Policy changed — see what exactly · 2026-08-21 →
Stiftung Bauhaus Dessau — the state foundation preserving the Bauhaus school's heritage. 81 requests, 3 domains. CookieFirst's no-autoblock mode correctly blocks all trackers before consent. Graebenbach and GraebenbachMono — Bauhaus-designed fonts — served locally. Matomo, YouTube, Meta Pixel — documented, not activated.
Timeline of the leak
Declared versus actual
Transfer timings
no-autoblock SDK v3.0.22. Digital Data Solutions B.V., Netherlands.
Geolocation for banner configuration. UUID b429fc54.
Detected trackers
- CookieFirst CMP (consent.cookiefirst.com, edge.cookiefirst.com)
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e)CookieFirst (Digital Data Solutions B.V., Netherlands) loads at +161 ms without user consent. As a consent management platform, CookieFirst processes data about the user's choice: IP address, a device UUID (b429fc54-f214-47ec-94e1-df385802efef), language, and country (edge.cookiefirst.com/prod/location). This is a standard tradeoff: loading the CMP before consent is technically necessary to display the banner. All other trackers (Matomo, YouTube, Meta) are blocked before consent.
Context
Stiftung Bauhaus Dessau is the state foundation preserving the heritage of the famous 1919–1933 design school. Funded by the federal government and the state of Saxony-Anhalt. It manages the original Bauhaus buildings in Dessau — UNESCO World Heritage sites. WordPress with a custom theme. HAR: 81 requests, 3 domains.
Graebenbach — a Bauhaus typeface
The site uses the Graebenbach typeface (Regular, Medium) and GraebenbachMono (Regular, Light), along with the bauhaus.ttf icon font — all hosted locally. Graebenbach is a modern interpretation of Bauhaus constructivist typography, developed specifically for the digital use of the school’s heritage. No Google Fonts, no Adobe Fonts — typographic independence is maintained.
CookieFirst no-autoblock — an architectural choice
The no-autoblock mode means CookieFirst does not scan the HTML for third-party scripts and does not block them automatically. Instead, all trackers are loaded conditionally: WordPress plugins (Matomo, YouTube, Meta) check for the presence of consent in the CookieFirst cookie before loading. This requires more careful configuration, but yields a more predictable result: not a single stray tracker request appears in the HAR.
Friendly Challenge — a privacy-friendly reCAPTCHA alternative
The site uses friendly-challenge/widget.module.min.js — Friendly Challenge from Friendly Captcha GmbH (Munich). Unlike Google reCAPTCHA, Friendly Challenge sets no cookies and transmits no data to the USA: verification tasks are solved mathematically in the browser with no user identification. Hosted locally (/libs-on-demand/). This is a deliberate choice in favor of privacy-friendly CAPTCHA — part of the site’s overall policy.
A detailed privacy policy
The policy (in English) documents Matomo, YouTube (with SCC and DPF), Meta Pixel, gomus (the ticketing system), CookieFirst, Friendly Challenge, and Hetzner hosting in detail. For each service, the address, legal basis, and data-transfer mechanism are stated. The level of documentation is comparable to BSI’s.
Conclusion
bauhaus.de is the twelfth zero result in the German series in terms of actual active tracking. CookieFirst is technically an external domain, but its loading before the banner is unavoidable — a systemic property of any external CMP. All declared trackers (Matomo, YouTube, Meta) are correctly blocked before consent. A state cultural foundation, not part of the federal ITZBund platform, has built a comparable privacy standard using its own tools.
67bd8849a24e0e480806fb7a73aebea2288806544d491177ee0af64b0a4093a2Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →
To: Federal Commissioner for Data Protection (BfDI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website bauhaus.de. 2. Circumstances I visited the website bauhaus.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) CookieFirst (Digital Data Solutions B.V., Netherlands) loads at +161 ms without user consent. As a consent management platform, CookieFirst processes data about the user's choice: IP address, a device UUID (b429fc54-f214-47ec-94e1-df385802efef), language, and country (edge.cookiefirst.com/prod/location). This is a standard tradeoff: loading the CMP before consent is technically necessary to display the banner. All other trackers (Matomo, YouTube, Meta) are blocked before consent. Full technical documentation is published at: https://gdpru.eu/en/audits/de-bauhaus-de/ 3. Provisions violated GDPR Art. 13(1)(e) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]