Technical audit · 2026-05-29

service.bund.de

Germany's Federal Job and Public Services Portal

Germany's federal job and public services portal, operated by the Bundesverwaltungsamt (BVA). 27 requests, 1 domain. GSB platform. Fonts via the system font stack. No cookie banner — only technically necessary session cookies (JSESSIONID), no consent required under § 25(2) TDDDG. The CSP permits geodatenzentrum.de (BKG) for maps — inactive in the HAR. Set-Cookie — zero. Not a single external domain.

Timeline of the leak

+0 ms · homepage
www.service.bund.de/Content/DE/Home/homepage_node.html — HTML, Apache, GSB. The Permissions-Policy explicitly disables camera, geolocation, microphone, payment, interest-cohort.
+139 ms · styles
leaflet.css, styles.css, additional.css, addon_forms.css, print.css — all local. Leaflet is used for maps on internal pages; no map tiles load on the homepage.
+141 ms · scripts and images
_basic.js, _base.js, _enhanced_Startseite.js, global.js — local. Teaser images for partner portals (GovData, D115, Geoportal, etc.) — all from www.service.bund.de.
+549 ms · logo and favicon
logo.png, favicon.ico — local. No requests to external resources.

Declared versus actual

JSESSIONID — a technically necessary session cookie, § 25(2) TDDDG — заявлен
BKG (geodatenzentrum.de) — mentioned for displaying maps, IP address transmitted to BKG — заявлен
Newsletter — mentioned as a separate consent-based service — заявлен

Context

service.bund.de is a federal portal operated by the Bundesverwaltungsamt (BVA, the Federal Office of Administration, Cologne). It aggregates job openings and tender notices from federal, state, and municipal authorities. GSB platform, Apache. HAR: 27 requests, 1 domain.

A minimalist architecture with no external dependencies

All 27 requests go exclusively to www.service.bund.de. The stack is GSB (Gemeinsames Servicezentrum der Bundesbehörden): standard CSS bundles, three local JS files. Fonts are drawn from the browser’s system font stack — there are no woff/woff2 files in the HAR. Icons for partner-portal teasers (GovData, D115, Geoportal, juris, etc.) are hosted locally. Leaflet.css is present as the styling for maps used on internal pages — no map tiles loaded on the homepage.

Permissions-Policy — an explicit restriction on browser APIs

The Permissions-Policy header explicitly disallows access to camera, geolocation, gyroscope, magnetometer, microphone, payment, usb, and interest-cohort (FLoC). The last item is a deliberate signal rejecting behavioral profiling at the browser API level.

BKG — federal cartography instead of Google Maps

The CSP includes img-src *.geodatenzentrum.de — the source for map tiles from the Bundesamt für Kartographie und Geodäsie (BKG). The privacy policy explains that when a map loads, the IP address is transmitted to BKG solely for protection against cyberattacks, with no further transfer. There are no requests to geodatenzentrum.de in the homepage HAR — the map was not displayed.

Cookies with no banner — by law

The policy declares only JSESSIONID — a session cookie for server load balancing. Legal basis: § 25 Abs. 2 Ziffer 2 TDDDG (technically necessary cookies, no consent required). Set-Cookie — zero in the HAR: a cookie is set only during active sessions (logging into the personal account, subscribing to the newsletter).

Conclusion

www.service.bund.de does not transmit visitor data to third parties. One domain, no external SDKs, no trackers, no cookie banner — and none is needed, since only technically necessary session cookies are used. No GDPR violations recorded at the time of the audit.

Evidence
Original (audit)
HAR file: de/service-bund-de-2026-05-29.har
SHA-256: 17e424c4f932c0e1cfe4b488309b52b54928eea17895547b43b1ada058d4a215
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.