RU EN
www.
Technical audit · 29.05.2026

bundeswehr.de

Armed Forces of the Federal Republic of Germany
DE

Germany's armed forces. 31 requests, 2 domains. CoreMedia CMS. Bebas Neue and PT Sans served locally. Matomo on a proprietary server (webstatistik.bundeswehr.de) requires consent per the policy — active in the HAR with no banner. Kaltura, Google Maps, Twitter/Facebook — in the CSP, inactive in the HAR. Set-Cookie — zero.

Request timeline

+124 ms · homepage
www.bundeswehr.de/de/ — CoreMedia CMS. Redirect /de → /de/. The CSP report-uri points to webstatistik.bundeswehr.de/report-uri/ — the same domain used for Matomo.
+289 ms · weba.js
www.bundeswehr.de/service/weba/bw-de/weba.js — a CoreMedia utility JS file that initiates loading of the Matomo Tag Manager from webstatistik.bundeswehr.de.
+290 ms · styles and logos
app.bundle.css, app.bundle.js — CoreMedia bundles. Bundeswehr SVG logos (designmark, wordmark), SVG social media icons (Facebook, Instagram, YouTube, WhatsApp, Flickr) — all local.
+434 ms · Matomo — no banner
webstatistik.bundeswehr.de/js/container_XIe0naNH.js — the Matomo Tag Manager. Loads before any consent banner. The policy requires explicit consent before activation.
+508 ms · fonts
BebasNeue-Regular.woff2, PTSans-Regular-Latin.woff2, PTSans-Italic-Latin.woff2, PTSans-Bold-Latin.woff2 — four woff2 files from themes/bwre/fonts/, local.

Declared versus actual

✓ Matomo (webstatistik.bundeswehr.de) — declared, requires Einwilligung (§25(1) TTDSG) — declared
✓ Technisch notwendige Cookies — Art. 6(1)(e) DSGVO i.V.m. § 3 BDSG — declared
✓ YouTube, Facebook, Instagram, X, Mastodon, Bluesky — mentioned as Bundeswehr's social media — declared
✓ Kaltura (*.de.kaltura.com, *.video-cdn.net) — in the CSP, for video on internal pages — declared
✓ Google Maps (maps.googleapis.com) — in the CSP, for maps on internal pages — declared

Transfer timings

+434 ms webstatistik.bundeswehr.de

Matomo Tag Manager. Bundeswehr's own server. The policy requires Einwilligung.

Detected trackers

Context

Bundeswehr is Germany’s armed forces, subordinate to the Bundesministerium der Verteidigung (BMVg). Sensitivity is high. CoreMedia CMS, proprietary infrastructure. HAR: 31 requests, 2 domains.

Matomo with no banner — a finding of the site’s own policy

weba.js (+289 ms) initiates loading of webstatistik.bundeswehr.de/js/container_XIe0naNH.js (+434 ms) — the Matomo Tag Manager on Bundeswehr’s own server. The privacy policy states directly that Matomo is activated “Auf der Grundlage Ihrer Einwilligung (§25 Abs. 1 Satz 1 TTDSG)” — i.e., it requires explicit consent. There is neither a CMP platform nor a consent banner in the HAR. The CSP contains report-uri https://webstatistik.bundeswehr.de/report-uri/ — the same domain is used for both CSP finding reports and analytics.

Bebas Neue and PT Sans — local

Four woff2 files: BebasNeue-Regular (a display typeface) and PT Sans (Regular, Italic, Bold), from the CoreMedia theme. No Google Fonts, no Adobe Fonts.

The CSP discloses an expanded stack for internal pages

The Content-Security-Policy permits: *.de.kaltura.com and *.video-cdn.net (Kaltura — a video platform for military content), maps.googleapis.com and maps.gstatic.com (Google Maps), platform.twitter.com, connect.facebook.net, www.instagram.com. None of these are active on the homepage.

The policy references TTDSG instead of TDDDG

The policy uses “§ 25 Abs. 1 Satz 1 TTDSG” — an outdated name. TDDDG has been in effect since May 2023.

Conclusion

www.bundeswehr.de does not comply with its own privacy policy: Matomo is declared as requiring explicit consent, but loads with no preceding banner. For the website of the armed forces, handling highly sensitive data, this is a substantial finding. The policy also contains an outdated legal reference to TTDSG instead of TDDDG.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/bundeswehr-de-2026-05-29.har
SHA-256: d213c3dc0305a787187fd08dfe68d2773b89f45f605b33655deff358db33e9ca
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bundeswehr.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bundeswehr.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-bundeswehr-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — bundeswehr.de

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website bundeswehr.de.

2. Circumstances
I visited the website bundeswehr.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

Full technical documentation is published at: https://gdpru.eu/en/audits/de-bundeswehr-de/

3. GDPR provisions I ask you to examine


4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]