RU EN
www.
Technical audit · 29.05.2026

zdf.de

German Public Broadcaster
DE

Policy changed — see what exactly · 2026-09-05 →

ZDF — Germany's largest public broadcaster. 205 requests, 5 domains — all German. ZDFType, ZDFMicro, 3satHurme — all served locally. No Google, no Meta, no Piano Analytics. The only external tracker is Sentry via Jakala, without consent. Next.js (Turbopack).

Request timeline

+91 ms · fonts and styles
19 corporate typefaces served locally: ZDFType (Regular, Medium, Bold, Heavy), ZDFTypeCond (5 weights), ZDFMicro (4 weights), 3satHurme (5 weights). Next.js CSS chunks (80+ files) and JS bundles — all from www.zdf.de.
+1082 ms · Sentry
sentry.jakala.services/api/22/envelope — three Sentry requests carrying browser performance and JS error data. No consent banner.
+1082 ms · api.zdf.de
api.zdf.de/graphql — a GraphQL API (6 requests): live broadcasts, the EPG schedule, cluster lists. ZDF's internal infrastructure.
+1082 ms · ssl.zdf.de
ssl.zdf.de/geo/ — geolocation for content geo-blocking (403 for de and dach, 200 for ebu). ZDF's internal infrastructure.

Declared versus actual

✓ External service providers (Externe Dienstleister) — mentioned in general terms, no names given — declared
✓ Rundfunkdatenschutzbeauftragter — documented as the supervisory body — declared
+ Sentry / Jakala (sentry.jakala.services) — not mentioned — not declared

Transfer timings

+1082 ms sentry.jakala.services

Sentry envelope. Jakala GmbH. Error monitoring. Germany.

Detected trackers

Context

ZDF (Zweites Deutsches Fernsehen) is Germany’s second federal public broadcaster. Funded by the Rundfunkbeitrag — the mandatory broadcasting fee. Jointly with ARD, it operates a number of channels: 3sat, Arte, KiKA, ZDFneo. Next.js (Turbopack) — a modern framework, a complete overhaul of the previous architecture. HAR: 205 requests, 5 domains — all within German infrastructure.

Corporate typefaces — 19 files served locally

ZDF uses three corporate typeface families: ZDFType (Regular, Medium, Bold, Heavy), ZDFTypeCond (Light, Regular, Medium, Bold, Heavy — for headlines), ZDFMicro (Light, Regular, Medium, Bold — for interface elements). Additionally, 3satHurme (Black, Bold, Light, Regular, SemiBold) for the co-managed channel 3sat. All 19 woff2 files are hosted locally at /_next/static/media/. No Adobe Fonts, no Google Fonts.

Sentry via Jakala — error monitoring without consent

At +1082 ms, ZDF sends three envelope requests to sentry.jakala.services. Sentry is an open-source error monitoring system, with a self-hosted instance deployed by Jakala GmbH (a German digital agency, Munich). The Sentry envelope carries browser performance data, JS error traces, and session metadata. This is not an advertising tracker, but it is an external recipient of the user’s technical data, absent consent.

ZDF’s privacy policy (version dated 25.03.2026) is a short page referring to a “detailed description above” without actually containing one. Jakala and Sentry are not mentioned in it.

ARD vs. ZDF — two approaches

ARD uses Piano Analytics (h-cdn.com / pa-cd.com) with no banner, based on its public broadcasting mandate. ZDF does not use Piano Analytics — there are no traces of AT Internet in the HAR either. It is possible ZDF implements audience measurement differently, or has forgone it entirely on the public site. The only external data recipient — Sentry via Jakala — is not an audience-measurement tool.

Set-Cookie — zero

Not one of the 205 requests sets a cookie via Set-Cookie.

Conclusion

zdf.de demonstrates an architecture fundamentally different from most media portals in the Irish series: no Google Analytics, no GTM, no Meta, no ad networks. The one finding is Sentry via Jakala, with no banner and no documentation. For a public broadcaster funded by a mandatory fee paid by citizens, this places it substantially below the finding threshold seen at most sites audited in the German series.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/zdf-de-2026-05-29.har
SHA-256: b2f7ae4669cbca484afd079975ab8e1dbb52f9479d48b900ffd25e5a8e6312ca
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — zdf.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website zdf.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-zdf-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Federal Commissioner for Data Protection (BfDI) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — zdf.de

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website zdf.de.

2. Circumstances
I visited the website zdf.de and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

Full technical documentation is published at: https://gdpru.eu/en/audits/de-zdf-de/

3. GDPR provisions I ask you to examine


4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]