Technical audit · 2026-05-29

bundesnetzagentur.de

German Federal Network Agency

Germany's federal regulator for telecommunications, energy, and transport networks. 109 requests, 1 domain. No analytics, no banner. Session cookies with no PII. The same rejection-of-tracking formula used by BGH and BfDI: 'Techniken, die es ermöglichen, das Zugriffsverhalten der Nutzer*innen nachzuvollziehen, werden nicht eingesetzt.' Full compliance.

Timeline of the leak

+1757 ms · load
CSS, jQuery, jQuery UI, JS add-ons (bxSlider, stacktable), thematic images (Stromleitung, GAS, Datenportal, Karriere) — all from www.bundesnetzagentur.de.
+1842 ms · fonts
BundesSansWeb Regular, Bold, and BundesSerifWeb Regular — in woff format (not woff2) — local, at /static/fonts/.
No analytics, no banner
No Matomo, no tracker, no ConsentBanner. Session cookies for navigation — no personal data. Set-Cookie — zero.

Declared versus actual

Session cookies — documented as temporary, with no PII — заявлен
IP anonymization in the log file (Protokolldatei) — documented — заявлен
Keine Tracking-Techniken — an explicit declaration — заявлен
Newsletter — documented with Einwilligung — заявлен

Context

Bundesnetzagentur is the Federal Network Agency, regulating Germany’s electricity, gas, telecommunications, postal, and railway markets. It reports to the BMWi. Known for a number of high-profile decisions, including banning children’s smartwatches with an eavesdropping function (2017) and overseeing algorithmic discrimination in networks. HAR: 109 requests, 1 domain.

The rejection-of-tracking formula — a third instance

The policy contains the same declaration used by BGH and BfDI: “Techniken, die es ermöglichen, das Zugriffsverhalten der Nutzer*innen nachzuvollziehen, werden nicht eingesetzt” — with the addition of the gendered *innen symbol, reflecting current style conventions in German state documents. This is not a coincidental match in wording: it is anchored in ITZBund and DSK guidance for state sites that forgo analytics.

IP anonymization in the log file

Unlike many other sites in the series, Bundesnetzagentur explicitly states that IP addresses in server logs are anonymized: “IP-Adresse, anonymisiert.” Legal basis: Art. 6(1)(f) DSGVO (berechtigtes Interesse in ensuring IT system security). The log-retention period is not stated in the policy.

The old woff format

The BundesSans and BundesSerif fonts are stored in .woff format — the predecessor standard to .woff2. This is one of the few signs that the site runs on an older version of the federal CMS platform. The principle of local hosting is nonetheless upheld.

Conclusion

bundesnetzagentur.de is the fourteenth zero result in the German series. A regulator that oversees compliance in the telecommunications industry — including network users’ privacy — applies the standard of rejecting tracking on its own site. Institutional consistency, characteristic of Germany’s federal platform.

Evidence
Original (audit)
HAR file: de/bundesnetzagentur-de-2026-05-29.har
SHA-256: e1ed2a79313a61a0a6ae19cfbe3f1fe38e6cb1ebc5055ea27d04a1902b4e7c75
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.