RU EN
www.
Technical audit · 29.05.2026

bauhaus.de

State Foundation Preserving the Bauhaus School's Heritage
DE

Policy changed — see what exactly · 2026-08-21 →

Stiftung Bauhaus Dessau — the state foundation preserving the Bauhaus school's heritage. 81 requests, 3 domains. CookieFirst's no-autoblock mode correctly blocks all trackers before consent. Graebenbach and GraebenbachMono — Bauhaus-designed fonts — served locally. Matomo, YouTube, Meta Pixel — documented, not activated.

Request timeline

+95–118 ms · load
All CSS, JS, images — from www.bauhaus.de. Graebenbach fonts (Regular, Medium), GraebenbachMono (Regular, Light), and the bauhaus.ttf icon font — all local. Swiper, Lottie, Vue.js, Swup — all self-hosted.
+118 ms · CookieFirst JS
www.bauhaus.de/providers/cookiefirst/cookiefirst.js — a CookieFirst wrapper loads locally as a provider.
+161 ms · CookieFirst SDK
consent.cookiefirst.com/consentBanner.no-autoblock.js — the CMP SDK in no-autoblock mode. The banner initializes.
+413 ms · geolocation
edge.cookiefirst.com/prod/location — CookieFirst determines the visitor's country to configure the banner.
No tracking — no-autoblock works
Matomo, YouTube, Meta Pixel, and gomus are not activated. The no-autoblock mode means CookieFirst does not automatically scan and block scripts, but all third-party trackers are wired up with conditional loading on the WordPress side — they do not load without consent. Set-Cookie — zero.

Declared versus actual

✓ Matomo — documented with Einwilligung — declared
✓ YouTube (Google Ireland) — documented with SCC/DPF — declared
✓ Meta Pixel — documented — declared
✓ gomus (online ticketing system) — documented — declared
✓ CookieFirst — documented (Digital Data Solutions B.V., Netherlands) — declared
✓ Friendly Challenge (a CAPTCHA alternative) — documented — declared
✓ Hetzner (hosting) — documented — declared

Transfer timings

+161 ms consent.cookiefirst.com

no-autoblock SDK v3.0.22. Digital Data Solutions B.V., Netherlands.

+413 ms edge.cookiefirst.com

Geolocation for banner configuration. UUID b429fc54.

Detected trackers

Indicators of GDPR non-compliance

Context

Stiftung Bauhaus Dessau is the state foundation preserving the heritage of the famous 1919–1933 design school. Funded by the federal government and the state of Saxony-Anhalt. It manages the original Bauhaus buildings in Dessau — UNESCO World Heritage sites. WordPress with a custom theme. HAR: 81 requests, 3 domains.

Graebenbach — a Bauhaus typeface

The site uses the Graebenbach typeface (Regular, Medium) and GraebenbachMono (Regular, Light), along with the bauhaus.ttf icon font — all hosted locally. Graebenbach is a modern interpretation of Bauhaus constructivist typography, developed specifically for the digital use of the school’s heritage. No Google Fonts, no Adobe Fonts — typographic independence is maintained.

CookieFirst no-autoblock — an architectural choice

The no-autoblock mode means CookieFirst does not scan the HTML for third-party scripts and does not block them automatically. Instead, all trackers are loaded conditionally: WordPress plugins (Matomo, YouTube, Meta) check for the presence of consent in the CookieFirst cookie before loading. This requires more careful configuration, but yields a more predictable result: not a single stray tracker request appears in the HAR.

Friendly Challenge — a privacy-friendly reCAPTCHA alternative

The site uses friendly-challenge/widget.module.min.js — Friendly Challenge from Friendly Captcha GmbH (Munich). Unlike Google reCAPTCHA, Friendly Challenge sets no cookies and transmits no data to the USA: verification tasks are solved mathematically in the browser with no user identification. Hosted locally (/libs-on-demand/). This is a deliberate choice in favor of privacy-friendly CAPTCHA — part of the site’s overall policy.

A detailed privacy policy

The policy (in English) documents Matomo, YouTube (with SCC and DPF), Meta Pixel, gomus (the ticketing system), CookieFirst, Friendly Challenge, and Hetzner hosting in detail. For each service, the address, legal basis, and data-transfer mechanism are stated. The level of documentation is comparable to BSI’s.

Conclusion

bauhaus.de is the twelfth zero result in the German series in terms of actual active tracking. CookieFirst is technically an external domain, but its loading before the banner is unavoidable — a systemic property of any external CMP. All declared trackers (Matomo, YouTube, Meta) are correctly blocked before consent. A state cultural foundation, not part of the federal ITZBund platform, has built a comparable privacy standard using its own tools.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/bauhaus-de-2026-05-29.har
SHA-256: 67bd8849a24e0e480806fb7a73aebea2288806544d491177ee0af64b0a4093a2
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bauhaus.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bauhaus.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) CookieFirst (Digital Data Solutions B.V., Netherlands) loads at +161 ms without user consent. As a consent management platform, CookieFirst processes data about the user's choice: IP address, a device UUID (b429fc54-f214-47ec-94e1-df385802efef), language, and country (edge.cookiefirst.com/prod/location). This is a standard tradeoff: loading the CMP before consent is technically necessary to display the banner. All other trackers (Matomo, YouTube, Meta) are blocked before consent.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-bauhaus-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — bauhaus.de

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website bauhaus.de.

2. Circumstances
I visited the website bauhaus.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) CookieFirst (Digital Data Solutions B.V., Netherlands) loads at +161 ms without user consent. As a consent management platform, CookieFirst processes data about the user's choice: IP address, a device UUID (b429fc54-f214-47ec-94e1-df385802efef), language, and country (edge.cookiefirst.com/prod/location). This is a standard tradeoff: loading the CMP before consent is technically necessary to display the banner. All other trackers (Matomo, YouTube, Meta) are blocked before consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/de-bauhaus-de/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]