RU EN
www.
Technical audit · 29.05.2026

berlin.de

Official Portal of the State of Berlin
DE

Policy changed — see what exactly · 2026-09-10 →

Official portal of Berlin. 39 requests, 2 domains — both Berlin-owned. Mapp Intelligence (Webtrekk) loads with no banner, based on Art. 6(1)(e). The policy warns that data may be transferred to the USA. Fonts served locally. The first violator in the German series outside the federal level.

Request timeline

+139 ms · load
CSS, JS bundles, SVG logos — all from www.berlin.de. Fonts (woff2) are part of the bundle — served locally.
+179 ms · Webtrekk tag
www.berlin.de/-wt-safetag.js — the Mapp Intelligence / Webtrekk tracking tag loads without consent.
+408 ms · tracking request
w7.berlin.de/wto_sp611xda1 — a Webtrekk tracking request with full session parameters. Status 0 — blocked by the browser.

Declared versus actual

✓ Mapp Intelligence / Webtrekk — documented with Art. 6(1)(e) and an opt-out cookie — declared
✓ IP anonymization — documented — declared
✓ Potential transfer to the USA — a warning in the policy — declared
✓ YouTube, Vimeo, Windy Widgets — documented (2-Klick-Lösung) — declared
✓ Amazon SES for the newsletter — documented (EU servers) — declared

Transfer timings

+179 ms www.berlin.de

/-wt-safetag.js — the Mapp Intelligence tag.

+408 ms w7.berlin.de

wto_sp611xda1 — Webtrekk tracking request. cg2, la=ru, pu=https://www.berlin.de/.

Detected trackers

Indicators of GDPR non-compliance

Context

berlin.de is the official internet portal of Berlin, operated by BerlinOnline GmbH. The portal covers city services, events, politics, and administration. HAR: 39 requests, 2 domains — www.berlin.de and w7.berlin.de (the Webtrekk subdomain of Berlin’s infrastructure).

Mapp Intelligence — state level vs. federal standard

At the federal level, all ten previous sites in the series showed either a zero result or used opt-in/opt-out Matomo via the state ITZBund infrastructure. berlin.de — the first state-level site — departs from this standard: it uses Mapp Intelligence (Webtrekk GmbH) with no consent banner, based on Art. 6(1)(e) DSGVO.

Webtrekk GmbH (Schönhauser Allee 148, 10435 Berlin) is a German company, but the policy discloses directly that it belongs to Mapp Digital US (USA). The policy warns: “US-Recht angewendet werden kann,” adding that the provider has given a contractual assurance excluding data transfer to the USA — without naming a specific mechanism (SCC Art. 46(2)(c) or otherwise). By EDPB standards, a contractual assurance with no specific mechanism named is not a sufficient legal basis for a transatlantic transfer.

wt-safetag.js — a tracking tag with no external load

-wt-safetag.js loads from www.berlin.de (+179 ms) — meaning the Webtrekk tag is hosted locally on Berlin’s own server, rather than from code.webtrekk.com or a similar external CDN. This reduces the tracker’s visibility in the HAR, but does not change the fact that a tracking request is initiated to w7.berlin.de at +408 ms.

Applying public interest (lit. e) as the basis for analytics without consent is practiced by a number of German state authorities — but without a unified position from supervisory bodies. The DSK (the conference of German data protection supervisory authorities), in its guidance on TDDDG § 25, consistently states the need for consent for cookies that are not technically necessary, including analytics cookies. Applying Art. 6(1)(e) does not exempt processing from the requirements of § 25 TDDDG when cookies are used.

What is done correctly

Fonts are hosted locally as part of the webpack bundle. YouTube, Vimeo, and Windy widgets are implemented via 2-Klick-Lösung (two-step activation). Amazon SES for the newsletter uses EU servers. The policy is detailed, naming all services specifically with addresses.

Conclusion

berlin.de is the first site with findings in the German series: Mapp Intelligence with no banner, potential transfer to the USA, and Art. 6(1)(e) used as a legal workaround for the consent requirement. The pattern echoes bmv.de (etracker + DNT) and ard.de (Piano Analytics + public mandate), but adds an American jurisdictional problem on top. The gap between the federal standard (ITZBund platform, zero domains) and this state-level portal is plainly visible.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/berlin-de-2026-05-29.har
SHA-256: 77501c41466ee9b7d5a88cf4261a9a48c9a619cf8826466ae224ee43cbc49a7a
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — berlin.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website berlin.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) www.berlin.de/-wt-safetag.js (the Webtrekk tracking tag) loads at +179 ms with no cookie banner and no consent. w7.berlin.de/wto_sp611xda1 (+408 ms) initiates a tracking request with session parameters (cg2, la, p, pu, cs802). The request is blocked by the browser (status 0), but it is initiated by JS. The policy applies Art. 6(1)(e) DSGVO (öffentliche Interessen / Öffentlichkeitsarbeit) with no banner. DNT is not mentioned — only an opt-out cookie.

2) The policy explicitly warns: 'Webtrekk GmbH als Betreiber des Dienstes zum Firmenverbund der Mapp Digital US mit Sitz in den USA gehört und US-Recht angewendet werden kann.' Data may be transferred to the USA. The legal basis stated for the transatlantic transfer: 'Ausschluss von Datenübertragungen... ist uns zugesichert worden' — a contractual assurance from the provider, with no specific mechanism named (SCC, BCR, or otherwise).


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-berlin-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — berlin.de

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website berlin.de.

2. Circumstances
I visited the website berlin.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) www.berlin.de/-wt-safetag.js (the Webtrekk tracking tag) loads at +179 ms with no cookie banner and no consent. w7.berlin.de/wto_sp611xda1 (+408 ms) initiates a tracking request with session parameters (cg2, la, p, pu, cs802). The request is blocked by the browser (status 0), but it is initiated by JS. The policy applies Art. 6(1)(e) DSGVO (öffentliche Interessen / Öffentlichkeitsarbeit) with no banner. DNT is not mentioned — only an opt-out cookie.

2) The policy explicitly warns: 'Webtrekk GmbH als Betreiber des Dienstes zum Firmenverbund der Mapp Digital US mit Sitz in den USA gehört und US-Recht angewendet werden kann.' Data may be transferred to the USA. The legal basis stated for the transatlantic transfer: 'Ausschluss von Datenübertragungen... ist uns zugesichert worden' — a contractual assurance from the provider, with no specific mechanism named (SCC, BCR, or otherwise).

Full technical documentation is published at: https://gdpru.eu/en/audits/de-berlin-de/

3. GDPR provisions I ask you to examine
GDPR Art. 7; TDDDG § 25 — Mapp Intelligence without a consent banner; GDPR Art. 44–46 — data transfer to the USA

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]