RU EN
www.
Technical audit · 29.05.2026

muenchen.de

Official City Portal of Bavaria's Capital
DE

Policy changed — see what exactly · 2026-08-26 →

The official city portal of Munich. 106 requests, 9 domains. Drupal CMS. Roboto Condensed and Open Sans served locally. etracker without cookies, on Art. 6(1)(f), active before the banner. Usercentrics as the CMP — not mentioned in the policy. sso.muenchen.de — Keycloak SSO for city services.

Request timeline

+0 ms · homepage
www.muenchen.de/ — HTML, Drupal CMS, Fastly CDN (x-cache: HIT). Varnish cache.
+118 ms · Drupal styles
Numerous CSS files from themes/contrib/stable/ and themes/custom/muenchen/ — all local.
+123 ms · etracker and the Usercentrics loader — simultaneously
static.etracker.com/code/e.js and code.etracker.com/code/e.js load at the same moment as app.usercentrics.eu/browser-ui/latest/loader.js and privacy-proxy.usercentrics.eu/latest/uc-block.bundle.js. etracker is active before the banner is displayed.
+124 ms · muenchenapis.de
muenchenapis.de/proxies/dbs-login/proxy.php — a proprietary proxy for checking the user's authorization status via the city's infrastructure.
+256 ms · fonts
Roboto Condensed (latin, regular, 700) and Open Sans (latin, regular, 700, italic) — five woff2 files from themes/custom/muenchen/assets/fonts/, all local.
+394 ms · assets.muenchen.de
assets.muenchen.de/mde/1.1.15/css/style.css — CSS for the city's MDE (München Design Elements) design system.
+502 ms · sso.muenchen.de
sso.muenchen.de/auth/realms/public/protocol/openid-connect/ — Keycloak OpenID Connect: checking the login-iframe state and 3p-cookies. Proprietary authentication infrastructure for city services.
+755 ms · Usercentrics banner
app.usercentrics.eu/session/1px.png (settingsId=8cHg-EU0P) — the banner appears at roughly +755 ms. By this point, etracker has already been running for over 600 ms.

Declared versus actual

✓ etracker — declared, Art. 6(1)(f), cookieless, processing in Germany — declared
✓ sso.muenchen.de (Keycloak) — proprietary SSO infrastructure — declared
✓ Stadtwerke München — a map of Munich, mentioned in the policy — declared
+ Usercentrics (app.usercentrics.eu, privacy-proxy.usercentrics.eu, api.usercentrics.eu) — not mentioned — not declared

Transfer timings

+123 ms static.etracker.com / code.etracker.com

etracker web analytics. etracker GmbH, Hamburg. Art. 6(1)(f). Cookieless.

Detected trackers

Context

Portal München is Munich’s official city information portal, operated by the Landeshauptstadt München (LHM). Drupal CMS, Fastly CDN. HAR: 106 requests, 9 domains.

etracker without cookies — before the banner

At +123 ms, two etracker scripts load: static.etracker.com/code/e.js and code.etracker.com/code/e.js. This happens at the same time as the Usercentrics loader — the banner won’t appear until +755 ms.

The privacy policy justifies etracker via Art. 6(1)(f) DSGVO (legitimate interest) and describes a cookieless mode: data is pseudonymized, processed exclusively in Germany, not shared with third parties, and Do Not Track is respected. etracker GmbH does indeed offer cookieless analytics — this is a differentiating feature of the service. Nonetheless, browser, URL, and behavioral data goes to etracker before any interaction with the banner. The lawfulness of Art. 6(1)(f) for consent-free analytics remains a subject of debate in German supervisory practice.

Usercentrics — undeclared

Usercentrics makes 9 requests: the loader, three UI modules, settings, translations, a 1px session pixel. The settingsId 8cHg-EU0P identifies the banner configuration. Yet neither “Usercentrics,” nor “Consent Management Platform,” nor any other description of a CMP platform is mentioned in the privacy policy.

City infrastructure: SSO and MDE

sso.muenchen.de implements Keycloak OpenID Connect — single sign-on for Munich’s digital city services. Session-state checks (login-status-iframe.html/init) and 3p-cookies checks take place within Munich’s own infrastructure. assets.muenchen.de serves CSS for the MDE (München Design Elements) city design system, version 1.1.15. muenchenapis.de/proxies/dbs-login/proxy.php — a proprietary proxy for authorization.

Fonts — local

Roboto Condensed and Open Sans — five woff2 files from the Drupal theme’s directory. No Google Fonts.

Conclusion

www.muenchen.de has two findings: etracker is active before the banner, based on legitimate interest — a legal basis that is disputed in the context of TDDDG; and Usercentrics, as the CMP, is not declared in the policy. The city’s own infrastructure (SSO, MDE, muenchenapis) is implemented entirely with proprietary tools.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/muenchen-de-2026-05-29.har
SHA-256: 5e15647aca730c699b95f115a431143cb548351fb8d3f7c325089f05fab67ae0
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — muenchen.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website muenchen.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-muenchen-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — muenchen.de

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website muenchen.de.

2. Circumstances
I visited the website muenchen.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

Full technical documentation is published at: https://gdpru.eu/en/audits/de-muenchen-de/

3. GDPR provisions I ask you to examine


4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]