Technical audit · 2026-05-29

muenchen.de

Official City Portal of Bavaria's Capital

The official city portal of Munich. 106 requests, 9 domains. Drupal CMS. Roboto Condensed and Open Sans served locally. etracker without cookies, on Art. 6(1)(f), active before the banner. Usercentrics as the CMP — not mentioned in the policy. sso.muenchen.de — Keycloak SSO for city services.

Timeline of the leak

+0 ms · homepage
www.muenchen.de/ — HTML, Drupal CMS, Fastly CDN (x-cache: HIT). Varnish cache.
+118 ms · Drupal styles
Numerous CSS files from themes/contrib/stable/ and themes/custom/muenchen/ — all local.
+123 ms · etracker and the Usercentrics loader — simultaneously
static.etracker.com/code/e.js and code.etracker.com/code/e.js load at the same moment as app.usercentrics.eu/browser-ui/latest/loader.js and privacy-proxy.usercentrics.eu/latest/uc-block.bundle.js. etracker is active before the banner is displayed.
+124 ms · muenchenapis.de
muenchenapis.de/proxies/dbs-login/proxy.php — a proprietary proxy for checking the user's authorization status via the city's infrastructure.
+256 ms · fonts
Roboto Condensed (latin, regular, 700) and Open Sans (latin, regular, 700, italic) — five woff2 files from themes/custom/muenchen/assets/fonts/, all local.
+394 ms · assets.muenchen.de
assets.muenchen.de/mde/1.1.15/css/style.css — CSS for the city's MDE (München Design Elements) design system.
+502 ms · sso.muenchen.de
sso.muenchen.de/auth/realms/public/protocol/openid-connect/ — Keycloak OpenID Connect: checking the login-iframe state and 3p-cookies. Proprietary authentication infrastructure for city services.
+755 ms · Usercentrics banner
app.usercentrics.eu/session/1px.png (settingsId=8cHg-EU0P) — the banner appears at roughly +755 ms. By this point, etracker has already been running for over 600 ms.

Declared versus actual

etracker — declared, Art. 6(1)(f), cookieless, processing in Germany — заявлен
sso.muenchen.de (Keycloak) — proprietary SSO infrastructure — заявлен
Stadtwerke München — a map of Munich, mentioned in the policy — заявлен
+ Usercentrics (app.usercentrics.eu, privacy-proxy.usercentrics.eu, api.usercentrics.eu) — not mentioned — не заявлен

Transfer timings

+123 ms static.etracker.com / code.etracker.com

etracker web analytics. etracker GmbH, Hamburg. Art. 6(1)(f). Cookieless.

Detected trackers

Indicators of GDPR non-compliance

Context

Portal München is Munich’s official city information portal, operated by the Landeshauptstadt München (LHM). Drupal CMS, Fastly CDN. HAR: 106 requests, 9 domains.

etracker without cookies — before the banner

At +123 ms, two etracker scripts load: static.etracker.com/code/e.js and code.etracker.com/code/e.js. This happens at the same time as the Usercentrics loader — the banner won’t appear until +755 ms.

The privacy policy justifies etracker via Art. 6(1)(f) DSGVO (legitimate interest) and describes a cookieless mode: data is pseudonymized, processed exclusively in Germany, not shared with third parties, and Do Not Track is respected. etracker GmbH does indeed offer cookieless analytics — this is a differentiating feature of the service. Nonetheless, browser, URL, and behavioral data goes to etracker before any interaction with the banner. The lawfulness of Art. 6(1)(f) for consent-free analytics remains a subject of debate in German supervisory practice.

Usercentrics — undeclared

Usercentrics makes 9 requests: the loader, three UI modules, settings, translations, a 1px session pixel. The settingsId 8cHg-EU0P identifies the banner configuration. Yet neither “Usercentrics,” nor “Consent Management Platform,” nor any other description of a CMP platform is mentioned in the privacy policy.

City infrastructure: SSO and MDE

sso.muenchen.de implements Keycloak OpenID Connect — single sign-on for Munich’s digital city services. Session-state checks (login-status-iframe.html/init) and 3p-cookies checks take place within Munich’s own infrastructure. assets.muenchen.de serves CSS for the MDE (München Design Elements) city design system, version 1.1.15. muenchenapis.de/proxies/dbs-login/proxy.php — a proprietary proxy for authorization.

Fonts — local

Roboto Condensed and Open Sans — five woff2 files from the Drupal theme’s directory. No Google Fonts.

Conclusion

www.muenchen.de has two violations: etracker is active before the banner, based on legitimate interest — a legal basis that is disputed in the context of TDDDG; and Usercentrics, as the CMP, is not declared in the policy. The city’s own infrastructure (SSO, MDE, muenchenapis) is implemented entirely with proprietary tools.

Evidence
Original (audit)
HAR file: de/muenchen-de-2026-05-29.har
SHA-256: 5e15647aca730c699b95f115a431143cb548351fb8d3f7c325089f05fab67ae0
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI)file a complaint online →

To: Federal Commissioner for Data Protection (BfDI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website muenchen.de.

2. Circumstances
I visited the website muenchen.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) etracker's e.js loads at the same time as the Usercentrics loader (+123 ms), before the consent banner is displayed. The policy justifies this via Art. 6(1)(f) (legitimate interest) and declares a cookieless mode with no user identification, processing data exclusively in Germany. Nonetheless, etracker receives browser, URL, and user-behavior data before any interaction with the banner.

2) Usercentrics (app.usercentrics.eu, privacy-proxy.usercentrics.eu, api.usercentrics.eu) — the CMP platform, making 9 requests — is not mentioned in the privacy policy, either by name or in a section on cookies or technical partners.

Full technical documentation is published at: https://gdpru.eu/en/audits/de-muenchen-de/

3. Provisions violated
GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 13(1)(e)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]