ARD — Europe's largest public broadcasting consortium. 39 requests, 5 domains. The TheSansC5s typeface and icons served locally. Piano Analytics sends an event carrying idclient with no consent. ARD relies on Art. 6(1)(e) DSGVO as the basis for audience measurement — a German legal approach disputed by supervisory authorities.
Timeline of the leak
Declared versus actual
Transfer timings
Hoster Player CDN loader.js. customer=ard_de.
Piano Analytics event. s=634411, idclient=mprfynurxuls81va.
Hoster configuration. md5=933738-0acf1ad1.
Hoster get_links_info. Transmits the current URL.
Detected trackers
- Piano Analytics / AT Internet (lnhgdjg.pa-cd.com)
- Hoster Player CDN (player.h-cdn.com, zagent7.h-cdn.com)
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e); TDDDG § 25Piano Analytics (lnhgdjg.pa-cd.com/event?s=634411&idclient=mprfynurxuls81va) loads at +312 ms and sends a tracking event carrying a unique idclient. There is no cookie banner: ARD relies on Art. 6(1)(e) DSGVO (public interest / öffentlich-rechtlicher Telemedienauftrag) as the legal basis for anonymous audience measurement (Nutzungsmessung) with no consent. However, the idclient parameter points to a unique client identifier — this potentially exceeds the 'fully anonymous' measurement claimed in the policy. player.h-cdn.com loads at +76 ms with no consent.
Context
ARD (Arbeitsgemeinschaft der öffentlich-rechtlichen Rundfunkanstalten der Bundesrepublik Deutschland) is Germany’s consortium of public-law broadcasters, bringing together BR, HR, MDR, NDR, Radio Bremen, RBB, SR, SWR, WDR, and Deutsche Welle. Controller for ard.de: Südwestrundfunk (SWR). HAR: 39 requests, 5 domains. 24 to www.ard.de, 10 to images.ard.de, 5 external.
Nutzungsmessung with no consent — a German legal approach
ARD displays no cookie banner and requests no consent for analytics. The legal justification is laid out in the policy: Nutzungsmessung (usage measurement) is carried out on the basis of Art. 6(1)(e) DSGVO, in conjunction with legislative provisions on the öffentlich-rechtlicher Telemedienauftrag — the public-law media mandate.
This approach is specific to German public broadcasting: ARD, ZDF, and Deutschlandradio have a legally established mandate to produce and distribute media content in the public interest. In ARD’s view, measuring reach and usage is an integral part of that mandate and is therefore permissible without user consent. ZDF, MDR, and NDR take the same position.
The position remains disputed: the EDPB and a number of German supervisory authorities point out that TDDDG § 25 requires consent for placing cookies and similar technologies, regardless of the GDPR legal basis relied upon.
Piano Analytics — idclient as a potential identifier
The request to lnhgdjg.pa-cd.com/event?s=634411&idclient=mprfynurxuls81va carries an idclient parameter — a unique identifier for the client session or browser. ARD’s policy describes anonymous Nutzungsmessung with immediate hashing of the IP address: “Ihre IP-Adresse unmittelbar mit Erfassung Ihrer Daten gehasht.” The presence of idclient suggests that Piano Analytics assigns the visitor an identifier that allows repeat visits to be tracked — potentially exceeding the “vollständig anonym” (fully anonymous) mode.
Hoster / h-cdn.com
Hoster GmbH is a German company providing CDN infrastructure for media players. player.h-cdn.com loads the player configuration, and zagent7.h-cdn.com requests link metadata. Both transmit the current page URL. Neither is explicitly mentioned in the supplied policy.
What is done correctly
The TheSansC5s typeface (ARD’s corporate font) is hosted locally. Social media icons are static SVGs, with no external SDKs. No Google Analytics, no GTM, no Meta Pixel, no ad networks. No third-party library CDN. The policy is detailed, structured, and provides specific legal bases for each category of processing.
Conclusion
ard.de applies a distinctly German legal approach to Nutzungsmessung: no banner, based on a public mandate. The architecture is minimalist — two external services. Open question: whether the idclient in the Piano Analytics request makes the measurement personalized within the meaning of TDDDG § 25.
8110bd6b052d9e64a3d97a32d0ead084ab26aea088cccab7c76ac84cc4adb78cWhere to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →
To: Federal Commissioner for Data Protection (BfDI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website ard.de. 2. Circumstances I visited the website ard.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Piano Analytics (lnhgdjg.pa-cd.com/event?s=634411&idclient=mprfynurxuls81va) loads at +312 ms and sends a tracking event carrying a unique idclient. There is no cookie banner: ARD relies on Art. 6(1)(e) DSGVO (public interest / öffentlich-rechtlicher Telemedienauftrag) as the legal basis for anonymous audience measurement (Nutzungsmessung) with no consent. However, the idclient parameter points to a unique client identifier — this potentially exceeds the 'fully anonymous' measurement claimed in the policy. player.h-cdn.com loads at +76 ms with no consent. Full technical documentation is published at: https://gdpru.eu/en/audits/de-ard-de/ 3. Provisions violated GDPR Art. 13(1)(e); TDDDG § 25 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]