German Federal Statistical Office. 46 requests, 2 domains. GSB platform, Myra Security CDN. StatisSans — a proprietary corporate typeface, 7 weights, served locally. The Faktenfuchs chatbot on bundesbots.de — declared. Matomo via ITZBund only after consent (Art. 6(1)(a), TDDDG §25(1)). Set-Cookie — zero. Full compliance.
Timeline of the leak
Declared versus actual
Context
Statistisches Bundesamt (Destatis) is Germany’s federal statistical office, based in Wiesbaden. It publishes official statistics on the economy, population, and society. GSB platform, Myra Security CDN. HAR: 46 requests, 2 domains.
StatisSans — a corporate typeface in 7 weights
Destatis uses its own StatisSans typeface in seven weights: Light, Book, Regular, Medium, SemiBold, Bold, Italic — all woff2 files from /static/fonts/statissans/. The typeface was developed specifically for the Statistisches Bundesamt and is visually tied to the agency’s corporate style. No Google Fonts, no Adobe Fonts. The Faktenfuchs chatbot widget additionally loads BundesSans from bundesbots.de.
Faktenfuchs — a state chatbot
faktenfuchs.destatis.bundesbots.de is Destatis’s statistical chatbot, running on the bundesbots.de platform (Bundesministerium des Innern). Loads a widget (+99 ms) and the BundesSans font. The privacy policy contains a dedicated “Datenschutzhinweise für den Chatbot” section, with a full description of the data processing, the operator, and user rights.
Matomo strictly after consent
The CSP explicitly includes piwik.itzbund.de among allowed sources. The policy declares Matomo via ITZBund, with a legal basis of Art. 6(1)(a) DSGVO combined with TDDDG §25(1) — meaning explicit consent is required. There are no requests to piwik.itzbund.de in the HAR. The GSB cookie banner loads at +467 ms.
Myra Security — a declared CDN
server: myracloud in the response headers discloses Myra Security GmbH (Munich) as the CDN and DDoS protection provider. The policy explicitly declares Myra Security, with its legal address and a description of the processing purpose.
Conclusion
www.destatis.de does not transmit visitor data to third parties on first visit. Two domains — both state-owned, a proprietary typeface, Matomo strictly behind the consent barrier, and the chatbot and CDN both declared. No GDPR violations recorded at the time of the audit.
a2611b316b2ebf7eb4ac784f53f967d6acb250adb32168551f7d4614b694b751