Technical audit · 2026-05-29

bundespolizei.de

German Federal Police

German Federal Police. 47 requests, 1 domain. BundesSans and BundesSerif served locally. A proprietary consent overlay and cookieBannerFull — no external CMP platforms. Not a single request outside bundespolizei.de. Full compliance.

Timeline of the leak

+84 ms · resource loading
All CSS, JS, fonts, and images load from bundespolizei.de. BundesSans-Web (Regular, Bold, Medium), BundesSerif-Web-Regular — Germany's state font family, hosted locally.
+301–350 ms · proprietary consent
bundespolizei.de/consent-overlay.js and cookieBannerFull.js — a proprietary cookie-banner implementation with no external dependencies. consent.html (+353 ms) — the consent-management page.
No external domains
Not a single request to external domains. No Google, no Meta, no CDN. Set-Cookie — zero.

Context

Bundespolizei is Germany’s federal police, subordinate to the Federal Ministry of the Interior. It secures state borders and safeguards federal railways and airports. Sensitivity is high. HAR: 47 requests, 1 domain.

Clean architecture

All 47 requests go exclusively to bundespolizei.de. The stack: proprietary Typo3 CMS CSS files, BundesSans-Web and BundesSerif-Web — Germany’s state design-standard fonts (Bundesdesign), hosted locally. Swiper.js, Solr — all local. Social media icons (Facebook, YouTube, Instagram, X, WhatsApp) — static SVGs with no external SDK.

Consent management is implemented with no external CMP platforms: a proprietary consent-overlay.js (+301 ms), cookieBannerFull.js (+350 ms), and consent.html (+353 ms). The policy describes only session cookies, technically necessary for the site’s operation, referencing § 25 para. 2 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) — Germany’s implementation of ePrivacy. No OneTrust, no Cookiebot, no Cookie Script.

BundesDesign as a privacy factor

Using the federal BundesSans/BundesSerif font family is not merely a matter of corporate identity. These fonts are part of the state design standard and are distributed centrally. Hosting them locally removes the need to contact external CDNs (Google Fonts, Adobe Fonts) on every visit — itself an architectural decision in favor of privacy.

Place within the German series

bundespolizei.de opens the German series the same way cao.ie opened the Irish one — with zero external domains and zero violations. Germany, with its established GDPR enforcement practice (BfDI rulings, the Munich court’s Google Fonts decision, DSK positions on cookie banners), historically forms a stricter supervisory environment. This first site sets the benchmark for comparison.

Conclusion

bundespolizei.de violates nothing: one domain, local resources, a proprietary consent mechanism, a policy with specific legal bases (TDDDG, BDSG, BSIG). For the website of the federal police, whose visitors may be in sensitive circumstances, this is the correct standard.

Evidence
Original (audit)
HAR file: de/bundespolizei-de-2026-05-29.har
SHA-256: 47a7cf09b15cfe7275bf06407c3960f67a04f57a95a1fbb19aee954571e03cdc
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.