RU EN
www.
Technical audit · 2026-05-29

rki.de

Germany's Federal Institute for Infectious Diseases
DE

Germany's federal institute for infectious diseases. 31 requests, 1 domain. GSB platform. Lato served locally. Matomo via piwik.itzbund.de only with consent (Art. 6(1)(a)). YouTube via a click-triggered lightbox — no preloading. A GSB cookie banner with no external CMP. Set-Cookie — zero. Not a single external domain.

Timeline of the leak

+0 ms · homepage
www.rki.de/DE/Home/home_node.html — HTML, Apache, GSB. The CSP explicitly permits script-src only to piwik.itzbund.de and youtube.com — neither domain is active in the HAR.
+113 ms · styles
GSB CSS bundles (_libs, small, medium, large, xlarge, custom, addon_usability, addon_print) — all local.
+256 ms · fonts
Lato (Regular, Italic, 700) — three woff2 files from /static/fonts/Lato/, all local. No Google Fonts.
+464 ms · JS bundles
bundle_lightbox.js, bundle_imagesourcelightbox.js, bundle_slideshow_dots.js, bundle_multimedia.js, global.js — all local. The lightbox for YouTube videos loads with no preloading of the YouTube iframe.
+518 ms · cookie banner
www.rki.de/SiteGlobals/Modules/CookieBanner/DE/Allgemein/CookieBanner.html — GSB's proprietary cookie banner, with no OneTrust, Cookiebot, or other external CMP.

Declared versus actual

✓ Matomo (piwik.itzbund.de / ITZBund) — only after consent, Art. 6(1)(a) — заявлен
✓ YouTube (Google Ireland Limited) — embedded via a lightbox on user click — заявлен
✓ Social media — YouTube, LinkedIn, BlueSky, Mastodon (social.bund.de), as external platforms — заявлен

Context

RKI (Robert Koch-Institut) is a federal institute under the Federal Ministry of Health. It conducts epidemiological surveillance and publishes scientific recommendations and outbreak data. Sensitivity is high. HAR: 31 requests, 1 domain, Apache, GSB.

Lato served locally, no Google Fonts

RKI uses the Lato typeface (Regular, Italic, Bold) — three woff2 files from /static/fonts/Lato/. Lato was designed by Polish designer Łukasz Dziedzic and is widely distributed via Google Fonts, yet RKI hosts it locally, eliminating requests to Google’s servers on page load.

The CSP includes piwik.itzbund.de among permitted script sources. The privacy policy states explicitly that Matomo activates only after the user’s consent has been obtained (Art. 6(1)(a) DSGVO). Data is processed on ITZBund servers in Germany and is not transmitted to third parties. There are no requests to piwik.itzbund.de in the homepage HAR — the tracker was not activated.

YouTube via a lightbox — no preloading

The homepage features a video teaser (Erklärvideo RKI 2023). bundle_multimedia.js and bundle_lightbox.js load — the infrastructure for the embedded player. A request to Erklaerfilm_RKI_DE_2023.html?view=renderLightbox (+520 ms) returns an HTML wrapper that only initiates the YouTube iframe on user click. There are no requests to youtube.com or ytimg.com in the HAR — no preloading occurs, and no data is transmitted to YouTube before the click.

The cookie banner is implemented via GSB’s own module (SiteGlobals/Modules/CookieBanner/). Neither OneTrust, Cookiebot, nor Cookie Script appears in the HAR. Set-Cookie — zero.

Conclusion

www.rki.de does not transmit visitor data to third parties on first visit. One domain, local resources, Matomo strictly behind the consent barrier, YouTube with no iframe preloading. No GDPR violations recorded at the time of the audit.

Evidence
Original (audit)
HAR file: de/rki-de-2026-05-29.har
SHA-256: 740c49169ca42665dba505f7bf432a98c5d74f3b5be4e44c9c02485b4144d311
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.