RU EN
www.
Technical audit · 29.05.2026

rki.de

Germany's Federal Institute for Infectious Diseases
DE

Germany's federal institute for infectious diseases. 31 requests, 1 domain. GSB platform. Lato served locally. Matomo via piwik.itzbund.de only with consent (Art. 6(1)(a)). YouTube via a click-triggered lightbox — no preloading. A GSB cookie banner with no external CMP. Set-Cookie — zero. Not a single external domain.

Request timeline

+0 ms · homepage
www.rki.de/DE/Home/home_node.html — HTML, Apache, GSB. The CSP explicitly permits script-src only to piwik.itzbund.de and youtube.com — neither domain is active in the HAR.
+113 ms · styles
GSB CSS bundles (_libs, small, medium, large, xlarge, custom, addon_usability, addon_print) — all local.
+256 ms · fonts
Lato (Regular, Italic, 700) — three woff2 files from /static/fonts/Lato/, all local. No Google Fonts.
+464 ms · JS bundles
bundle_lightbox.js, bundle_imagesourcelightbox.js, bundle_slideshow_dots.js, bundle_multimedia.js, global.js — all local. The lightbox for YouTube videos loads with no preloading of the YouTube iframe.
+518 ms · cookie banner
www.rki.de/SiteGlobals/Modules/CookieBanner/DE/Allgemein/CookieBanner.html — GSB's proprietary cookie banner, with no OneTrust, Cookiebot, or other external CMP.

Declared versus actual

✓ Matomo (piwik.itzbund.de / ITZBund) — only after consent, Art. 6(1)(a) — declared
✓ YouTube (Google Ireland Limited) — embedded via a lightbox on user click — declared
✓ Social media — YouTube, LinkedIn, BlueSky, Mastodon (social.bund.de), as external platforms — declared

Context

RKI (Robert Koch-Institut) is a federal institute under the Federal Ministry of Health. It conducts epidemiological surveillance and publishes scientific recommendations and outbreak data. Sensitivity is high. HAR: 31 requests, 1 domain, Apache, GSB.

Lato served locally, no Google Fonts

RKI uses the Lato typeface (Regular, Italic, Bold) — three woff2 files from /static/fonts/Lato/. Lato was designed by Polish designer Łukasz Dziedzic and is widely distributed via Google Fonts, yet RKI hosts it locally, eliminating requests to Google’s servers on page load.

The CSP includes piwik.itzbund.de among permitted script sources. The privacy policy states explicitly that Matomo activates only after the user’s consent has been obtained (Art. 6(1)(a) DSGVO). Data is processed on ITZBund servers in Germany and is not transmitted to third parties. There are no requests to piwik.itzbund.de in the homepage HAR — the tracker was not activated.

YouTube via a lightbox — no preloading

The homepage features a video teaser (Erklärvideo RKI 2023). bundle_multimedia.js and bundle_lightbox.js load — the infrastructure for the embedded player. A request to Erklaerfilm_RKI_DE_2023.html?view=renderLightbox (+520 ms) returns an HTML wrapper that only initiates the YouTube iframe on user click. There are no requests to youtube.com or ytimg.com in the HAR — no preloading occurs, and no data is transmitted to YouTube before the click.

The cookie banner is implemented via GSB’s own module (SiteGlobals/Modules/CookieBanner/). Neither OneTrust, Cookiebot, nor Cookie Script appears in the HAR. Set-Cookie — zero.

Conclusion

www.rki.de does not transmit visitor data to third parties on first visit. One domain, local resources, Matomo strictly behind the consent barrier, YouTube with no iframe preloading. No GDPR violations recorded at the time of the audit.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/rki-de-2026-05-29.har
SHA-256: 740c49169ca42665dba505f7bf432a98c5d74f3b5be4e44c9c02485b4144d311
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — rki.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website rki.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-rki-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]