RU EN
www.
Technical audit · 2026-05-29

zdf.de

German Public Broadcaster
DE

ZDF — Germany's largest public broadcaster. 205 requests, 5 domains — all German. ZDFType, ZDFMicro, 3satHurme — all served locally. No Google, no Meta, no Piano Analytics. The only external tracker is Sentry via Jakala, without consent. Next.js (Turbopack).

Timeline of the leak

+91 ms · fonts and styles
19 corporate typefaces served locally: ZDFType (Regular, Medium, Bold, Heavy), ZDFTypeCond (5 weights), ZDFMicro (4 weights), 3satHurme (5 weights). Next.js CSS chunks (80+ files) and JS bundles — all from www.zdf.de.
+1082 ms · Sentry
sentry.jakala.services/api/22/envelope — three Sentry requests carrying browser performance and JS error data. No consent banner.
+1082 ms · api.zdf.de
api.zdf.de/graphql — a GraphQL API (6 requests): live broadcasts, the EPG schedule, cluster lists. ZDF's internal infrastructure.
+1082 ms · ssl.zdf.de
ssl.zdf.de/geo/ — geolocation for content geo-blocking (403 for de and dach, 200 for ebu). ZDF's internal infrastructure.

Declared versus actual

✓ External service providers (Externe Dienstleister) — mentioned in general terms, no names given — заявлен
✓ Rundfunkdatenschutzbeauftragter — documented as the supervisory body — заявлен
+ Sentry / Jakala (sentry.jakala.services) — not mentioned — не заявлен

Transfer timings

+1082 ms sentry.jakala.services

Sentry envelope. Jakala GmbH. Error monitoring. Germany.

Detected trackers

Indicators of GDPR non-compliance

Context

ZDF (Zweites Deutsches Fernsehen) is Germany’s second federal public broadcaster. Funded by the Rundfunkbeitrag — the mandatory broadcasting fee. Jointly with ARD, it operates a number of channels: 3sat, Arte, KiKA, ZDFneo. Next.js (Turbopack) — a modern framework, a complete overhaul of the previous architecture. HAR: 205 requests, 5 domains — all within German infrastructure.

Corporate typefaces — 19 files served locally

ZDF uses three corporate typeface families: ZDFType (Regular, Medium, Bold, Heavy), ZDFTypeCond (Light, Regular, Medium, Bold, Heavy — for headlines), ZDFMicro (Light, Regular, Medium, Bold — for interface elements). Additionally, 3satHurme (Black, Bold, Light, Regular, SemiBold) for the co-managed channel 3sat. All 19 woff2 files are hosted locally at /_next/static/media/. No Adobe Fonts, no Google Fonts.

Sentry via Jakala — error monitoring without consent

At +1082 ms, ZDF sends three envelope requests to sentry.jakala.services. Sentry is an open-source error monitoring system, with a self-hosted instance deployed by Jakala GmbH (a German digital agency, Munich). The Sentry envelope carries browser performance data, JS error traces, and session metadata. This is not an advertising tracker, but it is an external recipient of the user’s technical data, absent consent.

ZDF’s privacy policy (version dated 25.03.2026) is a short page referring to a “detailed description above” without actually containing one. Jakala and Sentry are not mentioned in it.

ARD vs. ZDF — two approaches

ARD uses Piano Analytics (h-cdn.com / pa-cd.com) with no banner, based on its public broadcasting mandate. ZDF does not use Piano Analytics — there are no traces of AT Internet in the HAR either. It is possible ZDF implements audience measurement differently, or has forgone it entirely on the public site. The only external data recipient — Sentry via Jakala — is not an audience-measurement tool.

Set-Cookie — zero

Not one of the 205 requests sets a cookie via Set-Cookie.

Conclusion

zdf.de demonstrates an architecture fundamentally different from most media portals in the Irish series: no Google Analytics, no GTM, no Meta, no ad networks. The one violation is Sentry via Jakala, with no banner and no documentation. For a public broadcaster funded by a mandatory fee paid by citizens, this places it substantially below the violation threshold seen at most sites audited in the German series.

Evidence
Original (audit)
HAR file: de/zdf-de-2026-05-29.har
SHA-256: b2f7ae4669cbca484afd079975ab8e1dbb52f9479d48b900ffd25e5a8e6312ca
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

To: Federal Commissioner for Data Protection (BfDI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website zdf.de.

2. Circumstances
I visited the website zdf.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) sentry.jakala.services/api/22/envelope — the Sentry SDK sends three envelope requests carrying browser session, performance, and JS error data (+1082 ms). Jakala is a German digital agency running a self-hosted Sentry instance. The requests occur with no cookie banner and no consent. The privacy policy (a short version) does not mention Sentry or Jakala as data recipients.

Full technical documentation is published at: https://gdpru.eu/en/audits/de-zdf-de/

3. Provisions violated
GDPR Art. 13(1)(e); TDDDG § 25

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]