Policy changed — see what exactly · 2026-08-11 →
Germany's federal public procurement portal. 65 requests, 13 domains. Next.js, CloudWAF. Figtree Variable Font served locally. GTM and reCAPTCHA fire before the Usercentrics banner. GA4 is active before the banner is displayed. Bot Framework is undeclared. The policy is a machine translation describing already-discontinued services.
Timeline of the leak
Declared versus actual
Transfer timings
GTM-PGQ2TZ. Before the banner.
Google reCAPTCHA. Before the banner.
GA4 G-XTTERB4HCG. Before the banner is displayed.
Microsoft Bot Framework. Undeclared.
Detected trackers
- Google Tag Manager (www.googletagmanager.com) — tag container, before the banner
- Google reCAPTCHA (www.google.com, www.gstatic.com) — before the banner
- Google Analytics 4 (region1.google-analytics.com) — before the banner
- Google Fonts / Roboto (fonts.gstatic.com) — via a reCAPTCHA iframe
- Microsoft Bot Framework (cdn.botframework.com) — a chatbot, undeclared
- Usercentrics (web.cmp.usercentrics.eu et al.) — CMP
Indicators of GDPR non-compliance
- GDPR Art. 5(1)(a); TDDDG § 25(1)Google Tag Manager (GTM-PGQ2TZ, +852 ms) and Google reCAPTCHA (www.google.com/recaptcha/api.js, +852 ms) activate simultaneously — a full second before the Usercentrics loader (+1900 ms). Both transmit data to Google's servers without consent.
- GDPR Art. 5(1)(a); TDDDG § 25(1)Google Analytics 4 (tid=G-XTTERB4HCG), via GTM, triggers a request to region1.google-analytics.com/g/collect at +2612 ms — before the Usercentrics banner appears (+2688 ms, session/1px.png). GA4 receives a full set of parameters: tid, gtm, session parameters, traffic origin. The policy declares GA (Universal Analytics / Google Optimize), not GA4.
- GDPR Art. 13(1)(e)Microsoft Bot Framework (cdn.botframework.com/botframework-webchat/latest/webchat.js, +2334 ms) — a chat widget powered by Microsoft Azure Bot Services — loads with no consent. Not mentioned in the privacy policy.
- GDPR Art. 13(1)(e)The privacy policy contains clear traces of machine translation into Russian ('eVeregung.de', 'eVerbung.de' instead of 'eVergabe.de') and describes the discontinued services Google Universal Analytics and Google Optimize (both retired by Google in 2023–2024), rather than the current GA4. Usercentrics, Bot Framework, Storyblok, and Google Fonts are not mentioned.
Context
eVergabe.de is Germany’s official federal public procurement portal, publishing tenders and public procurement procedures. Sensitivity is high: the site processes data belonging to bid participants and public procuring entities. Next.js, CloudWAF. HAR: 65 requests, 13 domains.
GTM and reCAPTCHA — before the banner
At +852 ms, GTM (GTM-PGQ2TZ) and Google reCAPTCHA (render=6LfYf_kqAAAAACp89Dmqpzs2OO4FKZ6T_m8DUe22) load simultaneously. Usercentrics appears at +1900 ms — a second later. GA4 (G-XTTERB4HCG), via GTM, sends g/collect at +2612 ms — before the banner is displayed (+2688 ms). Google Fonts (Roboto, two weights) loads via a reCAPTCHA iframe at +3591 ms.
The policy — a machine translation with outdated content
The privacy policy is written in Russian with clear artifacts of machine translation: instead of “eVergabe.de,” the text reads “eVeregung.de” and “eVerbung.de.” The services it describes — Google Universal Analytics and Google Optimize — were discontinued by Google in 2023 and 2024, respectively. In their place, GA4 is actually running, and it is not mentioned in the policy. Usercentrics, Bot Framework, Storyblok, and Google Fonts are all absent from the policy.
Microsoft Bot Framework — undeclared
cdn.botframework.com/botframework-webchat/latest/webchat.js (+2334 ms) is the SDK for Microsoft Azure Bot Services’ chat widget. It loads before the banner and is not mentioned in the policy. For a public procurement portal whose users may enter sensitive tender data, this is a substantial gap.
Storyblok — direct requests to a CDN
One image (a.storyblok.com) loads directly, bypassing the Next.js image proxy — the visitor’s IP address is transmitted to Storyblok’s servers. Storyblok is not declared in the policy.
Conclusion
www.evergabe.de shows systemic non-compliance: GTM and reCAPTCHA are active before the banner, GA4 is undeclared, and Bot Framework is unmentioned. The privacy policy describes discontinued services and bears the marks of machine translation. For a public procurement portal handling especially sensitive data, this is an unusually low level of GDPR compliance.
d6c4d270fe9e5ec589b60e69b9439266388dd5ea2b8f5ef5365f421111322969Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →
To: Federal Commissioner for Data Protection (BfDI)
From: [Your name], [contact email]
1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website evergabe.de.
2. Circumstances
I visited the website evergabe.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:
1) Google Tag Manager (GTM-PGQ2TZ, +852 ms) and Google reCAPTCHA (www.google.com/recaptcha/api.js, +852 ms) activate simultaneously — a full second before the Usercentrics loader (+1900 ms). Both transmit data to Google's servers without consent.
2) Google Analytics 4 (tid=G-XTTERB4HCG), via GTM, triggers a request to region1.google-analytics.com/g/collect at +2612 ms — before the Usercentrics banner appears (+2688 ms, session/1px.png). GA4 receives a full set of parameters: tid, gtm, session parameters, traffic origin. The policy declares GA (Universal Analytics / Google Optimize), not GA4.
3) Microsoft Bot Framework (cdn.botframework.com/botframework-webchat/latest/webchat.js, +2334 ms) — a chat widget powered by Microsoft Azure Bot Services — loads with no consent. Not mentioned in the privacy policy.
4) The privacy policy contains clear traces of machine translation into Russian ('eVeregung.de', 'eVerbung.de' instead of 'eVergabe.de') and describes the discontinued services Google Universal Analytics and Google Optimize (both retired by Google in 2023–2024), rather than the current GA4. Usercentrics, Bot Framework, Storyblok, and Google Fonts are not mentioned.
Full technical documentation is published at: https://gdpru.eu/en/audits/de-evergabe-de/
3. Provisions violated
GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 13(1)(e); GDPR Art. 13(1)(e)
4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.
5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.
[Date] [Signature / name]