it shows how many seconds after the page opened the data reached each recipient.
• ID-exchange detection is stricter: request numbers are no longer taken for IDs.
• 7 domains were added to the tracker directory.

• New section “Fixed sites”. The first is palantir.com: violations in April, a re-check in August no longer found them. The original audit is linked from the fixed one.
• The home page shows the number of audits this month and new apps this week.
• The app catalogue has 1,455 cards. The United Kingdom, Switzerland, Norway, Ukraine, Turkey and Australia were added to the queue.
• The site header was cut down to four sections: Audits, Countries, Diary, GDPR articles. The home page tagline is “Website and app data audit”.
• The privacy policy change calendar moved to the home page. Month labels that were shifted relative to the weeks were fixed, as was the scrollbar jitter on hover.
• The “Project diary” appeared: entries since 10 July were moved over from VKontakte and cut down to what was done on the site.
• English versions checked: all 76 audits of the month are translated.
• GDPR articles — a tree by chapter with search and an “expand all” button.
• Article page: paragraphs in frames, the paragraph number as a label, sub-paragraph letters (a), (b)… highlighted in red, extra background removed. In the dark theme the article title is yellow.

• The catalogue of Android apps reached 691 apps. Local apps from Latvia, Lithuania, Russia, the Netherlands and Italy were added; Russia has the most, 109.
• An app’s analysis shows who signed it: the organisation, city and country from the file’s digital signature.
• A daily update monitor was launched: it records which SDKs and permissions appeared or disappeared in a new version.
• On the map, countries are sorted by the number of analysed apps.

A browser fingerprint check was added. The page shows 11 traits of the browser and device: how much each one singles out the user and where it comes from — settings, the system or the hardware. The resulting fingerprint code can be compared after turning on protection, and the result can be saved as a PDF. All calculations run in the browser.

• A browser extension check was added.
• The SDK reader was launched: an APK file is analysed in the browser, showing the embedded SDKs, their owners and the permissions; the file is not sent to the server. The report can be saved as a PDF.
• The first check was the VKontakte app: 22 third-party SDKs from 11 companies, all outside the EEA (USA, Russia, Israel, China), 100 permissions in the manifest.

• Map: a second hub — the Netherlands; country cards no longer cover the country itself.
• All 526 audits were cross-checked: links to HAR files and SHA-256 values match in the Russian and English versions, and screenshots sit under their own captions. The site build now stops if an image is missing.
• For 13 Estonian audits the list of violations was translated into legal Estonian.
• The page of each GDPR article shows in which audits the article was violated and which articles it is most often violated together with (example, in Russian).

A draft generator of DMCA copyright infringement notices was launched — the “Copyright protection” section in the site footer.

• The notice is assembled in the browser following the six required elements of 17 U.S.C. § 512(c)(3).
• Several infringing links can be listed.
• The SHA-256 of the evidence file is calculated locally.
• Links to the DMCA designated agent directory (copyright.gov) and to Google’s removal tool for search results.
• The site’s security policy (CSP) blocked external scripts, so all of the tool’s scripts are hosted on the site itself.

• Letters to companies and complaints to regulators are available in three languages (RU / EN / EST). For 98 Estonian audits there is a ready complaint text in Estonian: AKI accepts complaints only in Estonian.
• The letter fields (name, email, country, date) are filled in the browser and inserted into all letters at once; nothing is sent to the server.
• Next to the print button there are links to DigiDoc4 and RIA DigiDoc for a digital signature.
• Under the letter to the regulator there is a link to the official EDPB complaint template in the language of the relevant country, for all 27 EU countries.
• Policy monitoring: the translation history was cleaned up and the “before/after” comparison display was fixed.
• The preview image for links to the site was updated.
• No feedback form was added: third-party services do not guarantee delivery. Contact is by email from the “Author and contact” section.

A bug in the HAR check was fixed: when cookies were refused, the tool showed “consent given”, because the consent platform sends the same event for both acceptance and refusal.

• Consent is now determined from the decoded TCF string that advertising partners receive.
• If there is no such string in the recording, the status is “undetermined”.
• A flag was added for cases where tracker requests continue while the string says “refused”.
• The consent platform event and the contents of the string are shown side by side.

• The two databases of data recipients — one used by the check on the site, one by the engine for manual audits — were merged into a single directory. Candidates from the open Disconnect and EasyPrivacy lists are added only after a manual review.
• The result of a HAR check can be saved as a PDF with the site name and date.
• Audit cards got a PDF that can be edited offline.
• Almost all pages were translated into English.

• A HAR file check that runs in the browser was launched: the file never leaves the device, and the tool shows who receives the data — ad networks, analytics, consent platforms — as well as the file name and SHA-256.
• The directory of data recipients grew from 44 to 819 companies: ad exchanges, DSPs, SSPs, data brokers, consent platforms. The classification partly relies on the open DuckDuckGo Tracker Radar data.
• A consent timeline was added: the tool finds the moment the consent platform loads and counts tracker requests made before it. If there is no consent platform, this is stated.

The gdpru.eu site went public. It brings together most of the audits for the key countries and publishes the article “Digital surveillance in Russia” (in Russian).

• The project moved to its own server in Switzerland: its own code repository, firewall, protection against password guessing, automatic updates, encryption.
• Monitoring runs automatically: every night 883 privacy policies of European sites are checked. When a policy changes, the system records which paragraph was removed and which was added; a policy disappearing is recorded too. The original policies are stored on external media. Only public data is checked.
• A calendar of policy changes was added.
• Changes in policies in other languages are shown with a Russian translation next to the original. The translation runs locally on the server.

Automatic monitoring of privacy policies has been launched. Every night the system compares each policy with its previous version and records, with a date, when a document is rewritten, removed or hidden. The robot records only the fact of a change and does not judge whether anything is a violation.

The first 96 policies were loaded for a trial run. Some sites block automated access — for example, bundeswirtschaftsministerium.de is protected by the Radware Bot Manager anti-bot system.