Technical audit · 2026-05-29

evergabe.de

German Federal Public Procurement Portal

Germany's federal public procurement portal. 65 requests, 13 domains. Next.js, CloudWAF. Figtree Variable Font served locally. GTM and reCAPTCHA fire before the Usercentrics banner. GA4 is active before the banner is displayed. Bot Framework is undeclared. The policy is a machine translation describing already-discontinued services.

Timeline of the leak

+307 ms · homepage
www.evergabe.de/ — Next.js, CloudWAF (a proprietary WAF). Two redirects: http→https and evergabe.de→www.evergabe.de.
+842 ms · font and CSS
Figtree-VariableFont_wght.ttf (+842 ms preload, +1159 ms load) — a variable font, local. Next.js CSS bundles — local.
+852 ms · GTM and reCAPTCHA — before the banner
www.googletagmanager.com/gtm.js?id=GTM-PGQ2TZ and www.google.com/recaptcha/api.js?render=6LfYf_kq… load simultaneously. Roughly one second before the Usercentrics loader.
+1153 ms · Storyblok
a.storyblok.com — a hero-section image loaded directly (not through the Next.js image proxy). Storyblok is a headless CMS. The visitor's IP address is transmitted to Storyblok's servers.
+1900 ms · Usercentrics loader
web.cmp.usercentrics.eu/ui/loader.js — the CMP starts. settingsId=eV4HQKsCTwjEuJ. The banner appears at +2688 ms (session/1px.png).
+2176 ms · GA4 destination
www.googletagmanager.com/gtag/destination?id=G-XTTERB4HCG — GA4 configuration via GTM. 436 ms later — region1.google-analytics.com/g/collect with the full set of session parameters.
+2334 ms · Microsoft Bot Framework
cdn.botframework.com/botframework-webchat/latest/webchat.js — Microsoft Azure Bot Services' chat widget. Before the Usercentrics banner is displayed.
+3591 ms · Google Fonts
fonts.gstatic.com — Roboto (two weights, woff2) loads via a reCAPTCHA iframe. Google Fonts is not declared.

Declared versus actual

Google Analytics (Universal Analytics + Google Optimize) — declared, Art. 6(1)(f); both services have been discontinued by Google — заявлен
+ Google Tag Manager — not mentioned — не заявлен
+ Google Analytics 4 (G-XTTERB4HCG) — not mentioned (only UA is declared) — не заявлен
+ Microsoft Bot Framework (cdn.botframework.com) — not mentioned — не заявлен
+ Storyblok (a.storyblok.com) — not mentioned — не заявлен
+ Google Fonts / Roboto (fonts.gstatic.com) — not mentioned — не заявлен
+ Usercentrics — not mentioned — не заявлен

Transfer timings

+852 ms www.googletagmanager.com

GTM-PGQ2TZ. Before the banner.

+852 ms www.google.com / www.gstatic.com

Google reCAPTCHA. Before the banner.

+2612 ms region1.google-analytics.com

GA4 G-XTTERB4HCG. Before the banner is displayed.

+2334 ms cdn.botframework.com

Microsoft Bot Framework. Undeclared.

Detected trackers

Indicators of GDPR non-compliance

Context

eVergabe.de is Germany’s official federal public procurement portal, publishing tenders and public procurement procedures. Sensitivity is high: the site processes data belonging to bid participants and public procuring entities. Next.js, CloudWAF. HAR: 65 requests, 13 domains.

GTM and reCAPTCHA — before the banner

At +852 ms, GTM (GTM-PGQ2TZ) and Google reCAPTCHA (render=6LfYf_kqAAAAACp89Dmqpzs2OO4FKZ6T_m8DUe22) load simultaneously. Usercentrics appears at +1900 ms — a second later. GA4 (G-XTTERB4HCG), via GTM, sends g/collect at +2612 ms — before the banner is displayed (+2688 ms). Google Fonts (Roboto, two weights) loads via a reCAPTCHA iframe at +3591 ms.

The policy — a machine translation with outdated content

The privacy policy is written in Russian with clear artifacts of machine translation: instead of “eVergabe.de,” the text reads “eVeregung.de” and “eVerbung.de.” The services it describes — Google Universal Analytics and Google Optimize — were discontinued by Google in 2023 and 2024, respectively. In their place, GA4 is actually running, and it is not mentioned in the policy. Usercentrics, Bot Framework, Storyblok, and Google Fonts are all absent from the policy.

Microsoft Bot Framework — undeclared

cdn.botframework.com/botframework-webchat/latest/webchat.js (+2334 ms) is the SDK for Microsoft Azure Bot Services’ chat widget. It loads before the banner and is not mentioned in the policy. For a public procurement portal whose users may enter sensitive tender data, this is a substantial gap.

Storyblok — direct requests to a CDN

One image (a.storyblok.com) loads directly, bypassing the Next.js image proxy — the visitor’s IP address is transmitted to Storyblok’s servers. Storyblok is not declared in the policy.

Conclusion

www.evergabe.de shows systemic non-compliance: GTM and reCAPTCHA are active before the banner, GA4 is undeclared, and Bot Framework is unmentioned. The privacy policy describes discontinued services and bears the marks of machine translation. For a public procurement portal handling especially sensitive data, this is an unusually low level of GDPR compliance.

Evidence
Original (audit)
HAR file: de/evergabe-de-2026-05-29.har
SHA-256: d6c4d270fe9e5ec589b60e69b9439266388dd5ea2b8f5ef5365f421111322969
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI)file a complaint online →

To: Federal Commissioner for Data Protection (BfDI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website evergabe.de.

2. Circumstances
I visited the website evergabe.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Google Tag Manager (GTM-PGQ2TZ, +852 ms) and Google reCAPTCHA (www.google.com/recaptcha/api.js, +852 ms) activate simultaneously — a full second before the Usercentrics loader (+1900 ms). Both transmit data to Google's servers without consent.

2) Google Analytics 4 (tid=G-XTTERB4HCG), via GTM, triggers a request to region1.google-analytics.com/g/collect at +2612 ms — before the Usercentrics banner appears (+2688 ms, session/1px.png). GA4 receives a full set of parameters: tid, gtm, session parameters, traffic origin. The policy declares GA (Universal Analytics / Google Optimize), not GA4.

3) Microsoft Bot Framework (cdn.botframework.com/botframework-webchat/latest/webchat.js, +2334 ms) — a chat widget powered by Microsoft Azure Bot Services — loads with no consent. Not mentioned in the privacy policy.

4) The privacy policy contains clear traces of machine translation into Russian ('eVeregung.de', 'eVerbung.de' instead of 'eVergabe.de') and describes the discontinued services Google Universal Analytics and Google Optimize (both retired by Google in 2023–2024), rather than the current GA4. Usercentrics, Bot Framework, Storyblok, and Google Fonts are not mentioned.

Full technical documentation is published at: https://gdpru.eu/en/audits/de-evergabe-de/

3. Provisions violated
GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 13(1)(e); GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]