RU EN
www.
Technical audit · 29.05.2026

bfarm.de

German Federal Institute for Drugs and Medical Devices
DE

Policy changed — see what exactly · 2026-08-27 →

The federal drug and medical device regulator — a national-level counterpart to EMA. 54 requests, 2 domains (bfarm.de contains only redirects to www). BundesSans served locally. Matomo with an opt-out checkbox. No Matomo requests appear in the HAR. CookieBanner — a proprietary federal CMS module. Full compliance.

Request timeline

+0–35 ms · redirect
http://bfarm.de/ → https://bfarm.de/ (307) → https://www.bfarm.de/ (301). Technical HTTPS and www redirects. No external resources.
+1137 ms · load
CSS, SVG icons — all from www.bfarm.de. Themenbuehne images: TdoT2026, EU flag, Rote-Hand-Brief, DiGA-Verzeichnis, Organspende-Register — medical content, all local.
+1487 ms · JS
www.bfarm.de/global.js — the only JS file. Standard federal platform.
+1770 ms · fonts
BundesSansWeb (Regular, Bold, Italic) and BundesSerifWeb Bold — local, at /static/fonts/BundesSchrift/.
+2810 ms · CookieBanner
www.bfarm.de/CookieBanner.html — the proprietary federal CMS banner. Matomo is not activated — the user has not given consent.
No Matomo, no analytics
Not a single request to external analytics services. Set-Cookie — zero.

Declared versus actual

✓ Matomo — documented with an opt-out checkbox (Matomo-Deaktivierungs-Plugin) — declared
✓ IP anonymization — documented — declared
✓ CookieBanner — a proprietary module, not an external CMP — declared
✓ Social media — documented in a separate section (2-Click-Lösung) — declared

Context

BfArM (Bundesinstitut für Arzneimittel und Medizinprodukte) is the federal regulator that authorizes the marketing of drugs and medical devices in Germany. It maintains the DiGA-Verzeichnis (digital health app registry) and the Nationales Organspende-Register (national organ donation register). It reports to the Bundesgesundheitsministerium. Sensitivity is high: visitors include medical professionals, patients, and pharmaceutical companies. HAR: 54 requests, 2 domains (one containing only redirects).

Opt-out Matomo — the BND model

BfArM’s policy describes Matomo with opt-out via checkbox: “Sie können sich hier entscheiden… Wenn Sie sich dagegen entscheiden möchten, wählen Sie bitte die entsprechende Option, um den Matomo-Deaktivierungs-Cookie abzulegen.” This is the same opt-out model used by BND and BKA — as opposed to the opt-in model at BMJV, BBK, and BKA. There are no Matomo requests in the HAR: the user has not activated the analytics tool. The legal status of opt-out under TDDDG § 25 remains a matter of discussion at the level of state authorities.

An extensive privacy policy

BfArM’s policy (168,841 characters — the longest in the German series) covers processing types specific to the regulator: AMIce (a drug notification system for the federal states), EudraVigilance (the European adverse-reaction database), the Anzeigenportal, the DiGA-Verzeichnis, and the Organspende-Register. Each service is documented with its legal basis, retention period, and categories of recipients. For social media, the 2-Click-Lösung is used (a two-step activation approach common in Germany): social media widgets do not load when the page opens and are activated only by an explicit click.

BundesSchrift without BundesSansWebItalic

Font set: BundesSansWeb Regular, Bold, Italic, and BundesSerifWeb Bold — without BundesSerif Italic. The standard ITZBund federal platform, with minor variation in the font set.

Conclusion

bfarm.de is the tenth zero result in the German series. The federal drug regulator, which handles medical data, achieves zero external dependency and a correct (by the standards of German state practice) opt-out for Matomo. The extensive privacy policy covers the full spectrum of specific processing types — from regulatory procedures to the DiGA registry.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/bfarm-de-2026-05-29.har
SHA-256: c58b77c27b8bb36136fb5020f2b50134221acae6d43452002ca6e03775b9c6e7
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bfarm.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bfarm.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-bfarm-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]