RU EN
www.
Technical audit · 2026-05-29

bundeswirtschaftsministerium.de

Federal Ministry for Economic Affairs and Climate Action
DE

German Federal Ministry for Economic Affairs and Climate Action. 31 requests, 6 domains. CoreMedia CMS, JWPlayer local. BundesSans and BundesSerif served locally. etracker requires consent per the policy — active in the HAR with no banner. stage.bio and ReadSpeaker (stormcaster.js) are undeclared. The policy references TTDSG instead of TDDDG.

Timeline of the leak

+875 ms · homepage
www.bundeswirtschaftsministerium.de — two redirects: bmwk.bund.de → www.bmwk.de → www.bundeswirtschaftsministerium.de. CoreMedia CMS (CAE), Apache.
+1294 ms · styles and JS
production.min.css (a CoreMedia CAE bundle), additional-css.css. jwplayer-7.6.1/jwplayer.js — JW Player 7.6.1 loads locally from the ministry's site.
+1296 ms · etracker — before the banner
code.etracker.com/code/e.js — loads at the same time as the styles. The policy requires consent before etracker is activated. No banner precedes this request in the HAR.
+1304 ms · stage.bio
dashboard.stage.bio/static/bundle.js — a JS bundle from the stage.bio platform (server: nginx, access-control-allow-origin: *). At +3441 ms — cdn.stage.bio/static/stage_icon_grey.svg. Purpose: a link-in-bio widget within the site's content.
+1494 ms · ReadSpeaker stormcaster.js
www.bundeswirtschaftsministerium.de/18f5227b-e27b-445a-a53f-f845fbe69b40/stormcaster.js — the JS is hosted on the ministry's domain, but served from ReadSpeaker's CDN (server: rdwr, via: 1.1 google, x-cache: HIT from rdwr-edge, 176 KB).
+2112 ms · ReadSpeaker GUID requests
Four requests to /c99a4269-161c-4242-a3f0-28d44fa6ce24 — ReadSpeaker usage analytics/statistics. server: rdwr, via: 1.1 google, cache-control: no-store.
+1516 ms · fonts
BundesSansWeb (Regular, Bold), BundesSerifWeb (Regular, Bold, Italic), iconset-rework.woff — all from /cae/frontend/_global/fonts/, local.

Declared versus actual

✓ etracker — declared, requires Einwilligung (§25(1) TTDSG) — declared
✓ JW Player (LongTail Ad Solutions / TV1) — declared, requires Einwilligung — declared
✓ Session cookies — technically necessary — declared
✓ Social media (Facebook, YouTube, X, Instagram, LinkedIn, Threads, Mastodon, TikTok) — declared — declared
+ stage.bio (dashboard.stage.bio, cdn.stage.bio) — not mentioned — not declared
+ ReadSpeaker / rdwr (stormcaster.js, GUID endpoint) — not mentioned — not declared

Transfer timings

+1296 ms code.etracker.com

etracker. The policy requires Einwilligung. No banner preceded the request.

+1304 ms dashboard.stage.bio

stage.bio. Not declared.

+1494 ms www.bundeswirtschaftsministerium.de (rdwr CDN)

ReadSpeaker stormcaster.js. Not declared.

Detected trackers

Indicators of GDPR non-compliance

Context

BMWK (Bundesministerium für Wirtschaft und Klimaschutz) is Germany’s Federal Ministry for Economic Affairs and Climate Action. Reachable via three domains: bmwk.bund.de → www.bmwk.de → www.bundeswirtschaftsministerium.de. CoreMedia CMS (CAE), Apache. HAR: 31 requests, 6 domains.

etracker requires consent — active in the HAR with no banner

The policy explicitly describes etracker as an optional service requiring user consent: “Sie können jederzeit entscheiden, ob Sie uns erlauben…,” referring to “Einwilligungsverwaltung” at the bottom of the page. Legal basis: §25(1) TTDSG i.V.m. Art. 6(1)(a) DSGVO. In the HAR, code.etracker.com/code/e.js loads at +1296 ms with no preceding consent banner.

ReadSpeaker — hidden behind the ministry’s own domain

stormcaster.js (176 KB) is hosted at the URL www.bundeswirtschaftsministerium.de/18f5227b-e27b-445a-a53f-f845fbe69b40/stormcaster.js, yet the response headers reveal the actual provider: server: rdwr, via: 1.1 google, x-cache: HIT from rdwr-edge. ReadSpeaker is a German text-to-speech service for reading web pages aloud. Four subsequent requests to a GUID endpoint (/c99a4269-…) with cache-control: no-store constitute ReadSpeaker usage analytics. Neither ReadSpeaker nor rdwr is mentioned in the policy.

stage.bio — an undeclared external platform

dashboard.stage.bio and cdn.stage.bio belong to a link-in-bio mini-page builder platform. The JS bundle loads at +1304 ms, an icon at +3441 ms. Not mentioned in the privacy policy.

The policy cites “§ 25 Abs. 1 TTDSG” — the Telekommunikations-Telemedien-Datenschutz-Gesetz. This law was renamed TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) as of May 13, 2023. JW Player is likewise described via TTDSG. For the official website of a federal ministry, outdated legal references undermine the policy’s credibility.

BundesSchrift and JWPlayer — local

BundesSansWeb, BundesSerifWeb, and iconset-rework — local, from CoreMedia CAE. JWPlayer 7.6.1 is hosted locally.

Conclusion

www.bundeswirtschaftsministerium.de violates its own policy: etracker is declared as requiring consent, yet activates with no banner. Two services are undeclared (stage.bio, ReadSpeaker). The policy contains outdated legal references to TTDSG instead of TDDDG.

Evidence
Original (audit)
HAR file: de/bundeswirtschaftsministerium-de-2026-05-29.har
SHA-256: 633b9359ef041975495eb2925aace94c3c6113a0daa15cd3862d8c32ddf0e2a4
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

To: Federal Commissioner for Data Protection (BfDI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website bundeswirtschaftsministerium.de.

2. Circumstances
I visited the website bundeswirtschaftsministerium.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) etracker (code.etracker.com/code/e.js) loads at +1296 ms. The policy explicitly states that etracker requires consent under §25(1) TTDSG i.V.m. Art. 6(1)(a) DSGVO. There is no CMP banner in the HAR preceding the request to etracker — consent was not obtained before the data was sent.

2) stage.bio (dashboard.stage.bio/static/bundle.js, cdn.stage.bio/static/stage_icon_grey.svg) loads at +1304 ms and +3441 ms. Stage.bio is a link-in-bio mini-landing-page builder. It is not mentioned in the privacy policy.

3) ReadSpeaker Web Reader is implemented via stormcaster.js (hosted on the ministry's site but served from a CDN, rdwr/Google Cloud) and four GUID requests to the endpoint /c99a4269-161c-4242-a3f0-28d44fa6ce24 (server: rdwr, via: 1.1 google, cache-control: no-store). Neither ReadSpeaker nor rdwr is mentioned in the privacy policy.

4) The policy references §25 Abs. 1 TTDSG (Telekommunikations-Telemedien-Datenschutz-Gesetz). TTDSG was renamed TDDDG in May 2023. References to the outdated law mislead users checking the legal bases.

Full technical documentation is published at: https://gdpru.eu/en/audits/de-bundeswirtschaftsministerium-de/

3. Provisions violated
GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 13(1)(e); GDPR Art. 13(1)(e); GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]