decareto has analysed the websites of 21 defence industry companies using automated tools to identify data protection shortcomings. The result: 57 per cent exhibit technical vulnerabilities. In particular, external services and non-essential cookies are frequently loaded or set before consent has been given.
Companies in the security and defence industry are subject to stringent requirements regarding information security and the protection of sensitive information. These requirements also shape how digital technologies are used. This makes the findings of the latest decareto analysis all the more striking: numerous company websites have shortcomings in their implementation of data protection regulations. Particularly affected are the integration of external services, cookie configuration and the transparency of privacy policies.
21 defence industry companies examined
For the study, decareto analysed the websites of 21 defence industry companies with regard to their technical data protection configuration. The focus was on compliance with the consent requirements under Section 25 of the TDDDG and the transparency of data processing in accordance with the GDPR – in particular:
- Use of consent banners and consent management platforms
- Loading of external services
- Setting of cookies
- Completeness of privacy policies
The results show that data protection shortcomings occur despite the use of consent management solutions. Overall, 12 out of 21 websites (57 per cent) exhibit technical data protection vulnerabilities.
57% load external services without consent
External services are used on company websites for purposes including web analytics, marketing, advertising and the provision of content. Depending on how they are technically integrated and their intended use, they may require prior consent.
The analysis revealed that 12 out of 21 companies (57 per cent) load external services as soon as a page is accessed, even though consent has not yet been given.
This is particularly problematic when a consent banner gives the impression that it is awaiting the visitor’s decision, yet the relevant services are already activated beforehand.
52% set non-essential cookies without consent
Cookies are one of several technologies used to store or retrieve information on end devices. Under Section 25 of the TDDDG, consent is generally required for this, unless a statutory exception applies.
On 11 out of 21 websites (52%), non-essential cookies were set before visitors had given their consent.
The results show that a consent management platform alone does not guarantee a legally compliant cookie configuration. It is crucial that technologies requiring consent are technically blocked until consent is given.
43 per cent lack transparency in privacy policies
In addition to the technical configuration, decareto also examined the companies’ privacy policies.
The result: on 9 out of 21 websites (43 per cent), external services were identified whose use was not explained, or not clearly explained, in the respective privacy policies.
This may indicate shortcomings in compliance with the information obligations under Article 13 of the GDPR. Data controllers must provide transparent information about the processing of personal data, including the purposes of processing, legal bases and recipients or categories of recipients.
Google and marketing technologies among the most common providers
The study shows that various external technologies are used on defence industry websites. Among the five most frequently identified providers of services that were loaded without prior consent are:
| Rank | Provider | Categories |
| 1 | Web analytics, marketing, advertising, tag management | |
| 2 | HubSpot | Marketing, CRM and lead generation |
| 3 | Cloudflare | Content delivery, web security and performance |
| 4 | Meta | Social media integration, online advertising and conversion tracking |
| 5 | Microsoft | Cloud hosting, web analytics, CRM and marketing automation |
Google tops the list of the most frequently identified providers of external services that were loaded without consent. In addition, technologies from HubSpot, Cloudflare, Meta and Microsoft were identified in particular.
The scanned services in the overview
Looking at the details, these are the most common services that we scanned and detected. The table lists services that were loaded without consent. Tracking, web analytics and online advertising characterise the use of external services on the websites examined. Google Analytics, Meta Pixel and Matomo are particularly common. With eleven detections, Google Tag Manager is among the most widely used technologies.
A methodological note: As multiple services may be present on a single website, it is not possible to deduce the proportion of affected websites from these figures. Similarly, the mere detection of a service does not in itself constitute a data protection breach.
Data transfers to the US remain a relevant issue
When external services are used, personal data may be transferred to third-party providers, including, where applicable, to countries outside the European Union.
The EU-US Data Privacy Framework permits data transfers to certified US companies under certain conditions. Irrespective of this, the requirements of the GDPR and the TDDDG must be complied with. Valid consent remains necessary for tracking and marketing technologies that require consent.
For companies in the defence industry in particular, monitoring external services is important in order to track data flows and assess potential data protection risks.
Overall assessment of defence industry websites
The overall assessment of the websites examined varies.
- A: 9 websites (43 %)
- B: 3 websites (14 %)
- C: 1 website (5 %)
- D: 5 websites (24 per cent)
- E: 3 websites (14 per cent)
This means that 12 out of 21 websites (57 per cent) have data protection vulnerabilities. Eight websites (38 per cent) even received a risk score of D or E.
The results show that a significant proportion of the companies examined need to take action regarding the technical implementation of website data protection.
Key findings of the analysis
- 57 per cent of the websites examined have data protection vulnerabilities.
- 57 per cent load external services before consent is given.
- 52 per cent set non-essential cookies without consent.
- 43 per cent have transparency issues in their privacy policies.
- Google tops the list of the most frequently identified providers of external services that were loaded without prior consent.
About the analysis
For the analysis, decareto examined the websites of 21 companies in the defence industry from 27 September to 24 October 2026. The decareto platform for automated website compliance analysis was used for this purpose.
The assessment covered the technical implementation of consent mechanisms, the use of external services, the setting of cookies and the transparency of privacy policies. The assessment was based on the requirements of the GDPR, the TDDDG and European and German case law on the use of technologies requiring consent.
The following defence industry companies were examined
Airbus, ARX Robotics GmbH, Dynamit Nobel Defence, ELAC SONAR GmbH, Fr. Fassmer GmbH & Co. KG, GERMAN NAVAL YARDS, Heckler & Koch, HEGGEMANN, Helsing GmbH, HENSOLDT AG, IABG, JUNGHANS Microtec GmbH, MTU Aero Engines, NVL B.V. & Co. KG, PLATH GmbH & Co. KG, Quantum Systems, RENK Group AG, Rheinmetall, Rohde & Schwarz GmbH & Co. KG, TKMS, VINCORION SE
