Hamburg, Germany – October 22, 2023 – In an era where digital privacy is increasingly scrutinized, Tagesschau.de, the leading online news platform of Germany’s public broadcaster Norddeutscher Rundfunk (NDR), has released a comprehensive and stringent privacy policy. This updated framework underscores a profound commitment to data minimization, user control, and the complete absence of commercial advertising and tracking programs, setting a new benchmark for journalistic integrity in the digital realm. The policy, detailed meticulously by the NDR, aims to provide unparalleled transparency regarding data collection and usage, reinforcing the public service mission at its core.
The announcement comes as digital media consumption continues its exponential growth, bringing with it complex challenges for user data protection. Tagesschau.de’s proactive stance is designed to assure its vast audience that their interaction with the news platform remains untainted by the pervasive data harvesting common across much of the commercial internet. From foundational log data to the sophisticated mechanisms behind content delivery and statistical analysis, every aspect of data handling is meticulously outlined, emphasizing a user-centric approach guided by the strictures of the EU General Data Protection Regulation (GDPR).
Upholding the Public Service Mandate: NDR’s Foundational Approach to Data Protection
At the heart of Tagesschau.de’s privacy philosophy lies the Norddeutscher Rundfunk’s unwavering dedication to its public service broadcasting mandate. Unlike commercial entities driven by advertising revenues, NDR’s primary objective is to inform, educate, and entertain, free from commercial pressures. This fundamental difference profoundly shapes its data protection strategy, prioritizing the trust of its audience above all else.
A Decade of Digital Evolution and Evolving Privacy Standards
The journey towards this robust privacy framework is rooted in NDR’s continuous adaptation to the digital landscape. As online platforms evolved from simple websites to complex ecosystems integrating streaming media, social interactivity, and diverse content delivery mechanisms, so too did the legal and ethical considerations surrounding user data. The advent of the GDPR in 2018 marked a pivotal moment, harmonizing data protection laws across the European Union and empowering individuals with greater control over their personal information. Tagesschau.de’s latest policy is a testament to this ongoing evolution, demonstrating a commitment not just to compliance, but to exceeding expectations in safeguarding user privacy. It reflects a proactive response to the evolving digital environment, ensuring that journalistic independence is complemented by stringent data ethics.
The policy clearly identifies NDR as the data controller, represented by its Director General, with contact details provided for general inquiries. Furthermore, Dr. Heiko Neuhoff serves as the dedicated Data Protection Officer, offering an accessible point of contact for all privacy-related concerns, underscoring the broadcaster’s commitment to accountability and open dialogue with its users.
Dissecting the Digital Footprint: How Tagesschau.de Manages User Data
Tagesschau.de’s operations are designed with "data economy" as a guiding principle. This means that only essential data is processed, and critically, no user profiles are created for commercial exploitation. The absence of advertising inherently removes the incentive for extensive tracking programs, a stark contrast to many other news outlets.
The Core Principle: Data Minimization and Absence of Commercial Tracking
The cornerstone of Tagesschau.de’s privacy policy is an explicit commitment to data minimization. In an age where user data is often commodified, Tagesschau.de actively resists the creation of extensive user profiles. This fundamental decision means that the platform operates without any advertising-driven tracking programs that would otherwise monitor and log user behavior for commercial purposes. The direct implication for users is a browsing experience free from targeted advertisements and the unsettling feeling of being constantly monitored, allowing them to engage with news content purely for informational purposes, aligned with the public service ethos.
Essential Diagnostics: Logfiles and the Role of Content Delivery Networks
Despite the strong emphasis on data minimization, some data collection is indispensable for the functionality and security of any online platform. When users access Tagesschau.de, the system automatically records certain data in logfiles. While the exact details of these logfiles were not fully enumerated in the original text, typical entries include the IP address of the accessing device, browser and operating system information, the referring URL (the previous website visited), the name of the internet provider, and the date and time of page views, along with the volume of data transferred. This information is primarily used for technical troubleshooting, ensuring the stability and security of the service, and is stored only for a maximum of seven days before deletion.
To ensure rapid and reliable delivery of its content, especially large media files such as videos, Tagesschau.de utilizes a Content Delivery Network (CDN). This network consists of regionally distributed servers operated by technical service providers (contract processors). When content is requested, the user’s browser or application automatically transmits information to these CDN servers. These server logfiles, collected within the European Union, are subsequently anonymized – stripped of any personal identifiers – before being transmitted to the USA for processing. They are stored for a maximum of 90 days before automated deletion. The data collected by the CDN includes details similar to the internal logfiles, but also extends to technical, non-personal data for optimizing video quality, such as video start times, technically induced interruptions, loading times, received quality, and network information. Additionally, monitoring data (e.g., load times, transmission speed, file sizes) is collected to assess and improve the functionality and performance of the service on various end devices. This data is also processed within the EU and then anonymized before being sent to the USA for evaluation, with strict retention periods.
Measuring Reach, Not Individuals: The Nuances of Statistical Analysis
Separate from the technical log data, Tagesschau.de collects statistical data to gauge the acceptance and reach of its offerings. This is crucial for fulfilling its constitutional mandate to provide public information and understand how effectively it is serving its audience. These statistics help determine, for example, which content is frequently accessed or how often videos are viewed, enabling the editorial team to refine and improve its journalistic output. Importantly, these analyses serve purely journalistic objectives, devoid of any commercial or advertising intent.
For these statistical measurements, Tagesschau.de, like other ARD public broadcasting institutions, employs standardized procedures:
- AT Internet (A Piano Company): This service collects and stores anonymized information about website usage. It utilizes small image files or JavaScript embedded in web pages to measure access numbers, often via cookies. It also tracks audio and video usage within the player. The collected data is solely used for improving the service and is not otherwise shared with third parties.
- Nielsen ("AGF-Zählpixel"): Nielsen’s technology is used to anonymously collect and store information about video usage. This involves embedding a small image file or JavaScript into web pages to measure video consumption without the use of cookies. All IP addresses are stored in anonymized form, ensuring that no data can be used to personally identify website visitors. The data exclusively supports service improvement.
- GfK SE ("AGF-Single-Source" Measurement): This method, commissioned by AGF, measures video usage in a fully anonymous manner. An exception applies to users who are members of GfK’s television research panel; their usage can be identified and attributed, but only because they have explicitly consented to this data processing as part of their panel participation (Art. 6 Abs. 1 lit. 1 a) GDPR). All other measured usage remains completely anonymous. GfK employs a procedure called "sensic," operated via sensic.net, which, despite sometimes being misidentified by browser add-ons as an ad tracker, is emphatically confirmed by Tagesschau.de to be a statistical usage measurement and not advertising tracking.
Users are empowered with the option to prevent the collection of statistical data by AT Internet and Nielsen through a dedicated opt-out checkbox, providing an immediate layer of control. Furthermore, Tagesschau.de periodically conducts user surveys using Lamapoll to gather direct feedback, redirecting participants to Lamapoll’s servers, whose privacy policy is explicitly linked.
Cookies: Functional Necessity vs. Personal Tracking
Cookies, small text files stored temporarily on a user’s device by their internet browser, play a dual role in Tagesschau.de’s operations. Functional cookies are employed for purely technical reasons to enable access to the service, enhance user-friendliness, and ensure accessibility. These cookies store user settings (e.g., volume, subtitles, display size) and login information, operating under the legal basis of Art. 6 Abs. 1 lit. e) GDPR. Other cookies serve the statistical analysis purposes detailed above, helping to evaluate the acceptance and usage of the platform in line with its public service mission, justified under Art. 6 Abs. 1 S. 1 lit. e) or f) GDPR.
Crucially, Tagesschau.de is fully accessible without cookies. Most browsers automatically accept cookies, but users retain full control, able to deactivate cookie storage, configure their browser to notify them of cookie transmission, or delete stored cookies at any time.
Navigating the Interconnected Web: Third-Party Content and Platform Presences
The modern digital landscape is inherently interconnected, requiring news platforms to engage with various third-party services and social media to disseminate content effectively. Tagesschau.de navigates this complexity with specific safeguards.
Empowering User Choice: The "Two-Click Solution" for Embedded Content
Tagesschau.de frequently links to and integrates content from third-party providers, including social plugins from networks like Facebook and X (formerly Twitter), and functions from Instagram and YouTube, as well as data visualization tools. Recognizing the privacy implications of such integrations, Tagesschau.de employs a "two-click solution" to protect user data. This means that external content is not directly embedded. Instead, users are explicitly informed about the external content and the potential data transfer to third-party providers before it is displayed. Users must then actively consent to the data transfer by clicking to view the content. This explicit consent serves as the legal basis for data processing (Art. 6 Abs. 1 S. 1 lit. a GDPR), ensuring users retain agency over their data. Users also have the option to permanently agree to the display of embedded third-party content, with the selection stored in their browser, and this consent can be revoked at any time. Specific privacy policies for each third-party provider are linked for further user information. Additionally, for autoplay video previews of livestreams and videos, Tagesschau.de uses the "Spark" tool from Web Spark Ltd. in incognito mode, ensuring no personal data is processed during its use.
Beyond Tagesschau.de: Data Dynamics on Social Media and Smart Speakers
Tagesschau.de maintains a presence on various third-party platforms, such as social media networks. It is important to note that the operators of these platforms process user data according to their own privacy policies and settings, over which Tagesschau.de has no influence. These platforms may also set cookies to track user behavior across different websites and apps. To access Tagesschau.de content on these platforms, users typically need to register and agree to the respective terms and conditions and privacy policies. NDR cautions that these services may have different data protection standards than Tagesschau.de and is not liable for damages arising from their use.
When users comment on Tagesschau.de articles or share content via social networks, specific data handling rules apply. Commenting requires an email address, which is used for password recovery or notifications, and is not published (Art. 6 Abs. 1 lit. a) GDPR). Sharing content utilizes operating system-native sharing services, which may transmit usage data like IP addresses to the respective social network. Tagesschau.de itself does not receive additional data or access user data on these platforms. Users are also reminded that comments are publicly viewable, and any sensitive personal data disclosed in comments (Art. 9 Abs. 1 GDPR) is processed on the basis of the data subject having made it public (Art. 9 Abs. 2 lit. e) GDPR).
For its TikTok channel, Tagesschau.de confirms it receives no personal data from users. It also highlights TikTok’s age restriction (13 years) and the necessity of parental consent for users under 18.
Tagesschau.de’s WhatsApp channel provides one-way information. While users subscribe to a service of WhatsApp Ireland Limited (a Meta Platforms Ireland Limited subsidiary), Tagesschau.de has no control over WhatsApp’s or Meta’s data processing. WhatsApp collects information like IP addresses, device data, and usage patterns, which may be transferred outside the EU. Tagesschau.de only receives aggregated, anonymized statistical data on channel reach. Users should be aware that channel status messages are publicly visible, and personal information like profile names or pictures can also be public if not restricted in WhatsApp settings. Crucially, WhatsApp’s end-to-end encryption does not apply to channels.
Regarding Smart Speakers (e.g., Alexa, Google Play), direct access to Tagesschau.de content results in the automated collection of logfile data by NDR’s system. This includes device type, operating system, language, location, anonymized IP address, timestamp, and requested content. These data are not merged with other data sources, with the collection based on Art. 6 Abs. 1 S. 1 lit. f GDPR. While communication with voice assistants is recorded and stored in the cloud by the device provider, and data transfers to the USA by these providers are possible (a concern highlighted by the Schrems II ruling regarding lower data protection levels), NDR does not directly transfer personal data, as users typically consent to such processing through their registration with these service providers.
Transparency and Accountability: NDR’s Commitment to User Rights
The privacy policy serves as a testament to NDR’s profound commitment to transparency and accountability, particularly regarding the rights of individuals concerning their personal data.
Your Rights Under GDPR: A Comprehensive Overview
Under the GDPR, individuals whose personal data is processed are referred to as "data subjects." As a data subject interacting with Tagesschau.de, users are afforded a comprehensive suite of rights. These include:
- Right of Access (Art. 15 GDPR): The right to obtain confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data and specific information regarding its processing.
- Right to Rectification (Art. 16 GDPR): The right to demand the correction of inaccurate personal data and the completion of incomplete data.
- Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR): The right to request the deletion of personal data under certain conditions, for example, if the data is no longer necessary for the purposes for which it was collected.
- Right to Restriction of Processing (Art. 18 GDPR): The right to obtain restriction of processing under certain circumstances, such as when the accuracy of the data is contested.
- Right to Object (Art. 21 GDPR): The right to object to the processing of personal data for reasons relating to their particular situation, especially when processing is based on legitimate interests or the performance of a task carried out in the public interest.
- Right to Data Portability (Art. 20 GDPR): The right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance.
These rights empower users to actively manage their digital privacy and ensure that their personal information is handled responsibly and legally. Inquiries regarding these rights can be directed to the responsible party (NDR) or the Data Protection Officer.
The Supervisory Watchdog: Lodging Complaints and Seeking Redress
Beyond individual rights, the GDPR also grants data subjects the right to lodge a complaint with a supervisory authority if they believe their data protection rights have been violated. As Tagesschau.de is a joint institution of the ARD, headquartered at NDR in Hamburg, the primary supervisory authority is the Broadcasting Data Protection Officer of the NDR. Any data protection concerns or complaints regarding the use of Tagesschau.de should be addressed to this office. The current Broadcasting Data Protection Officer is Stephan Schwarze, located in Leipzig, and contact details including a complaint form are readily available. This independent oversight mechanism ensures an additional layer of accountability and a formal channel for resolving disputes. For users of the Tagesschau App, a separate, dedicated privacy policy is available directly within the application, acknowledging the specific technical and usage characteristics of mobile platforms.
Broader Implications: Setting a Standard for Public Broadcasters
Tagesschau.de’s comprehensive privacy policy extends beyond its immediate online offerings, reflecting a broader commitment by the NDR to data protection across all its operations. This holistic approach has significant implications, not only for its users but also for the wider landscape of public broadcasting.
The NDR Framework: General Data Processing Principles
The NDR’s general approach to processing personal data, regardless of online or app usage, is rooted in legal principles. Data such as name, contact details, date of birth, bank information, employer, ID details, and security-relevant data (e.g., images from video surveillance, access data, event photos) may be stored for various legitimate purposes. These include:
- Contract Initiation and Fulfillment (Art. 6 Abs. 1 lit. b) GDPR): To deliver services, process payments, or manage contractual obligations.
- Protection of Vital Interests (Art. 6 Abs. 1 lit. d) GDPR): For instance, sharing data in an emergency if the data subject is incapacitated.
- Performance of Public Interest Tasks (Art. 6 Abs. 1 lit. e) GDPR): This includes fulfilling NDR’s broadcasting and program mandate, such as processing listener mail or program complaints.
- Legitimate Interests (Art. 6 Abs. 1 lit. f) GDPR): For example, processing data for NDR’s external representation or exercising house rights (e.g., security interests).
The provision of such data is often a necessary part of contractual obligations or for accessing NDR premises or services. Failure to provide necessary data can result in the inability to offer contractual services or deny access. Where data processing is based on voluntary consent (Art. 6 Abs. 1 a), Art. 4 No. 11 GDPR), users have the right to withdraw this consent at any time without affecting the legality of processing prior to withdrawal.
Internally, data recipients are limited to specific NDR personnel entrusted with concrete, purpose-bound tasks (e.g., departmental staff, reception, security, event personnel), all bound by confidentiality obligations. Data is not shared with third parties unless explicit consent is given or legally mandated. Furthermore, NDR engages service providers for data processing under strict contractual agreements (Art. 28 GDPR), maintaining full data protection responsibility. These processors are also bound by confidentiality and security measures to protect personal data from loss or misuse. Personal data is stored until contractual relationships are terminated, claims resolved, and all legal or internal retention periods expire. Data processed for public interest or legitimate business interests is stored until its purpose is fulfilled and documentation is no longer required for legal or evidentiary purposes.
A Future-Proof Approach to Digital Journalism
Tagesschau.de’s comprehensive and user-centric privacy policy represents more than just legal compliance; it embodies a philosophical commitment to journalistic integrity in the digital age. By prioritizing data minimization, eschewing commercial tracking, and empowering users with transparent information and control, NDR sets a high standard for public broadcasters globally. It underscores the belief that trustworthy journalism thrives when audience trust is paramount, uncompromised by hidden data practices. In a media landscape increasingly fragmented and susceptible to data exploitation, Tagesschau.de’s updated policy offers a beacon of ethical practice, ensuring that its mission to inform remains steadfastly aligned with the privacy rights of its audience. This forward-looking approach positions Tagesschau.de not merely as a news provider, but as a guardian of digital civil liberties, shaping a more responsible and user-friendly internet for public information.
