STAY UP TO DATE: The Effects of the US Foreign Aid Freeze on Freedom House
Expanding Freedom and Democracy
Freedom on the Net 2024

Estonia

Free
92
100
A Obstacles to Access 25 25
B Limits on Content 31 35
C Violations of User Rights 36 40
Last Year's Score & Status
93 100 Free
Scores are based on a scale of 0 (least free) to 100 (most free). See the methodology and report acknowledgements.
Estonia_hero

header1 Key Developments, June 1, 2023–May 31, 2024

Internet freedom is generally robust in Estonia, a consolidated democracy and European Union (EU) member state well-regarded for its pioneering approach to e-government. Protections for user rights and media freedom are strong, and the Estonian government typically places few limits on online content.

  • Estonian authorities continued to block more than 300 websites in accordance with EU sanctions targeting Russian broadcasting activities (see B1).
  • The parliament considered legislation meant to curb hate speech, which passed in a first reading in September 2023 and remained pending at the end of the coverage period (see C2).
  • In December 2023, the Ministry of the Interior abandoned a proposal that would have required real-name registration for prepaid SIM cards (see C4).
  • A civil society investigation published in May 2024 prompted additional concerns that Estonian authorities have access to Pegasus spyware (see C5).
  • The Estonian public sector continued to face a wave of cyberattacks following Russia’s invasion of Ukraine, though effective cybersecurity measures helped to limit the impact of these incidents (see C8).

header2 Political Overview

Estonia’s democratic institutions are generally strong, and both political rights and civil liberties are widely respected. However, about 5 percent of the population remains stateless and cannot participate in national elections. Far-right and Eurosceptic forces have played a vocal role in Estonian politics in recent years.

A Obstacles to Access

A1 1.00-6.00 pts0-6 pts
Do infrastructural limitations restrict access to the internet or the speed and quality of internet connections? 6.006 6.006

In general, there are no infrastructural limitations to internet access in Estonia. According to data from Statistics Estonia, the state statistics agency, 92.9 percent of households had internet connections in 2024.1 According to the EU’s Digital Economy and Society Index (DESI), 77 percent of households were covered by a fixed-line Very High Capacity Network (VHCN) providing fiber-optic or equivalent service in 2023, slightly below the EU average, while mobile broadband uptake reached 90 percent of individuals, in line with the EU average.2

Internet speeds are reliable in Estonia. According to Ookla’s Speedtest Global Index, the median fixed-line broadband download speed stood at 84.65 megabits per second (Mbps) in May 2024, while the median mobile download speed was 104.08 Mbps.3

The government continues to enhance information and communication technology (ICT) infrastructure. The Estonian Recovery and Resilience Plan (RRP) allotted €24 million ($26.2 million) to launching VHCNs in rural areas. These funds are part of a €208 million ($227.3 million) investment project to improve ICT services between 2021 and 2026.4

The availability of 5G mobile service has expanded considerably in recent years. According to the latest DESI statistics, 5G coverage was available to 87 percent of households in 2023,5 compared to 43 percent in 2022.6 Radio frequencies for 5G mobile services were distributed at a series of public auctions after amendments to the Electronic Communications Act were passed by the parliament in November 2021 (see A4).7 Telia, a leading internet service provider (ISP), reported that it had installed more than 500 5G base stations by October 2023.8

A2 1.00-3.00 pts0-3 pts
Is access to the internet prohibitively expensive or beyond the reach of certain segments of the population for geographical, social, or other reasons? 3.003 3.003

There are no significant digital divides in the country. According to DESI, Estonia has one of the highest shares of individuals who use e-government services in Europe (95 percent of internet users),1 and scores 96 out of 100 points for digital public services for citizens, meaning that almost all public services have been digitized.2

In general, internet connections are affordable, though some concerns persist. Estonia’s leading service providers have responded to high inflation and other rising costs by implementing price increases for customers and discontinuing some cheaper service packages.3 In 2023, the International Telecommunication Union (ITU) put the cost of a monthly fixed-line broadband subscription at 0.72 percent of the gross national income (GNI) per capita,4 while 2 gigabytes (GB) of mobile data cost 0.18 percent of the GNI per capita.5 According to the World Bank, Estonia’s GNI per capita was $27,240 as of 2023.6

While there are a variety of packages offering internet service at affordable prices, authorities have acknowledged that very high-speed connections remain relatively unaffordable,7 contributing to low uptake of these services. As of 2023, only 36 percent of all fixed-line broadband subscriptions were for speeds of at least 100 Mbps, which was well below the EU average of 66 percent.8 The market power of Telia, which owns much of the physical infrastructure, has also contributed to higher consumer prices by raising operating costs for independent wholesale ISPs (see A4).9

There is no significant urban-rural digital divide. According to Statistics Estonia, 92.7 percent of households in urban areas had internet connections in 2024, while 93.4 percent of those in rural areas were connected.10

In 2024, slightly fewer men (91.6 percent) used the internet than women (92.9 percent), according to Statistics Estonia.11 There is a larger gap in usage in terms of age: 99.6 percent of 16-to-24–year-olds use the internet, while just 69.7 percent of 65-to-74–year-olds do, per 2024 figures.12

A3 1.00-6.00 pts0-6 pts
Does the government exercise technical or legal control over internet infrastructure for the purposes of restricting connectivity? 6.006 6.006

The government does not exercise technical or legal control over the domestic internet, although the Cybersecurity Act,1 which implemented the EU Network and Information System Directive (2016/1148),2 gives it limited powers to restrict the use of or access to information systems in the event of a cybersecurity incident. As an exceptional and temporary measure, the government can also restrict internet connections in “emergency situations”3 and “states of emergency,”4 though this would not necessarily entail a total shutdown of internet connections. There were no government-imposed restrictions or disruptions to connectivity during the coverage period.

A4 1.00-6.00 pts0-6 pts
Are there legal, regulatory, or economic obstacles that restrict the diversity of service providers? 6.006 6.006

There are no undue legal, regulatory, or economic restrictions on Estonia’s ICT market. The Electronic Communications Act aims to develop and promote a free market and fair competition in telecommunications services.1 Information society services, meaning economic or professional activities involving the processing, storing, or transmitting of information by electronic means upon a recipient’s request, are regulated by the Information Society Services Act (see B3).2

The ICT market is relatively diverse, though in practice it is led by certain large providers. Sweden’s Telia is the largest fixed-line broadband and mobile service provider in Estonia, according to its 2023 annual report.3 Legally, service providers are required to register with the Consumer Protection and Technical Regulatory Authority (TTJA). There is a registration fee depending on the service provided; the amount is regulated by the State Fees Act.4

In recent years, concerns have emerged that the dominance of a few large ISPs has contributed to telecommunications price increases (see A2). In a June 2023 report, the TTJA suggested that Telia be classified as “an undertaking with significant market power in the broadband access wholesale market” in parts of the country, citing wholesale providers’ reliance on Telia’s network infrastructure.5 In July 2024, after the coverage period, the TTJA rejected the notion that it could intervene in the market to counteract price increases by telecommunications companies.6

The distribution of radio frequencies for 5G mobile services was initiated at a public auction in May 2022 after the parliament passed amendments to the Electronic Communications Act in November 2021 (see A1).7 The legislation bans the use of technology from the Chinese company Huawei in Estonian networks and harmonizes consumer rights regulations.8

A5 1.00-4.00 pts0-4 pts
Do national regulatory bodies that oversee service providers and digital technology fail to operate in a free, fair, and independent manner? 4.004 4.004

The main regulatory bodies for the Estonian ICT sector, the TTJA and the Information System Authority (RIA), have a reputation for professionalism and independence. Both bodies operate under the Ministry of Economic Affairs and Communications. The TTJA monitors the fixed-line and mobile broadband markets,1 ensuring compliance with the EU Net Neutrality Regulation (2015/2120),2 which outlines open internet access requirements and user rights relating to electronic communications networks and services. Meanwhile, the RIA manages state ICT resources.3 There were no reported cases of undue interference in the ICT sector or abuse of power by these bodies during the coverage period.

The TTJA has extended its oversight and enforcement mandate in recent years due to EU sanctions on Russian state media (see B1) and other EU regulations that have been transposed into national laws. In March 2024, the parliament introduced amendments to three laws, including the Information Society Services Act, that implement the EU’s Digital Services Act (DSA), designating the TTJA as Estonia’s digital services coordinator (DSC).4 In this role, the TTJA will receive complaints for alleged violations of the DSA, which aims to counteract the spread of illegal content on digital platforms.5 The amendments were enacted in June 2024,6 after the coverage period, and the TTJA officially became Estonia’s DSC on July 1.7

The Estonian Internet Foundation, which represents a broad group of stakeholders in the Estonian internet community, manages Estonia’s top-level domain (.ee).8

B Limits on Content

B1 1.00-6.00 pts0-6 pts
Does the state block or filter, or compel service providers to block or filter, internet content, particularly material that is protected by international human rights standards? 4.004 6.006

The vast majority of political, social, and cultural content is freely available to users. However, during the coverage period, hundreds of websites remained blocked due to EU sanctions imposed in response to Russia’s brutal invasion of Ukraine, which targeted Russian broadcasting activities and licenses.1 According to information provided by the TTJA, 307 websites and 53 television channels remained blocked in Estonia as of May 2024.2

In March 2022, the EU issued Regulation 2022/350, ordering member states to “urgently suspend the broadcasting activities” of the Russian state-controlled network RT and its RT France, RT Germany, RT Spanish, and RT UK channels, as well as the Russian government’s Sputnik news agency, and block their websites because they “engaged in continuous and concerted propaganda actions targeted at civil society.”3 As of February 2024, two years after the Russian invasion, the EU had adopted 13 packages of sanctions.4 Prolonged sanctions include suspending the distribution of a number of Russian news outlets, including RTR-Planeta, Russia 24, and TV Centre International.5

Restrictions on internet content also include a ban on unlicensed gambling websites (see B3). As of March 2024, the Tax and Customs Board (MTA) had more than 1,800 URLs on its list of illegal online gambling sites that Estonian ISPs are required to block.6

B2 1.00-4.00 pts0-4 pts
Do state or nonstate actors employ legal, administrative, or other means to force publishers, content hosts, or digital platforms to delete content, particularly material that is protected by international human rights standards? 3.003 4.004

Online content is sometimes removed following a court order, although this is not a widespread issue. Comments on news websites and discussion boards are also sometimes removed by website administrators. Most popular websites have codes of conduct for the responsible and ethical use of their services and enforcement policies that allow certain content to be taken down.

At times, social media content is removed. Between July and December 2023, Facebook restricted access in Estonia to 82 items for alleged violations of local laws and 100 items that violated EU sanctions on Russian state-controlled media.1 Google received five requests from the Estonian government to remove a total of nine pieces of content during that same period, and removed eight of the requested items.2

Russian social media platforms Odnoklassniki (OK) and Vkontakte (VK) are also popular in Estonia, but their parent companies do not release data about content removal requests.

B3 1.00-4.00 pts0-4 pts
Do restrictions on the internet and digital content lack transparency, proportionality to the stated aims, or an independent appeals process? 4.004 4.004

Restrictions on online content are generally transparent and grounded in the law. The Gambling Act, one of the few laws that imposes restrictions, requires domestic and foreign gambling websites to obtain a special license.1 Unlicensed websites are subject to blocking by the MTA (see B1). The MTA’s list of blocked websites is transparent and available to the public.

Under the Information Society Services Act and pursuant to the DSA, which fully entered into force in February 2024,2 service providers are generally not liable for illegal content transmitted by users, with limited exceptions. Online platforms are liable for illegal content if they fail to remove or restrict access to such content once they become aware of it.3

Previous actions have reinforced intermediary liability in certain circumstances. In 2015, the European Court of Human Rights (EctHR) upheld a controversial 2009 Estonian Supreme Court decision in the case of Delfi v. Estonia, which established intermediary liability for third-party defamatory comments on news sites.4 In December 2021, the EU Directive on Copyright in the Digital Single Market (2019/790) was adopted into Estonian law.5 The directive, among other things, establishes ancillary copyright for digital publishers and makes “online content sharing service providers” partially liable for copyright violations on their platforms.6

In January 2024, it was reported that the Ministry of Justice sought to amend Estonian copyright law to allow the TTJA, under certain circumstances, to order ISPs to block websites in Estonia that violate intellectual property rights, even if such content is hosted outside the country.7 The proposal was not enacted by the end of the coverage period.

Estonia adopted the EU Audio-Visual Media Services Directive (AVMSD) (2018/1808)8 in March 2022.9 The AVMSD requires “video-sharing platform services” to take “appropriate measures” to protect minors from content “which may impair their physical, mental or moral development,” and the general public from content involving child sexual abuse, racism, or xenophobia as well as content inciting hatred, terrorism, or violence.10 According to the AVMSD, service providers must apply for a license to operate, submit reports on the structure of the program, and disclose their ownership structure. The regulatory changes mainly affect Estonian audiovisual media service providers.11

The Information Society Services Act, originally enacted in 2004, allows the government to impose unspecified restrictions on foreign-based information society services. Under the law, restrictions on such services are allowed in cases “justified by morality, public order, national security, public health and consumer protection.”12 The law places further conditions on these restrictions, including that they be imposed on a specific service, that they are “proportionate to its purpose,” and that Estonian authorities appeal to the applicable country to impose a restriction before doing so themselves.

The Information Society Services Act permits authorities to block online content in certain circumstances, particularly in the context of Russia’s invasion of Ukraine. Amendments to the act that took effect in August 2022 empower the TTJA to order service providers to block domains containing material that “incites hatred, violence or discrimination” or “incites or justifies war crimes” when such measures are necessary for national security and no other avenues to counter the spread of the information exist.13 According to a government press release, the amendments were meant to “ensure the existence of domestic measures” to restrict content that “is used to shape the attitudes of people living or staying in Estonia as part of informational influence activities directed against Estonia.”14 The law also amended the Cybersecurity Act to update Estonia’s cybersecurity framework (see C8).

Decisions to restrict content can be appealed to the courts. In July 2023, the Administrative Court of Tallinn ruled that the TTJA had the legal mandate to block Russian state-linked domains and television stations, and that the constitutional right to free expression was not harmed by the decision.15

According to Section 51 of Estonia's Media Services Act, the TTJA has the right to prevent the retransmission of a foreign audiovisual media service if it has “harmed the public health and the security of society, including national security and defense.”16 An audiovisual media service is defined by the law as one “with the main purpose of providing informative, educational or entertainment programs to the public via an electronic communication network.”

B4 1.00-4.00 pts0-4 pts
Do online journalists, commentators, and ordinary users practice self-censorship? 4.004 4.004

In general, self-censorship is not prevalent, and online debates are active and open.

Estonians value freedom of speech highly. According to a Eurobarometer survey conducted in March 2023, Estonians believe that protecting freedom of speech should be one of the most important priorities of the European Parliament.1

Reporters Without Borders’ 2024 Press Freedom Index ranks Estonia as the sixth freest country out of 180 measured. Press freedom is guaranteed in both legal and political spheres. However, journalists may self-censor in response to cyberbullying or because of potential penalties from antidefamation legislation (see C2). According to the report, online threats by private individuals have increased, though police tend to be notified of and investigate the most serious instances.2

B5 1.00-4.00 pts0-4 pts
Are online sources of information controlled or manipulated by the government or other powerful actors to advance a particular political interest? 3.003 4.004

Manipulation of the online information landscape continued during the coverage period, especially concerning Russia’s full-scale invasion of Ukraine. Soon after the invasion, false information about Ukrainians attacking Russians in Estonia was shared across Facebook and Instagram.1 In August 2022, Estonian authorities acknowledged that the spread of disinformation, which often sought to stigmatize Ukrainian refugees living in the country, had increased significantly since the invasion, particularly on Telegram.2

Russian information campaigns have historically sought to manipulate public opinion in Estonia.3 A post spread on social media in March 2024 used statistics published on the Russian Ministry of Defence’s Telegram channel to falsely claim that Estonia had sent 190 “mercenaries” to fight in Ukraine. Though the post had limited reach, fact-checkers labelled it as “Russian propaganda.”4

Generally, disinformation is evident in online channels. In September 2020, the Global Disinformation Index (GDI) found that one quarter of Estonian media sites presented a high risk of spreading disinformation to their online readers. Some of these sites were based in Russia, and they were not part of Estonia’s mainstream media market.5

B6 1.00-3.00 pts0-3 pts
Are there economic or regulatory constraints that negatively affect users’ ability to publish content online? 3.003 3.003

There are few economic or regulatory barriers to posting content online. News websites do not need to register with the government to operate.1

In line with the EU, Estonia supports net neutrality. Providers found to be in violation can be fined up to €9,600 ($10,492).2 Estonia has not implemented separate rules on net neutrality and follows the EU’s regulatory framework on open internet access and user rights relating to electronic communications networks and services.3 The TTJA regularly analyzes the ICT market for zero-rating plans exempting certain websites or applications from data charges that may violate net neutrality, along with other net neutrality infractions; the TTJA’s latest report, in 2022, did not identify any violations.4

B7 1.00-4.00 pts0-4 pts
Does the online information landscape lack diversity and reliability? 4.004 4.004

A diverse range of content is available online. While journalists have raised concerns that media ownership in Estonia remains concentrated, which could limit the diversity of online content, they have also noted that Estonia’s information landscape remains robust for a country of its size.1

In recent years, Estonians have formed initiatives to counteract false narratives and improve the reliability of the online information space (see B5). Propastop, a volunteer-led effort established in 2016,2 aims to improve Estonia’s “information space security” by publicly correcting false and biased information in the media, including inaccurate information shared online.3 While such outlets do commendable work, they have yet to become part of mainstream media consumption in Estonia.

Knowledge of foreign languages among Estonians is high, which facilitates access to diverse content.4

B8 1.00-6.00 pts0-6 pts
Do conditions impede users’ ability to mobilize, form communities, and campaign, particularly on political and social issues? 6.006 6.006

Estonians use social media platforms to share news and information, as well as to generate public discussion about current political issues. No restrictions to online mobilization tools were put in place during the coverage period.

In 2014, the official platform Rahvaalgatus.ee was launched, enabling people to compile petitions, send them to the parliament if they gather at least 1,000 digital signatures, and monitor lawmakers’ responses.1 As of March 2024, 471 petitions had been launched, of which 223 gathered the necessary support to be sent to the parliament or local governments.2 By law, petitions aimed at local governments must gather signatures from at least 1 percent of residents in a given locality to warrant official consideration by the local council.3 By March 2024, over 750,000 authenticated digital signatures had been collected in support of petitions.4

C Violations of User Rights

C1 1.00-6.00 pts0-6 pts
Do the constitution or other laws fail to protect rights such as freedom of expression, access to information, and press freedom, including on the internet, and are they enforced by a judiciary that lacks independence? 6.006 6.006

All citizens have the constitutional rights to freely obtain information and to freely disseminate ideas, beliefs, and facts.1 There are no obstacles to people exercising their right to freedom of expression online.

The judiciary in Estonia is independent, and there have not been any instances of political interference with the judiciary. According to the 2023 EU Justice Scoreboard, 64 percent of Estonians trust the independence of the judiciary, an increase from the 60 percent recorded in the previous year’s survey.2

In June 2023, the Estonian Supreme Court ruled that it was unconstitutional for an Estonian detention center to ban detained asylum seekers from using personal communications devices, confirming a March 2023 administrative court decision. The Estonian Human Rights Centre, which initiated the case, argued that the restrictions on internet access violated the asylum seekers’ rights to freedom of expression and access to information.3

In March 2022, the parliament adopted amendments to the Public Sector Information Act submitted by the Ministry of Justice. The amendments align Estonian law with the EU’s revised Public Sector Information Directive (2019/1024), which governs public access to state data.4

Protections for journalists, which include the right to the confidentiality of sources, are strong.5

C2 1.00-4.00 pts0-4 pts
Are there laws that assign criminal penalties or civil liability for online activities, particularly those that are protected under international human rights standards? 3.003 4.004

On paper, there are few limits on freedom of expression online. Speech that publicly incites hatred, violence, or discrimination on the basis of nationality, race, color, gender, language, origin, religion, sexual orientation, political opinion, or financial or social status, and that results in danger to the life, health, or property of a person, is punishable by a fine of up to €3,200 ($3,497) under the penal code.1 Such speech is also punishable by up to three years in prison if it leads to the “death of a person or results in damage to health or other serious consequences.”

Defamation was decriminalized in 2002.2 Civil defamation cases can be brought under the Law of Obligations Act,3 though damages are usually moderate (see C3).4

Following Estonia’s March 2023 parliamentary elections, the new governing coalition said that it planned to implement stronger legal penalties for hate speech as part of its coalition agreement.5 A bill to do so, which would broaden the conditions under which hate speech would be criminalized in the penal code,6 was introduced in the parliament in June 2023 and passed its first reading in September 2023.7 The European Commission had brought infringement proceedings against Estonia in January 2023 because, in its view, the country had not transposed EU hate speech regulations into national law.8 Debate on the so-called hate speech bill remained ongoing after the end of the coverage period.9

C3 1.00-6.00 pts0-6 pts
Are individuals penalized for online activities, particularly those that are protected under international human rights standards? 6.006 6.006

There were no criminal convictions or detentions for online activities reported during the coverage period.

In January 2024, it was reported that Tarmo Tamm, a member of the parliament, had sued the digital outlet Äripäev in 2023 for allegedly publishing false accusations about him. The outlet had reported on several allegations involving Tamm, including his work on a parliamentary environmental committee and his alleged involvement in conservation-related scandals.1 There were no additional updates on the case reported before the end of the coverage period.

Previously, in April 2022, two Eesti Ekspress journalists, Tarmo Vahter and Sulev Vedler, were fined €1,000 ($1,093) each for publishing an article about alleged money laundering conducted by managers of a major Swedish bank. Eesti Ekspress was also fined.2 The decision prompted pushback from both private and public media organizations in Estonia, as well as from several public officials.3 In June 2022, the fines were dismissed by an appeals court,4 a decision that was later upheld by the Supreme Court in January 2023.5

A previous defamation case concerning two journalists in 2018 prompted the Estonian Data Protection Inspectorate (AKI) to call for “all authors operating in the public sphere,” including social media users, to abide by journalistic principles “when publishing current, social or other public interest texts.”6

C4 1.00-4.00 pts0-4 pts
Does the government place restrictions on anonymous communication or encryption? 4.004 4.004

There are no governmental restrictions on anonymous communication or encryption, and no SIM card registration requirements.1 The Ministry of the Interior shelved plans to mandate real-name registration for prepaid SIM cards in December 2023 after the proposal raised privacy concerns, with the ministry’s internal security undersecretary saying that it was not “justified at this stage.”2

Some major news sites have limited anonymous commenting on their articles in reaction to the establishment of intermediary liability for third-party defamatory comments on internet news portals (see B3).

C5 1.00-6.00 pts0-6 pts
Does state surveillance of internet activities infringe on users’ right to privacy? 5.005 6.006

Score Change: The score declined from 6 to 5 due to a lack of transparency about the government’s procurement and use of commercial products that allow for intrusive surveillance.

Historically, government surveillance has not been intrusive, and the constitution guarantees the right to the confidentiality of messages sent or received.1 Reporting has indicated that authorities have acquired invasive surveillance technologies in recent years, though the extent to which these technologies are used remains unclear.

The Estonian legal framework includes robust safeguards against intrusive surveillance. Parliament’s Security Authorities Surveillance Select Committee oversees surveillance and security agencies. The committee monitors the activities of these bodies to ensure conformity with the constitution, the Security Authorities Act,2 and other regulations, which include necessity and proportionality requirements. Additionally, Chancellor of Justice Ülle Madise, who serves as the state ombudsperson, verifies the lawful operation of state agencies that organize the interception of phone calls and conversations, surveil correspondence, and otherwise covertly collect, process, and use personal data. The chancellor’s most recent annual report, analyzing surveillance files opened by the Estonian Internal Security Service (KAPO) between 2020 and 2022, found that the agency’s surveillance activities were conducted with due authorization and in accordance with the law.3

The Office of the Prosecutor General monitors surveillance activities and reports regularly to the parliamentary select committee. In its annual report for 2023, the prosecutor’s office disclosed that law enforcement bodies had been granted permission to use surveillance tools in 999 cases; 47 percent were granted by courts and 53 percent by the prosecutor’s office. Wiretapping was authorized in 378 cases.4

While the Estonian Defence Forces are legally authorized to conduct surveillance in certain circumstances,5 the Chancellor of Justice reported that the Military Police have not done so in recent years because “there has been no need for this.”6

It is suspected that the Estonian government has access to Pegasus spyware, a surveillance tool developed by the Israel-based company NSO Group. The New York Times reported that the government began negotiations to purchase Pegasus in 2018. The following year, the Israeli Ministry of Defense prohibited Estonian authorities from using Pegasus to target Russian devices, but there is no indication that Israel prevented the spyware’s sale to Estonia altogether.7

During the coverage period, a May 2024 joint investigation by Access Now, the Citizen Lab, and independent expert Nikolai Kvantaliani served as further confirmation that Estonian authorities had acquired Pegasus. The investigation documented seven EU-based Belarusian, Israeli, Latvian, and Russian journalists and activists who were targeted with Pegasus. While the report did not confirm that the Estonian government was responsible, the Citizen Lab noted that “Estonia does appear to use Pegasus extensively outside their borders, including within multiple European countries.”8

Responding to the May 2024 investigation, Ants Frosch, the former head of the Estonian Foreign Intelligence Service (VLA), said it was “conceivable” that foreign intelligence agencies would ask Estonian authorities to conduct surveillance on their behalf, but claimed that the allegations were “pure speculation.”9 Harrys Puusepp, the head of bureau at KAPO, would neither confirm nor deny that Estonia is a Pegasus user, instead emphasizing “that Estonia is a state governed by the rule of law.”10

A December 2020 investigation by Citizen Lab identified the Estonian government as a likely client of Circles, a surveillance company that allows customers to monitor calls, texts, and cell phone geolocation by exploiting weaknesses in mobile telecommunications infrastructure.11 Following the revelation, the Ministry of Defence refused to comment.12

C6 1.00-6.00 pts0-6 pts
Does monitoring and collection of user data by service providers and other technology companies infringe on users’ right to privacy? 4.004 6.006

Estonia has strong laws protecting citizens’ personal information, although service providers are mandated to retain user data. The General Data Protection Regulation (GDPR) (2016/679), which came into force in all EU member states in May 2018,1 puts limits on how interested parties can use and store Estonians’ data.

Estonia’s Personal Data Protection Act (PDPA) was amended in 2018 and entered into force in January 2019.2 The law contains the provisions left by the GDPR to EU member states' legislation, which includes certain exceptions like those identifying instances when the media can use personal data if it is in the public interest. Laws regulating databases and data collection by public and private registries were also updated during this process. The AKI is the supervisory authority for the PDPA.3 A February 2023 assessment by the National Audit Office found that officials’ access to two databases operated by the Social Insurance Board, which oversees social security benefits, was too broad, creating potential for misuse.4

Service providers are required to collect and retain a substantial amount of metadata. These requirements were established under the Electronic Communications Act, which aligned with EU legislation. They were cast into doubt by the Court of Justice of the European Union (CJEU) in 2014, when the court found the European Data Retention Directive (2006/24/EC) to be invalid.5 More recently, an April 2022 ruling by the CJEU found that the “general and indiscriminate retention” of communications data to combat “serious crime” is against EU law.6 Though Estonian telecommunications companies have continued to store metadata within the confines of existing law, the Ministry of the Interior has said that judicial authorization is now required for investigators to access such data.7

Article 111 of the Electronic Communications Act outlines various restrictions on how this data can be stored and used.8 It requires data to be kept for one year, unless there are special circumstances determined by the government that justify keeping it longer, such as maintaining public order and national security. Article 112 regulates how requests by law enforcement authorities or other agencies can be made in relevant situations, such as criminal investigations, as provided by law. These requests for data are kept by the requesting agency for two years. Article 112 also stipulates that operators shall inform the TTJA of requests made and measures undertaken.

The Electronic Communications Act has been criticized for allowing requests for metadata in too many situations. While Estonia’s chancellor of justice has found that the system does not contradict constitutional guarantees, the office has questioned the proportionality of the law.9 Pursuant to the Electronic Communications Act, the Cybersecurity Act also requires companies to monitor communications, mainly to ensure the security of their own systems; companies are required to inform the RIA of “actions or software compromising the security of the system.”10

The chancellor of justice can make suggestions regarding data protection. In her 2022 annual report, the chancellor of justice noted that her office’s earlier proposals to better protect the fundamental rights of Estonians during surveillance operations had been implemented by authorities (see C5).11

C7 1.00-5.00 pts0-5 pts
Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in relation to their online activities? 5.005 5.005

There have been no registered physical attacks against users or online journalists, though online discussions are sometimes inflammatory. Both critics and supporters of the far-right Conservative People’s Party of Estonia (EKRE) have faced online harassment, including threats of violence, for their views.1 Online harassment can be reported to social media administrators or to the police, which has a designated web patrol unit with a presence on Facebook.2 Cyberbullying remains a particular concern for young people in Estonia.3

In recent years, several defamation cases have incited public debate on the accepted code of conduct in the digital space and the appropriate sanctioning for breaches such as verbal threats, intimidation, and harassment.4

In October 2020, the European Commission launched infringement proceedings against Estonia, as the country had not criminalized public incitement to violence or hatred directed at vulnerable groups.5 After the Commission sent another notice to Estonia in January 2023,6 a proposal to broaden the criminalization of hate speech remained under consideration during the current coverage period (see C2).

C8 1.00-3.00 pts0-3 pts
Are websites, governmental and private entities, service providers, or individual users subject to widespread hacking and other forms of cyberattack? 3.003 3.003

Estonia is well-regarded for its commitment to cybersecurity and has developed effective resilience strategies in recent years.1 Despite this, cyberattacks pose an ongoing threat to government agencies and private entities.

Cyberattacks originating from Russia have intensified following Russia’s full-scale invasion of Ukraine,2 though the attacks’ impact has been limited by their low level of sophistication and by countermeasures taken by Estonian cybersecurity specialists. In March 2024, a few dozen websites belonging to governmental entities, including the Ministry of Justice and the Police and Border Guard Board, were targeted by what was reportedly “the largest wave” of distributed denial-of-service (DDoS) attacks that Estonia had experienced to that point. According to the RIA, successful countermeasures limited the impact of the cyberattack, which authorities attributed to pro-Kremlin actors, to only “brief disruptions” or slower connections to the targeted sites.3

During the previous coverage period, in August 2022, the Russian hacker group Killnet claimed responsibility for a DDoS attack against more than 200 public and private institutions in Estonia. Estonian authorities said the cyberattack was repelled and targeted websites remained available “with some brief and minor exceptions.”4 In March 2024, the RIA warned that DDoS attacks, many of them politically motivated, were likely to continue over the next year and were becoming more technically sophisticated.5

Private entities, including in the health-care sector, have also been targeted by recent cyberattacks. In November 2023, the genetic testing company Asper Biogene reported to authorities that 33 GB of personal data—encompassing 100,000 data items belonging to 10,000 people, including paternity and fertility tests—had been compromised in a cyberattack.6 It was reported in October 2023 that one quarter of family medical centers in Estonia have faced cyberattacks, with an even greater number failing to meet cybersecurity requirements.7

Estonia’s cybersecurity strategy is built on strong private-public collaboration and a unique voluntary structure through the Estonian Defence League’s Cyber Defence Unit.8 In November 2023, members of the RIA’s “cyber reserve”—which includes the Estonian Defence League’s unit—held a training exercise that simulated a cyberattack against a telecommunications company and an electricity provider.9

As an additional measure to ensure the security of public electronic data, Estonia established the first of several planned “data embassies” in 2019. This first embassy, based in Luxembourg, stores servers containing public data and information systems critical to the functioning of the state, including Estonia’s state gazette, land registry, and business register, that are accessible via the cloud. This enables the Estonian state to function in the event of a cyberattack or other political crisis within the country that could endanger data stored on servers within its national borders.10 The bilateral agreement between the two governments to establish the embassy was signed in June 2017 and it was ratified by both parliaments. The data embassy is granted the same privileges bestowed upon traditional embassies.11

The Cybersecurity Act implements the Network and Information System Directive on measures for a high common level of security of network and information systems.12 It includes requirements to have a computer security incident response team (CSIRT) and a competent national network and information security (NIS) authority (which Estonia already had) and strengthens cooperation among EU member states. Businesses identified as operators of essential services are required to take appropriate security measures and to notify relevant national authorities of serious incidents.13

In July 2022, the parliament approved amendments to the Cybersecurity Act that designate the TTJA as the national cybersecurity certification authority and allow the government to implement additional cybersecurity regulations,14 including the Estonian Information Security Standard (E-ITS).15 The law, which entered into force in August 2022, also amends the Information Society Services Act to enable the TTJA to restrict online content (see B3).

The North Atlantic Treaty Organization (NATO) Cooperative Cyber Defence Center of Excellence (CCDCOE) is located in Tallinn.16 Since its founding in 2008, the center has supported awareness campaigns and academic research and has hosted several high-profile conferences, among other activities. The center organizes an annual International Conference on Cyber Conflict (CyCon), bringing together international experts from governments, the private sector, and academia with the goal of ensuring the development of a free and secure internet.

On Estonia

See all data, scores & information on this country or territory.

See More

Country Facts

  • Population

    1,349,000

  • Global Freedom Score

    96 100 free

  • Internet Freedom Score

    91 100 free

  • Freedom in the World Status

    Free

  • Networks Restricted

    No

  • Websites Blocked

    Yes

  • Pro-government Commentators

    No

  • Users Arrested

    No