The official city portal of Munich. 106 requests, 9 domains. Drupal CMS. Roboto Condensed and Open Sans served locally. etracker without cookies, on Art. 6(1)(f), active before the banner. Usercentrics as the CMP — not mentioned in the policy. sso.muenchen.de — Keycloak SSO for city services.
Timeline of the leak
Declared versus actual
Transfer timings
etracker web analytics. etracker GmbH, Hamburg. Art. 6(1)(f). Cookieless.
Detected trackers
- etracker (static.etracker.com, code.etracker.com) — cookieless web analytics, before the banner
Indicators of GDPR non-compliance
- GDPR Art. 5(1)(a); TDDDG § 25(1)etracker's e.js loads at the same time as the Usercentrics loader (+123 ms), before the consent banner is displayed. The policy justifies this via Art. 6(1)(f) (legitimate interest) and declares a cookieless mode with no user identification, processing data exclusively in Germany. Nonetheless, etracker receives browser, URL, and user-behavior data before any interaction with the banner.
- GDPR Art. 13(1)(e)Usercentrics (app.usercentrics.eu, privacy-proxy.usercentrics.eu, api.usercentrics.eu) — the CMP platform, making 9 requests — is not mentioned in the privacy policy, either by name or in a section on cookies or technical partners.
Context
Portal München is Munich’s official city information portal, operated by the Landeshauptstadt München (LHM). Drupal CMS, Fastly CDN. HAR: 106 requests, 9 domains.
etracker without cookies — before the banner
At +123 ms, two etracker scripts load: static.etracker.com/code/e.js and code.etracker.com/code/e.js. This happens at the same time as the Usercentrics loader — the banner won’t appear until +755 ms.
The privacy policy justifies etracker via Art. 6(1)(f) DSGVO (legitimate interest) and describes a cookieless mode: data is pseudonymized, processed exclusively in Germany, not shared with third parties, and Do Not Track is respected. etracker GmbH does indeed offer cookieless analytics — this is a differentiating feature of the service. Nonetheless, browser, URL, and behavioral data goes to etracker before any interaction with the banner. The lawfulness of Art. 6(1)(f) for consent-free analytics remains a subject of debate in German supervisory practice.
Usercentrics — undeclared
Usercentrics makes 9 requests: the loader, three UI modules, settings, translations, a 1px session pixel. The settingsId 8cHg-EU0P identifies the banner configuration. Yet neither “Usercentrics,” nor “Consent Management Platform,” nor any other description of a CMP platform is mentioned in the privacy policy.
City infrastructure: SSO and MDE
sso.muenchen.de implements Keycloak OpenID Connect — single sign-on for Munich’s digital city services. Session-state checks (login-status-iframe.html/init) and 3p-cookies checks take place within Munich’s own infrastructure. assets.muenchen.de serves CSS for the MDE (München Design Elements) city design system, version 1.1.15. muenchenapis.de/proxies/dbs-login/proxy.php — a proprietary proxy for authorization.
Fonts — local
Roboto Condensed and Open Sans — five woff2 files from the Drupal theme’s directory. No Google Fonts.
Conclusion
www.muenchen.de has two violations: etracker is active before the banner, based on legitimate interest — a legal basis that is disputed in the context of TDDDG; and Usercentrics, as the CMP, is not declared in the policy. The city’s own infrastructure (SSO, MDE, muenchenapis) is implemented entirely with proprietary tools.
5e15647aca730c699b95f115a431143cb548351fb8d3f7c325089f05fab67ae0Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →
To: Federal Commissioner for Data Protection (BfDI) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website muenchen.de. 2. Circumstances I visited the website muenchen.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) etracker's e.js loads at the same time as the Usercentrics loader (+123 ms), before the consent banner is displayed. The policy justifies this via Art. 6(1)(f) (legitimate interest) and declares a cookieless mode with no user identification, processing data exclusively in Germany. Nonetheless, etracker receives browser, URL, and user-behavior data before any interaction with the banner. 2) Usercentrics (app.usercentrics.eu, privacy-proxy.usercentrics.eu, api.usercentrics.eu) — the CMP platform, making 9 requests — is not mentioned in the privacy policy, either by name or in a section on cookies or technical partners. Full technical documentation is published at: https://gdpru.eu/en/audits/de-muenchen-de/ 3. Provisions violated GDPR Art. 5(1)(a); TDDDG § 25(1); GDPR Art. 13(1)(e) 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]