RU EN
www.
Technical audit · 29.05.2026

bundeswirtschaftsministerium.de

Federal Ministry for Economic Affairs and Climate Action
DE

German Federal Ministry for Economic Affairs and Climate Action. 31 requests, 6 domains. CoreMedia CMS, JWPlayer local. BundesSans and BundesSerif served locally. etracker requires consent per the policy — active in the HAR with no banner. stage.bio and ReadSpeaker (stormcaster.js) are undeclared. The policy references TTDSG instead of TDDDG.

Request timeline

+875 ms · homepage
www.bundeswirtschaftsministerium.de — two redirects: bmwk.bund.de → www.bmwk.de → www.bundeswirtschaftsministerium.de. CoreMedia CMS (CAE), Apache.
+1294 ms · styles and JS
production.min.css (a CoreMedia CAE bundle), additional-css.css. jwplayer-7.6.1/jwplayer.js — JW Player 7.6.1 loads locally from the ministry's site.
+1296 ms · etracker — before the banner
code.etracker.com/code/e.js — loads at the same time as the styles. The policy requires consent before etracker is activated. No banner precedes this request in the HAR.
+1304 ms · stage.bio
dashboard.stage.bio/static/bundle.js — a JS bundle from the stage.bio platform (server: nginx, access-control-allow-origin: *). At +3441 ms — cdn.stage.bio/static/stage_icon_grey.svg. Purpose: a link-in-bio widget within the site's content.
+1494 ms · ReadSpeaker stormcaster.js
www.bundeswirtschaftsministerium.de/18f5227b-e27b-445a-a53f-f845fbe69b40/stormcaster.js — the JS is hosted on the ministry's domain, but served from ReadSpeaker's CDN (server: rdwr, via: 1.1 google, x-cache: HIT from rdwr-edge, 176 KB).
+2112 ms · ReadSpeaker GUID requests
Four requests to /c99a4269-161c-4242-a3f0-28d44fa6ce24 — ReadSpeaker usage analytics/statistics. server: rdwr, via: 1.1 google, cache-control: no-store.
+1516 ms · fonts
BundesSansWeb (Regular, Bold), BundesSerifWeb (Regular, Bold, Italic), iconset-rework.woff — all from /cae/frontend/_global/fonts/, local.

Declared versus actual

✓ etracker — declared, requires Einwilligung (§25(1) TTDSG) — declared
✓ JW Player (LongTail Ad Solutions / TV1) — declared, requires Einwilligung — declared
✓ Session cookies — technically necessary — declared
✓ Social media (Facebook, YouTube, X, Instagram, LinkedIn, Threads, Mastodon, TikTok) — declared — declared
+ stage.bio (dashboard.stage.bio, cdn.stage.bio) — not mentioned — not declared
+ ReadSpeaker / rdwr (stormcaster.js, GUID endpoint) — not mentioned — not declared

Transfer timings

+1296 ms code.etracker.com

etracker. The policy requires Einwilligung. No banner preceded the request.

+1304 ms dashboard.stage.bio

stage.bio. Not declared.

+1494 ms www.bundeswirtschaftsministerium.de (rdwr CDN)

ReadSpeaker stormcaster.js. Not declared.

Detected trackers

Indicators of GDPR non-compliance

Context

BMWK (Bundesministerium für Wirtschaft und Klimaschutz) is Germany’s Federal Ministry for Economic Affairs and Climate Action. Reachable via three domains: bmwk.bund.de → www.bmwk.de → www.bundeswirtschaftsministerium.de. CoreMedia CMS (CAE), Apache. HAR: 31 requests, 6 domains.

etracker requires consent — active in the HAR with no banner

The policy explicitly describes etracker as an optional service requiring user consent: “Sie können jederzeit entscheiden, ob Sie uns erlauben…,” referring to “Einwilligungsverwaltung” at the bottom of the page. Legal basis: §25(1) TTDSG i.V.m. Art. 6(1)(a) DSGVO. In the HAR, code.etracker.com/code/e.js loads at +1296 ms with no preceding consent banner.

ReadSpeaker — hidden behind the ministry’s own domain

stormcaster.js (176 KB) is hosted at the URL www.bundeswirtschaftsministerium.de/18f5227b-e27b-445a-a53f-f845fbe69b40/stormcaster.js, yet the response headers reveal the actual provider: server: rdwr, via: 1.1 google, x-cache: HIT from rdwr-edge. ReadSpeaker is a German text-to-speech service for reading web pages aloud. Four subsequent requests to a GUID endpoint (/c99a4269-…) with cache-control: no-store constitute ReadSpeaker usage analytics. Neither ReadSpeaker nor rdwr is mentioned in the policy.

stage.bio — an undeclared external platform

dashboard.stage.bio and cdn.stage.bio belong to a link-in-bio mini-page builder platform. The JS bundle loads at +1304 ms, an icon at +3441 ms. Not mentioned in the privacy policy.

The policy cites “§ 25 Abs. 1 TTDSG” — the Telekommunikations-Telemedien-Datenschutz-Gesetz. This law was renamed TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) as of May 13, 2023. JW Player is likewise described via TTDSG. For the official website of a federal ministry, outdated legal references undermine the policy’s credibility.

BundesSchrift and JWPlayer — local

BundesSansWeb, BundesSerifWeb, and iconset-rework — local, from CoreMedia CAE. JWPlayer 7.6.1 is hosted locally.

Conclusion

www.bundeswirtschaftsministerium.de does not comply with its own policy: etracker is declared as requiring consent, yet activates with no banner. Two services are undeclared (stage.bio, ReadSpeaker). The policy contains outdated legal references to TTDSG instead of TDDDG.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/bundeswirtschaftsministerium-de-2026-05-29.har
SHA-256: 633b9359ef041975495eb2925aace94c3c6113a0daa15cd3862d8c32ddf0e2a4
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bundeswirtschaftsministerium.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bundeswirtschaftsministerium.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) etracker (code.etracker.com/code/e.js) loads at +1296 ms. The policy explicitly states that etracker requires consent under §25(1) TTDSG i.V.m. Art. 6(1)(a) DSGVO. There is no CMP banner in the HAR preceding the request to etracker — consent was not obtained before the data was sent.

2) stage.bio (dashboard.stage.bio/static/bundle.js, cdn.stage.bio/static/stage_icon_grey.svg) loads at +1304 ms and +3441 ms. Stage.bio is a link-in-bio mini-landing-page builder. It is not mentioned in the privacy policy.

3) ReadSpeaker Web Reader is implemented via stormcaster.js (hosted on the ministry's site but served from a CDN, rdwr/Google Cloud) and four GUID requests to the endpoint /c99a4269-161c-4242-a3f0-28d44fa6ce24 (server: rdwr, via: 1.1 google, cache-control: no-store). Neither ReadSpeaker nor rdwr is mentioned in the privacy policy.

4) The policy references §25 Abs. 1 TTDSG (Telekommunikations-Telemedien-Datenschutz-Gesetz). TTDSG was renamed TDDDG in May 2023. References to the outdated law mislead users checking the legal bases.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-bundeswirtschaftsministerium-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — bundeswirtschaftsministerium.de

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website bundeswirtschaftsministerium.de.

2. Circumstances
I visited the website bundeswirtschaftsministerium.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) etracker (code.etracker.com/code/e.js) loads at +1296 ms. The policy explicitly states that etracker requires consent under §25(1) TTDSG i.V.m. Art. 6(1)(a) DSGVO. There is no CMP banner in the HAR preceding the request to etracker — consent was not obtained before the data was sent.

2) stage.bio (dashboard.stage.bio/static/bundle.js, cdn.stage.bio/static/stage_icon_grey.svg) loads at +1304 ms and +3441 ms. Stage.bio is a link-in-bio mini-landing-page builder. It is not mentioned in the privacy policy.

3) ReadSpeaker Web Reader is implemented via stormcaster.js (hosted on the ministry's site but served from a CDN, rdwr/Google Cloud) and four GUID requests to the endpoint /c99a4269-161c-4242-a3f0-28d44fa6ce24 (server: rdwr, via: 1.1 google, cache-control: no-store). Neither ReadSpeaker nor rdwr is mentioned in the privacy policy.

4) The policy references §25 Abs. 1 TTDSG (Telekommunikations-Telemedien-Datenschutz-Gesetz). TTDSG was renamed TDDDG in May 2023. References to the outdated law mislead users checking the legal bases.

Full technical documentation is published at: https://gdpru.eu/en/audits/de-bundeswirtschaftsministerium-de/

3. GDPR provisions I ask you to examine
GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 13(1)(e); GDPR Art. 13(1)(e); GDPR Art. 13(1)(e)

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]