Technical audit · 2026-05-29

berlin.de

Official Portal of the State of Berlin

Official portal of Berlin. 39 requests, 2 domains — both Berlin-owned. Mapp Intelligence (Webtrekk) loads with no banner, based on Art. 6(1)(e). The policy warns that data may be transferred to the USA. Fonts served locally. The first violator in the German series outside the federal level.

Timeline of the leak

+139 ms · load

CSS, JS bundles, SVG logos — all from www.berlin.de. Fonts (woff2) are part of the bundle — served locally.

+179 ms · Webtrekk tag

www.berlin.de/-wt-safetag.js — the Mapp Intelligence / Webtrekk tracking tag loads without consent.

+408 ms · tracking request

w7.berlin.de/wto_sp611xda1 — a Webtrekk tracking request with full session parameters. Status 0 — blocked by the browser.

Declared versus actual

✓ Mapp Intelligence / Webtrekk — documented with Art. 6(1)(e) and an opt-out cookie — заявлен

✓ IP anonymization — documented — заявлен

✓ Potential transfer to the USA — a warning in the policy — заявлен

✓ YouTube, Vimeo, Windy Widgets — documented (2-Klick-Lösung) — заявлен

✓ Amazon SES for the newsletter — documented (EU servers) — заявлен

Transfer timings

+179 ms www.berlin.de

/-wt-safetag.js — the Mapp Intelligence tag.

+408 ms w7.berlin.de

wto_sp611xda1 — Webtrekk tracking request. cg2, la=ru, pu=https://www.berlin.de/.

Detected trackers

Mapp Intelligence / Webtrekk (www.berlin.de/-wt-safetag.js, w7.berlin.de)

Indicators of GDPR non-compliance

GDPR Art. 7; TDDDG § 25 — Mapp Intelligence without a consent banner
www.berlin.de/-wt-safetag.js (the Webtrekk tracking tag) loads at +179 ms with no cookie banner and no consent. w7.berlin.de/wto_sp611xda1 (+408 ms) initiates a tracking request with session parameters (cg2, la, p, pu, cs802). The request is blocked by the browser (status 0), but it is initiated by JS. The policy applies Art. 6(1)(e) DSGVO (öffentliche Interessen / Öffentlichkeitsarbeit) with no banner. DNT is not mentioned — only an opt-out cookie.
GDPR Art. 44–46 — data transfer to the USA
The policy explicitly warns: 'Webtrekk GmbH als Betreiber des Dienstes zum Firmenverbund der Mapp Digital US mit Sitz in den USA gehört und US-Recht angewendet werden kann.' Data may be transferred to the USA. The legal basis stated for the transatlantic transfer: 'Ausschluss von Datenübertragungen... ist uns zugesichert worden' — a contractual assurance from the provider, with no specific mechanism named (SCC, BCR, or otherwise).

Context

berlin.de is the official internet portal of Berlin, operated by BerlinOnline GmbH. The portal covers city services, events, politics, and administration. HAR: 39 requests, 2 domains — www.berlin.de and w7.berlin.de (the Webtrekk subdomain of Berlin’s infrastructure).

Mapp Intelligence — state level vs. federal standard

At the federal level, all ten previous sites in the series showed either a zero result or used opt-in/opt-out Matomo via the state ITZBund infrastructure. berlin.de — the first state-level site — departs from this standard: it uses Mapp Intelligence (Webtrekk GmbH) with no consent banner, based on Art. 6(1)(e) DSGVO.

Webtrekk GmbH (Schönhauser Allee 148, 10435 Berlin) is a German company, but the policy discloses directly that it belongs to Mapp Digital US (USA). The policy warns: “US-Recht angewendet werden kann,” adding that the provider has given a contractual assurance excluding data transfer to the USA — without naming a specific mechanism (SCC Art. 46(2)(c) or otherwise). By EDPB standards, a contractual assurance with no specific mechanism named is not a sufficient legal basis for a transatlantic transfer.

wt-safetag.js — a tracking tag with no external load

-wt-safetag.js loads from www.berlin.de (+179 ms) — meaning the Webtrekk tag is hosted locally on Berlin’s own server, rather than from code.webtrekk.com or a similar external CDN. This reduces the tracker’s visibility in the HAR, but does not change the fact that a tracking request is initiated to w7.berlin.de at +408 ms.

The legal debate: Art. 6(1)(e) for web analytics

Applying public interest (lit. e) as the basis for analytics without consent is practiced by a number of German state authorities — but without a unified position from supervisory bodies. The DSK (the conference of German data protection supervisory authorities), in its guidance on TDDDG § 25, consistently states the need for consent for cookies that are not technically necessary, including analytics cookies. Applying Art. 6(1)(e) does not exempt processing from the requirements of § 25 TDDDG when cookies are used.

What is done correctly

Fonts are hosted locally as part of the webpack bundle. YouTube, Vimeo, and Windy widgets are implemented via 2-Klick-Lösung (two-step activation). Amazon SES for the newsletter uses EU servers. The policy is detailed, naming all services specifically with addresses.

Conclusion

berlin.de is the first violator in the German series: Mapp Intelligence with no banner, potential transfer to the USA, and Art. 6(1)(e) used as a legal workaround for the consent requirement. The pattern echoes bmv.de (etracker + DNT) and ard.de (Piano Analytics + public mandate), but adds an American jurisdictional problem on top. The gap between the federal standard (ITZBund platform, zero domains) and this state-level portal is plainly visible.

Evidence

Original (audit)

HAR file: de/berlin-de-2026-05-29.har

SHA-256: 77501c41466ee9b7d5a88cf4261a9a48c9a619cf8826466ae224ee43cbc49a7a

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

To: Federal Commissioner for Data Protection (BfDI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website berlin.de.

2. Circumstances
I visited the website berlin.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) www.berlin.de/-wt-safetag.js (the Webtrekk tracking tag) loads at +179 ms with no cookie banner and no consent. w7.berlin.de/wto_sp611xda1 (+408 ms) initiates a tracking request with session parameters (cg2, la, p, pu, cs802). The request is blocked by the browser (status 0), but it is initiated by JS. The policy applies Art. 6(1)(e) DSGVO (öffentliche Interessen / Öffentlichkeitsarbeit) with no banner. DNT is not mentioned — only an opt-out cookie.

2) The policy explicitly warns: 'Webtrekk GmbH als Betreiber des Dienstes zum Firmenverbund der Mapp Digital US mit Sitz in den USA gehört und US-Recht angewendet werden kann.' Data may be transferred to the USA. The legal basis stated for the transatlantic transfer: 'Ausschluss von Datenübertragungen... ist uns zugesichert worden' — a contractual assurance from the provider, with no specific mechanism named (SCC, BCR, or otherwise).

Full technical documentation is published at: https://gdpru.eu/en/audits/de-berlin-de/

3. Provisions violated
GDPR Art. 7; TDDDG § 25 — Mapp Intelligence without a consent banner; GDPR Art. 44–46 — data transfer to the USA

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]