RU EN
www.
Technical audit · 29.05.2026

bundesfinanzministerium.de

German Federal Ministry of Finance
DE

Federal Ministry of Finance. 42 requests, 1 domain. Matomo with Einwilligung — Addon_ConsentBanner loads 150 ms after Addon_Tracker, but no Matomo requests appear in the HAR. BundesSans + Söhne — both local. No external domains. Full compliance.

Request timeline

+173 ms · load
CSS, JS bundles, jQuery 3.6.0 — all from www.bundesfinanzministerium.de. Topics: Bundeshaushalt, Steuern, Internationales, Europa — financial content, all local.
+438–439 ms · fonts
BundesSerifWeb-Regular, BundesSansWeb-Regular, BundesSansWeb-Bold — the state fonts. Additionally: soehne-kraeftig.woff2 — the commercial typeface Söhne (Klim Type Foundry). All four served locally.
+708 ms · Addon_Tracker
Addon_Tracker.js — a proprietary tracking add-on of the federal platform. Loads locally. No external requests.
+858 ms · Addon_ConsentBanner
Addon_ConsentBanner.js — a proprietary consent banner. Loads after Addon_Tracker. Matomo is not activated — consent has not been given.
No Matomo, no external domains
Not a single request outside www.bundesfinanzministerium.de. Set-Cookie — zero.

Declared versus actual

✓ Matomo — documented with Einwilligung, § 25 Abs. 1 TDDDG — declared
✓ YouTube (videos) — documented with Einwilligung — declared
✓ Flockler Social Media Newsroom — documented — declared
✓ DRH 360° — documented (Virtueller Rundgang) — declared
✓ Newsletter — documented — declared

Context

BMF (Bundesministerium der Finanzen) is the Federal Ministry of Finance, responsible for the federal budget, tax legislation, and financial policy in Germany. HAR: 42 requests, 1 domain.

Addon_Tracker and Addon_ConsentBanner — a proprietary implementation

The Ministry of Finance uses its own JS add-ons for tracking and consent management — Addon_Tracker.js and Addon_ConsentBanner.js — instead of external CMP platforms (OneTrust, Cookiebot). Both are hosted locally on www.bundesfinanzministerium.de. Addon_Tracker loads at +708 ms, Addon_ConsentBanner at +858 ms. There are no Matomo requests in the HAR: consent has not been given, and the analytics tool is not activated. The policy declares Matomo with Einwilligung under § 25 Abs. 1 TDDDG.

Söhne — a commercial typeface, local

Alongside the standard BundesSans and BundesSerif, the site uses soehne-kraeftig.woff2 — Söhne Kräftig from Klim Type Foundry (New Zealand), a commercial typeface licensed for web use. It is hosted locally — as are all the other fonts. No third-party font-service CDN.

Flockler and DRH 360°

The policy mentions Flockler (a social news aggregator) and DRH 360° (a virtual tour of the ministry’s building) — both with Einwilligung as their legal basis. On the homepage in the HAR, neither Flockler nor DRH 360° activates — they apparently load only on specific subpages upon explicit request.

Conclusion

bundesfinanzministerium.de is the eleventh zero result in the German series. A proprietary consent-banner implementation with no external CMP, the commercial Söhne typeface hosted locally, and Matomo with correct opt-in. The Ministry of Finance reproduces the federal privacy standard while adding an unconventional typographic choice, with no compromise to architectural discipline.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/bundesfinanzministerium-de-2026-05-29.har
SHA-256: 6eccbda5ebf8f23db102f1e0fd11645db670afffc452528acf5baababa698699
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bundesfinanzministerium.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bundesfinanzministerium.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-bundesfinanzministerium-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]