Technical audit · 2026-05-29

bmjv.de

German Federal Ministry of Justice

Federal Ministry of Justice — the body publishing Germany's legislation and legal policy. 33 requests, 1 domain. BundesSans v3 served locally. Matomo via ITZBund — opt-in under § 25 Abs. 1 TDDDG. No Matomo appears in the HAR — consent was not given, tracking was not activated. Full compliance.

Timeline of the leak

+113 ms · load
CSS, images, JS — all from www.bmjv.de. Publications (Betreuungsrecht, Patientenverfügung, Patientenrechte) — webp images served locally.
+200 ms · JS
www.bmjv.de/global.js — the only JS file. A minimalist stack.
+308 ms · fonts
www.bmjv.de/static/fonts/BundesSchrift-v3 — BundesSansWeb Regular, RegularItalic, Bold. The state font, version 3, served locally.
+397 ms · cookie banner
www.bmjv.de/CookieBannerJson.html — the configuration of the federal platform's proprietary cookie banner. Matomo does not load — the user has not given consent.
No external domains
Not a single request outside www.bmjv.de. Set-Cookie — zero.

Declared versus actual

Matomo (via ITZBund) — documented under § 25 Abs. 1 TDDDG + Art. 6(1)(a) DSGVO — заявлен
Session cookie + persistent cookie (basket, navigation) — documented as technisch notwendig — заявлен
Log file (Protokolldatei) on ITZBund servers — documented — заявлен

Context

BMJV (Bundesministerium der Justiz) is Germany’s Federal Ministry of Justice. It publishes legislation, legal policy, and consumer brochures (Patientenverfügung, Betreuungsrecht). Runs on the federal bodies’ shared web platform (ITZBund). HAR: 33 requests, 1 domain — the smallest stack among all multi-page German sites in the series.

Correct opt-in implementation

The privacy policy clearly separates three categories of processing: service data (Protokolldatei — service logs on ITZBund servers, Art. 6(1)(e) DSGVO), technically necessary cookies (session cookie, persistent cookie for the basket and banner, § 25 Abs. 2 Nr. 2 TDDDG), and Matomo (Art. 6(1)(a) DSGVO + § 25 Abs. 1 TDDDG — Einwilligung).

CookieBannerJson loads at +397 ms. Matomo is absent from the HAR — the user has not given consent, and tracking is not activated. This is a precise implementation of the documented behavior.

ITZBund as state infrastructure

Matomo is hosted on ITZBund servers — the Informationstechnikzentrum Bund, the federal IT center serving most ministries. Data does not leave Germany’s state infrastructure. The policy states directly: “Die Software wird beim ITZBund gehostet und uns von dort bereitgestellt.” This is analogous to gov.ie’s track.analytics.services.gov.ie — a shared state Matomo instance for the entire federal platform.

Minimalism as a principle

33 requests — the lowest count in the German series among multi-page sites. One JS file, three font files, a proprietary CookieBannerJson. No CDN, no external dependencies, no third-party libraries. For the Federal Ministry of Justice — the body that publishes data protection laws — this is architecture consistent with institutional function.

Conclusion

bmjv.de is the fourth zero result in the German series. Bundespolizei, BAMF, BBK, BMJV — federal bodies spanning law enforcement to justice. All four: one domain, state hosting, BundesDesign fonts served locally, opt-in Matomo via ITZBund, no external dependencies. Germany’s federal platform (BUND platform, ITZBund) forms a systemic privacy standard that is reproduced uniformly.

Evidence
Original (audit)
HAR file: de/bmjv-de-2026-05-29.har
SHA-256: 035085165485acb6774ad4495fadd6aa904dd6b70d87d6ec74a287b776a66093
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.