The federal drug and medical device regulator — a national-level counterpart to EMA. 54 requests, 2 domains (bfarm.de contains only redirects to www). BundesSans served locally. Matomo with an opt-out checkbox. No Matomo requests appear in the HAR. CookieBanner — a proprietary federal CMS module. Full compliance.
Timeline of the leak
Declared versus actual
Context
BfArM (Bundesinstitut für Arzneimittel und Medizinprodukte) is the federal regulator that authorizes the marketing of drugs and medical devices in Germany. It maintains the DiGA-Verzeichnis (digital health app registry) and the Nationales Organspende-Register (national organ donation register). It reports to the Bundesgesundheitsministerium. Sensitivity is high: visitors include medical professionals, patients, and pharmaceutical companies. HAR: 54 requests, 2 domains (one containing only redirects).
Opt-out Matomo — the BND model
BfArM’s policy describes Matomo with opt-out via checkbox: “Sie können sich hier entscheiden… Wenn Sie sich dagegen entscheiden möchten, wählen Sie bitte die entsprechende Option, um den Matomo-Deaktivierungs-Cookie abzulegen.” This is the same opt-out model used by BND and BKA — as opposed to the opt-in model at BMJV, BBK, and BKA. There are no Matomo requests in the HAR: the user has not activated the analytics tool. The legal status of opt-out under TDDDG § 25 remains a matter of discussion at the level of state authorities.
An extensive privacy policy
BfArM’s policy (168,841 characters — the longest in the German series) covers processing types specific to the regulator: AMIce (a drug notification system for the federal states), EudraVigilance (the European adverse-reaction database), the Anzeigenportal, the DiGA-Verzeichnis, and the Organspende-Register. Each service is documented with its legal basis, retention period, and categories of recipients. For social media, the 2-Click-Lösung is used (a two-step activation approach common in Germany): social media widgets do not load when the page opens and are activated only by an explicit click.
BundesSchrift without BundesSansWebItalic
Font set: BundesSansWeb Regular, Bold, Italic, and BundesSerifWeb Bold — without BundesSerif Italic. The standard ITZBund federal platform, with minor variation in the font set.
Conclusion
bfarm.de is the tenth zero result in the German series. The federal drug regulator, which handles medical data, achieves zero external dependency and a correct (by the standards of German state practice) opt-out for Matomo. The extensive privacy policy covers the full spectrum of specific processing types — from regulatory procedures to the DiGA registry.
c58b77c27b8bb36136fb5020f2b50134221acae6d43452002ca6e03775b9c6e7