German Federal Administrative Court. 27 requests, 1 domain. Grav CMS, Cloudflare CDN. Merriweather and Font Awesome served locally. No analytics, no trackers, no banner. Cloudflare NEL is declared only as 'Dienste Dritter,' with no name given. Set-Cookie — zero.
Timeline of the leak
Declared versus actual
Indicators of GDPR non-compliance
- GDPR Art. 13(1)(e)Cloudflare serves as the CDN and processes all requests to the site (cf-ray, cf-cache-status, server: cloudflare). Cloudflare Network Error Logging (NEL) sends reports to a.nel.cloudflare.com. The policy declares 'Dienste Dritter' (third-party services) without disclosing specific providers — Cloudflare Inc. (USA) is not named. Art. 13(1)(e) requires disclosure of the recipients or categories of recipients of personal data.
Context
Bundesverwaltungsgericht is Germany’s highest court of administrative jurisdiction, located in Leipzig. It hears appeals on points of administrative law. Sensitivity is high. Grav CMS, Cloudflare CDN. HAR: 27 requests, 1 domain.
Grav CMS with a proprietary theme
The site is built on Grav — a flat-file CMS with no database. The bverwg theme contains a full set of local resources: fonts, icons, images, JS/CSS. One compiled CSS bundle, one JS bundle. The HTML5 video player px-video.js with VTT subtitles — no YouTube or Vimeo iframe.
Cloudflare — a CDN, undeclared by name
The response headers unambiguously identify Cloudflare: server: cloudflare, cf-ray: a038618ef9bcb32c-FRA, cf-cache-status: HIT. Network Error Logging (NEL) is configured to a.nel.cloudflare.com — Cloudflare receives reports of the browser’s network errors. When using Cloudflare’s CDN, all visitors’ IP addresses pass through Cloudflare Inc.’s infrastructure (USA).
The policy declares the use of “Dienste Dritter” (third-party services), with data processed “on specially secured servers in Germany and other EU member states,” and allows for processing outside the EEA subject to Art. 44 ff. GDPR. Cloudflare is not named.
Policy — concise, no TDDDG reference
The privacy policy runs to roughly 4,200 characters and contains not a single mention of a specific third-party provider. Cookies are described as technically necessary (Art. 6(1)(f)), with no reference to TDDDG.
Merriweather and Font Awesome — local
Merriweather v18 (Regular, Italic, Bold, with the extended latin-ext set) and Font Awesome 4.6.3 — all woff2 files from Grav’s local theme. No Google Fonts.
Conclusion
www.bverwg.de uses no trackers or analytics. The one violation is that Cloudflare is not disclosed by name in the privacy policy. For the website of the highest administrative court, one that also hears data-protection cases, this is a notable omission.
388247e270412d38d5a97a67ea988ca0bbb1faa8aa704c115fce05b1149387c8Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →
To: Federal Commissioner for Data Protection (BfDI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website bverwg.de. 2. Circumstances I visited the website bverwg.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) Cloudflare serves as the CDN and processes all requests to the site (cf-ray, cf-cache-status, server: cloudflare). Cloudflare Network Error Logging (NEL) sends reports to a.nel.cloudflare.com. The policy declares 'Dienste Dritter' (third-party services) without disclosing specific providers — Cloudflare Inc. (USA) is not named. Art. 13(1)(e) requires disclosure of the recipients or categories of recipients of personal data. Full technical documentation is published at: https://gdpru.eu/en/audits/de-bverwg-de/ 3. Provisions violated GDPR Art. 13(1)(e) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]