What happens when a state institution that already harmed citizens through data misuse appears to collect, route, and retain behavioural data from those same citizens again?

2025-11-28 · Source: Pascal’s Substack · Field: Government & Public Sector — Public Policy & Governance, Regulatory & Compliance, Artificial Intelligence & Machine Learning · Depth: Intermediate, long

Summary

A report by Hackedemia alleges that the Dutch Tax Administration's recovery website, "herstel.toeslagen.nl," for victims of the childcare benefits scandal, transmits sensitive user data to Adobe in the United States. This includes page visits, search queries, chatbot inputs, and feedback text, routed via CNAME cloaking to appear as first-party traffic. The report, verified through HAR captures, DNS checks, and JavaScript analysis, claims persistent Adobe Experience Cloud IDs are used for up to two years, enabling behavioral profiling. This practice is particularly concerning given the site's purpose to rebuild trust with financially vulnerable and traumatized citizens previously harmed by the state's data misuse, and contradicts a December 2023 statement by the Belastingdienst about disabling Adobe cookie functionality.

Key takeaway

For CTOs and public sector executives overseeing digital services, this report highlights the critical need for absolute transparency and data minimization on sensitive government platforms. You must rigorously audit all third-party tracking, especially for vulnerable populations, and ensure your public statements align with actual technical implementations. Prioritize rebuilding trust through verifiable data restraint, publishing comprehensive DPIAs, and providing clear, auditable data governance for all citizen-facing systems.

Key insights

Institutional data misuse can recur through opaque tracking, undermining trust in state recovery efforts.

Principles

• Trust repair demands data restraint and transparency.
• Public-sector data ethics requires necessity and proportionality.
• Challenge the full data supply chain, not just AI outputs.

Method

The report's verification method involved HAR captures, DNS checks, JavaScript analysis, and a scanner to distinguish hard evidence from circumstantial evidence and interpretation regarding tracking infrastructure.

In practice

• Preserve interaction evidence when challenging automated systems.
• Request your data, including scores and logs, from automated systems.
• Escalate collective harm to regulators or civil-society groups.

Topics

• Dutch Tax Administration
• Childcare Benefits Scandal
• Behavioral Data Tracking
• Adobe Experience Cloud
• CNAME Cloaking

Best for: CTO, Executive, VP of Engineering/Data, AI Ethicist, Policy Maker, Legal Professional

Related on AIssential

• The complaint by Just Futures Law is formally a FOIA case, but substantively it challenges the secrecy around ICE, DHS, DOGE and Palantir tools. — Opaque data-fusion systems enabling coercive state action demand transparency for public accountability and legal assessment.
• Fault Lines: Navigating Ethics and Responsible AI Where National Policy Meets Local Practice in Public Sector Transformation — Implementing responsible AI in UK public services faces critical national-local policy gaps and five interconnected challenges.
• The governance reckoning: How tax departments must prepare for the new era of mandatory compliance — Corporate tax compliance now demands real-time data, robust governance, and demonstrable processes, not just accurate filings.
• Trump's plan to redesign every .gov website leads to AI-designed horrors — The rapid, AI-driven overhaul of government websites by NDS has resulted in significant usability, accessibility, and privacy failures, hindering its core mission.
• The AI Ethics Brief #190: The Data We Leave Behind — Data reuse without consent and AI-generated misinformation erode trust and highlight critical governance gaps.
• Digital monitoring is growing in South Africa’s public service – regulation needs to catch up — Rapid digital tool adoption in public sector evaluation outpaces ethical governance, creating risks for citizens and data integrity.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Pascal’s Substack.