Technical audit · 2026-05-29

destatis.de

German Federal Statistical Office

German Federal Statistical Office. 46 requests, 2 domains. GSB platform, Myra Security CDN. StatisSans — a proprietary corporate typeface, 7 weights, served locally. The Faktenfuchs chatbot on bundesbots.de — declared. Matomo via ITZBund only after consent (Art. 6(1)(a), TDDDG §25(1)). Set-Cookie — zero. Full compliance.

Timeline of the leak

+0 ms · homepage
www.destatis.de/ — GSB, Myra Security CDN (server: myracloud). The CSP permits piwik.itzbund.de and *.bundesbots.de — inactive in the HAR before consent. bewacherregister.de appears in the CSP — a registry of security firms, a partner resource of Destatis.
+94 ms · GSB styles
normalize.css, _libs.css, responsive CSS (small, medium, large, custom, custom_destatis), and the seasonal custom_xmas.css — all local.
+99 ms · Faktenfuchs chatbot
faktenfuchs.destatis.bundesbots.de/widget/widget/ — Destatis's statistical chatbot widget. bundesbots.de is a state chatbot platform (Bundesministerium des Innern). Declared in the policy.
+279 ms · StatisSans
StatisSans (Light, Book, Regular, Medium, SemiBold, Bold, Italic) — 7 woff2 files from /static/fonts/statissans/, all local. Destatis/Statistisches Bundesamt's own typeface. BundesSans-Web-Regular loads via the chatbot widget from bundesbots.de.
+467 ms · GSB cookie banner
www.destatis.de/SiteGlobals/Modules/CookieBanner/DE/Allgemein/CookieBanner.json — the proprietary GSB consent banner.

Declared versus actual

Matomo (piwik.itzbund.de / ITZBund) — only after explicit consent, Art. 6(1)(a) DSGVO, TDDDG §25(1), IP anonymization (2 bytes) — заявлен
Faktenfuchs chatbot (*.bundesbots.de) — declared, with a dedicated section in the policy — заявлен
Myra Security GmbH — CDN and DDoS protection, declared — заявлен
Social media (LinkedIn, Mastodon, Spotify) — mentioned as Destatis's external platforms — заявлен

Context

Statistisches Bundesamt (Destatis) is Germany’s federal statistical office, based in Wiesbaden. It publishes official statistics on the economy, population, and society. GSB platform, Myra Security CDN. HAR: 46 requests, 2 domains.

StatisSans — a corporate typeface in 7 weights

Destatis uses its own StatisSans typeface in seven weights: Light, Book, Regular, Medium, SemiBold, Bold, Italic — all woff2 files from /static/fonts/statissans/. The typeface was developed specifically for the Statistisches Bundesamt and is visually tied to the agency’s corporate style. No Google Fonts, no Adobe Fonts. The Faktenfuchs chatbot widget additionally loads BundesSans from bundesbots.de.

Faktenfuchs — a state chatbot

faktenfuchs.destatis.bundesbots.de is Destatis’s statistical chatbot, running on the bundesbots.de platform (Bundesministerium des Innern). Loads a widget (+99 ms) and the BundesSans font. The privacy policy contains a dedicated “Datenschutzhinweise für den Chatbot” section, with a full description of the data processing, the operator, and user rights.

The CSP explicitly includes piwik.itzbund.de among allowed sources. The policy declares Matomo via ITZBund, with a legal basis of Art. 6(1)(a) DSGVO combined with TDDDG §25(1) — meaning explicit consent is required. There are no requests to piwik.itzbund.de in the HAR. The GSB cookie banner loads at +467 ms.

Myra Security — a declared CDN

server: myracloud in the response headers discloses Myra Security GmbH (Munich) as the CDN and DDoS protection provider. The policy explicitly declares Myra Security, with its legal address and a description of the processing purpose.

Conclusion

www.destatis.de does not transmit visitor data to third parties on first visit. Two domains — both state-owned, a proprietary typeface, Matomo strictly behind the consent barrier, and the chatbot and CDN both declared. No GDPR violations recorded at the time of the audit.

Evidence
Original (audit)
HAR file: de/destatis-de-2026-05-29.har
SHA-256: a2611b316b2ebf7eb4ac784f53f967d6acb250adb32168551f7d4614b694b751
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.