Policy changed — see what exactly · 2026-08-12 →
German Federal Police. 47 requests, 1 domain. BundesSans and BundesSerif served locally. A proprietary consent overlay and cookieBannerFull — no external CMP platforms. Not a single request outside bundespolizei.de. Full compliance.
Timeline of the leak
Context
Bundespolizei is Germany’s federal police, subordinate to the Federal Ministry of the Interior. It secures state borders and safeguards federal railways and airports. Sensitivity is high. HAR: 47 requests, 1 domain.
Clean architecture
All 47 requests go exclusively to bundespolizei.de. The stack: proprietary Typo3 CMS CSS files, BundesSans-Web and BundesSerif-Web — Germany’s state design-standard fonts (Bundesdesign), hosted locally. Swiper.js, Solr — all local. Social media icons (Facebook, YouTube, Instagram, X, WhatsApp) — static SVGs with no external SDK.
Consent management is implemented with no external CMP platforms: a proprietary consent-overlay.js (+301 ms), cookieBannerFull.js (+350 ms), and consent.html (+353 ms). The policy describes only session cookies, technically necessary for the site’s operation, referencing § 25 para. 2 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) — Germany’s implementation of ePrivacy. No OneTrust, no Cookiebot, no Cookie Script.
BundesDesign as a privacy factor
Using the federal BundesSans/BundesSerif font family is not merely a matter of corporate identity. These fonts are part of the state design standard and are distributed centrally. Hosting them locally removes the need to contact external CDNs (Google Fonts, Adobe Fonts) on every visit — itself an architectural decision in favor of privacy.
Place within the German series
bundespolizei.de opens the German series the same way cao.ie opened the Irish one — with zero external domains and zero violations. Germany, with its established GDPR enforcement practice (BfDI rulings, the Munich court’s Google Fonts decision, DSK positions on cookie banners), historically forms a stricter supervisory environment. This first site sets the benchmark for comparison.
Conclusion
bundespolizei.de violates nothing: one domain, local resources, a proprietary consent mechanism, a policy with specific legal bases (TDDDG, BDSG, BSIG). For the website of the federal police, whose visitors may be in sensitive circumstances, this is the correct standard.
47a7cf09b15cfe7275bf06407c3960f67a04f57a95a1fbb19aee954571e03cdc