Technical audit · 2026-05-29

ard.de

Germany's Public Broadcasting Consortium

ARD — Europe's largest public broadcasting consortium. 39 requests, 5 domains. The TheSansC5s typeface and icons served locally. Piano Analytics sends an event carrying idclient with no consent. ARD relies on Art. 6(1)(e) DSGVO as the basis for audience measurement — a German legal approach disputed by supervisory authorities.

Timeline of the leak

+74 ms · resource loading
TheSansC5s-5_Plain, TheSansC5s-7_Bold, TheSansC5s-5_PlainItalic — ARD's typeface, hosted locally.
+76 ms · before the banner
player.h-cdn.com/loader.js?customer=ard_de — the Hoster media player CDN. Loads immediately.
+312 ms · no banner
lnhgdjg.pa-cd.com/event?s=634411&idclient=mprfynurxuls81va — a Piano Analytics tracking event. A unique visitor idclient.
+4376–4597 ms
player.h-cdn.com — player configuration (no_conf, md5). zagent7.h-cdn.com — get_links_info for a specific URL. No cookie banner throughout the entire session.

Declared versus actual

Piano Analytics — mentioned in the policy's Nutzungsmessung section — заявлен
Nielsen Digital Measurement — mentioned in the policy — заявлен
Google Cloud Platform — mentioned in the policy — заявлен
Firebase (Cloud Messaging, Crashlytics) — mentioned in the policy (for apps) — заявлен
Legal basis — Art. 6(1)(e) DSGVO + öffentlich-rechtlicher Telemedienauftrag — заявлен
+ Hoster / h-cdn.com — not explicitly mentioned in the supplied policy — не заявлен

Transfer timings

+76 ms player.h-cdn.com

Hoster Player CDN loader.js. customer=ard_de.

+312 ms lnhgdjg.pa-cd.com

Piano Analytics event. s=634411, idclient=mprfynurxuls81va.

+4376 ms player.h-cdn.com

Hoster configuration. md5=933738-0acf1ad1.

+4597 ms zagent7.h-cdn.com

Hoster get_links_info. Transmits the current URL.

Detected trackers

Indicators of GDPR non-compliance

Context

ARD (Arbeitsgemeinschaft der öffentlich-rechtlichen Rundfunkanstalten der Bundesrepublik Deutschland) is Germany’s consortium of public-law broadcasters, bringing together BR, HR, MDR, NDR, Radio Bremen, RBB, SR, SWR, WDR, and Deutsche Welle. Controller for ard.de: Südwestrundfunk (SWR). HAR: 39 requests, 5 domains. 24 to www.ard.de, 10 to images.ard.de, 5 external.

ARD displays no cookie banner and requests no consent for analytics. The legal justification is laid out in the policy: Nutzungsmessung (usage measurement) is carried out on the basis of Art. 6(1)(e) DSGVO, in conjunction with legislative provisions on the öffentlich-rechtlicher Telemedienauftrag — the public-law media mandate.

This approach is specific to German public broadcasting: ARD, ZDF, and Deutschlandradio have a legally established mandate to produce and distribute media content in the public interest. In ARD’s view, measuring reach and usage is an integral part of that mandate and is therefore permissible without user consent. ZDF, MDR, and NDR take the same position.

The position remains disputed: the EDPB and a number of German supervisory authorities point out that TDDDG § 25 requires consent for placing cookies and similar technologies, regardless of the GDPR legal basis relied upon.

Piano Analytics — idclient as a potential identifier

The request to lnhgdjg.pa-cd.com/event?s=634411&idclient=mprfynurxuls81va carries an idclient parameter — a unique identifier for the client session or browser. ARD’s policy describes anonymous Nutzungsmessung with immediate hashing of the IP address: “Ihre IP-Adresse unmittelbar mit Erfassung Ihrer Daten gehasht.” The presence of idclient suggests that Piano Analytics assigns the visitor an identifier that allows repeat visits to be tracked — potentially exceeding the “vollständig anonym” (fully anonymous) mode.

Hoster / h-cdn.com

Hoster GmbH is a German company providing CDN infrastructure for media players. player.h-cdn.com loads the player configuration, and zagent7.h-cdn.com requests link metadata. Both transmit the current page URL. Neither is explicitly mentioned in the supplied policy.

What is done correctly

The TheSansC5s typeface (ARD’s corporate font) is hosted locally. Social media icons are static SVGs, with no external SDKs. No Google Analytics, no GTM, no Meta Pixel, no ad networks. No third-party library CDN. The policy is detailed, structured, and provides specific legal bases for each category of processing.

Conclusion

ard.de applies a distinctly German legal approach to Nutzungsmessung: no banner, based on a public mandate. The architecture is minimalist — two external services. Open question: whether the idclient in the Piano Analytics request makes the measurement personalized within the meaning of TDDDG § 25.

Evidence
Original (audit)
HAR file: de/ard-de-2026-05-29.har
SHA-256: 8110bd6b052d9e64a3d97a32d0ead084ab26aea088cccab7c76ac84cc4adb78c
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI)file a complaint online →

To: Federal Commissioner for Data Protection (BfDI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ard.de.

2. Circumstances
I visited the website ard.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Piano Analytics (lnhgdjg.pa-cd.com/event?s=634411&idclient=mprfynurxuls81va) loads at +312 ms and sends a tracking event carrying a unique idclient. There is no cookie banner: ARD relies on Art. 6(1)(e) DSGVO (public interest / öffentlich-rechtlicher Telemedienauftrag) as the legal basis for anonymous audience measurement (Nutzungsmessung) with no consent. However, the idclient parameter points to a unique client identifier — this potentially exceeds the 'fully anonymous' measurement claimed in the policy. player.h-cdn.com loads at +76 ms with no consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/de-ard-de/

3. Provisions violated
GDPR Art. 13(1)(e); TDDDG § 25

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]