RU EN
www.
Technical audit · 2026-05-29

bundeswehr.de

Armed Forces of the Federal Republic of Germany
DE

Germany's armed forces. 31 requests, 2 domains. CoreMedia CMS. Bebas Neue and PT Sans served locally. Matomo on a proprietary server (webstatistik.bundeswehr.de) requires consent per the policy — active in the HAR with no banner. Kaltura, Google Maps, Twitter/Facebook — in the CSP, inactive in the HAR. Set-Cookie — zero.

Timeline of the leak

+124 ms · homepage
www.bundeswehr.de/de/ — CoreMedia CMS. Redirect /de → /de/. The CSP report-uri points to webstatistik.bundeswehr.de/report-uri/ — the same domain used for Matomo.
+289 ms · weba.js
www.bundeswehr.de/service/weba/bw-de/weba.js — a CoreMedia utility JS file that initiates loading of the Matomo Tag Manager from webstatistik.bundeswehr.de.
+290 ms · styles and logos
app.bundle.css, app.bundle.js — CoreMedia bundles. Bundeswehr SVG logos (designmark, wordmark), SVG social media icons (Facebook, Instagram, YouTube, WhatsApp, Flickr) — all local.
+434 ms · Matomo — no banner
webstatistik.bundeswehr.de/js/container_XIe0naNH.js — the Matomo Tag Manager. Loads before any consent banner. The policy requires explicit consent before activation.
+508 ms · fonts
BebasNeue-Regular.woff2, PTSans-Regular-Latin.woff2, PTSans-Italic-Latin.woff2, PTSans-Bold-Latin.woff2 — four woff2 files from themes/bwre/fonts/, local.

Declared versus actual

✓ Matomo (webstatistik.bundeswehr.de) — declared, requires Einwilligung (§25(1) TTDSG) — заявлен
✓ Technisch notwendige Cookies — Art. 6(1)(e) DSGVO i.V.m. § 3 BDSG — заявлен
✓ YouTube, Facebook, Instagram, X, Mastodon, Bluesky — mentioned as Bundeswehr's social media — заявлен
✓ Kaltura (*.de.kaltura.com, *.video-cdn.net) — in the CSP, for video on internal pages — заявлен
✓ Google Maps (maps.googleapis.com) — in the CSP, for maps on internal pages — заявлен

Transfer timings

+434 ms webstatistik.bundeswehr.de

Matomo Tag Manager. Bundeswehr's own server. The policy requires Einwilligung.

Detected trackers

Indicators of GDPR non-compliance

Context

Bundeswehr is Germany’s armed forces, subordinate to the Bundesministerium der Verteidigung (BMVg). Sensitivity is high. CoreMedia CMS, proprietary infrastructure. HAR: 31 requests, 2 domains.

Matomo with no banner — a violation of the site’s own policy

weba.js (+289 ms) initiates loading of webstatistik.bundeswehr.de/js/container_XIe0naNH.js (+434 ms) — the Matomo Tag Manager on Bundeswehr’s own server. The privacy policy states directly that Matomo is activated “Auf der Grundlage Ihrer Einwilligung (§25 Abs. 1 Satz 1 TTDSG)” — i.e., it requires explicit consent. There is neither a CMP platform nor a consent banner in the HAR. The CSP contains report-uri https://webstatistik.bundeswehr.de/report-uri/ — the same domain is used for both CSP violation reports and analytics.

Bebas Neue and PT Sans — local

Four woff2 files: BebasNeue-Regular (a display typeface) and PT Sans (Regular, Italic, Bold), from the CoreMedia theme. No Google Fonts, no Adobe Fonts.

The CSP discloses an expanded stack for internal pages

The Content-Security-Policy permits: *.de.kaltura.com and *.video-cdn.net (Kaltura — a video platform for military content), maps.googleapis.com and maps.gstatic.com (Google Maps), platform.twitter.com, connect.facebook.net, www.instagram.com. None of these are active on the homepage.

The policy references TTDSG instead of TDDDG

The policy uses “§ 25 Abs. 1 Satz 1 TTDSG” — an outdated name. TDDDG has been in effect since May 2023.

Conclusion

www.bundeswehr.de violates its own privacy policy: Matomo is declared as requiring explicit consent, but loads with no preceding banner. For the website of the armed forces, handling highly sensitive data, this is a substantial violation. The policy also contains an outdated legal reference to TTDSG instead of TDDDG.

Evidence
Original (audit)
HAR file: de/bundeswehr-de-2026-05-29.har
SHA-256: d213c3dc0305a787187fd08dfe68d2773b89f45f605b33655deff358db33e9ca
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

To: Federal Commissioner for Data Protection (BfDI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website bundeswehr.de.

2. Circumstances
I visited the website bundeswehr.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) webstatistik.bundeswehr.de/js/container_XIe0naNH.js (the Matomo Tag Manager) loads at +434 ms with no preceding consent banner. The policy explicitly requires Einwilligung (§25(1) TTDSG) to activate Matomo cookies. There is no CMP or consent-management banner in the HAR. The policy references TTDSG instead of the current TDDDG.

Full technical documentation is published at: https://gdpru.eu/en/audits/de-bundeswehr-de/

3. Provisions violated
GDPR Art. 5(1)(a); TDDDG § 25(1)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]