RU EN
www.
Technical audit · 29.05.2026

destatis.de

German Federal Statistical Office
DE

German Federal Statistical Office. 46 requests, 2 domains. GSB platform, Myra Security CDN. StatisSans — a proprietary corporate typeface, 7 weights, served locally. The Faktenfuchs chatbot on bundesbots.de — declared. Matomo via ITZBund only after consent (Art. 6(1)(a), TDDDG §25(1)). Set-Cookie — zero. Full compliance.

Request timeline

+0 ms · homepage
www.destatis.de/ — GSB, Myra Security CDN (server: myracloud). The CSP permits piwik.itzbund.de and *.bundesbots.de — inactive in the HAR before consent. bewacherregister.de appears in the CSP — a registry of security firms, a partner resource of Destatis.
+94 ms · GSB styles
normalize.css, _libs.css, responsive CSS (small, medium, large, custom, custom_destatis), and the seasonal custom_xmas.css — all local.
+99 ms · Faktenfuchs chatbot
faktenfuchs.destatis.bundesbots.de/widget/widget/ — Destatis's statistical chatbot widget. bundesbots.de is a state chatbot platform (Bundesministerium des Innern). Declared in the policy.
+279 ms · StatisSans
StatisSans (Light, Book, Regular, Medium, SemiBold, Bold, Italic) — 7 woff2 files from /static/fonts/statissans/, all local. Destatis/Statistisches Bundesamt's own typeface. BundesSans-Web-Regular loads via the chatbot widget from bundesbots.de.
+467 ms · GSB cookie banner
www.destatis.de/SiteGlobals/Modules/CookieBanner/DE/Allgemein/CookieBanner.json — the proprietary GSB consent banner.

Declared versus actual

✓ Matomo (piwik.itzbund.de / ITZBund) — only after explicit consent, Art. 6(1)(a) DSGVO, TDDDG §25(1), IP anonymization (2 bytes) — declared
✓ Faktenfuchs chatbot (*.bundesbots.de) — declared, with a dedicated section in the policy — declared
✓ Myra Security GmbH — CDN and DDoS protection, declared — declared
✓ Social media (LinkedIn, Mastodon, Spotify) — mentioned as Destatis's external platforms — declared

Context

Statistisches Bundesamt (Destatis) is Germany’s federal statistical office, based in Wiesbaden. It publishes official statistics on the economy, population, and society. GSB platform, Myra Security CDN. HAR: 46 requests, 2 domains.

StatisSans — a corporate typeface in 7 weights

Destatis uses its own StatisSans typeface in seven weights: Light, Book, Regular, Medium, SemiBold, Bold, Italic — all woff2 files from /static/fonts/statissans/. The typeface was developed specifically for the Statistisches Bundesamt and is visually tied to the agency’s corporate style. No Google Fonts, no Adobe Fonts. The Faktenfuchs chatbot widget additionally loads BundesSans from bundesbots.de.

Faktenfuchs — a state chatbot

faktenfuchs.destatis.bundesbots.de is Destatis’s statistical chatbot, running on the bundesbots.de platform (Bundesministerium des Innern). Loads a widget (+99 ms) and the BundesSans font. The privacy policy contains a dedicated “Datenschutzhinweise für den Chatbot” section, with a full description of the data processing, the operator, and user rights.

The CSP explicitly includes piwik.itzbund.de among allowed sources. The policy declares Matomo via ITZBund, with a legal basis of Art. 6(1)(a) DSGVO combined with TDDDG §25(1) — meaning explicit consent is required. There are no requests to piwik.itzbund.de in the HAR. The GSB cookie banner loads at +467 ms.

Myra Security — a declared CDN

server: myracloud in the response headers discloses Myra Security GmbH (Munich) as the CDN and DDoS protection provider. The policy explicitly declares Myra Security, with its legal address and a description of the processing purpose.

Conclusion

www.destatis.de does not transmit visitor data to third parties on first visit. Two domains — both state-owned, a proprietary typeface, Matomo strictly behind the consent barrier, and the chatbot and CDN both declared. No GDPR violations recorded at the time of the audit.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/destatis-de-2026-05-29.har
SHA-256: a2611b316b2ebf7eb4ac784f53f967d6acb250adb32168551f7d4614b694b751
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — destatis.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website destatis.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-destatis-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]