bnt.bg

Context

bnt.bg is the website of Bulgarian National Television (Българска национална телевизия, BNT), the country’s public broadcaster. The data controller is BNT. A BNT personal data protection policy (approximately 36,500 characters) and a supplementary document were provided. Capture: 307 requests, 26 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — Ad Manager and AdSense advertising, GA4, DoubleClick; Meta (USA) — Pixel; Microsoft (USA) — Clarity.

Declared versus Actual

BNT’s policy mentions the use of cookies and consent in general terms (the term “съгласие” appears repeatedly), but names no specific measurement, advertising, or session-recording services.

The capture reveals a fully deployed publisher stack firing prior to consent. At +3446 ms, Google Ad Manager (the gpt.js tag from securepubads.g.doubleclick.net) and AdSense (adsbygoogle from pagead2.googlesyndication.com) launch simultaneously, along with the GA4 tag (G-XG1L8ND8YV). The consent management tool — Google Funding Choices (fundingchoicesmessages.google.com) — loads only at +4493 ms, that is, already after the advertising stack has started, and therefore does not precede it. Prior to consent, the following also fire: GA4 with a page_view event (+5723 ms), Microsoft Clarity, which records user behavior (the tag and recurring calls to y.clarity.ms/collect), Meta Pixel (identifier 752207755627662, PageView event at +6191 ms), LinkedIn, and the embedded SoundCloud audio player with its own set of domains. The session state is one of no consent: not a single cookie is set across the entire session, and no choice has been made by the user.

Thus, advertising, analytics, session recording, and social pixels transmit data to Google, Meta, and Microsoft (all USA) prior to consent, and these services themselves are not disclosed in the policy. The loading order — with the consent tool appearing after advertising — means that consent could not, technically, have preceded monetization.

Timing Relative to Consent

The advertising stack starts at +3446 ms; the Google Funding Choices consent tool at +4493 ms; the GA4 event and Meta Pixel at +5723–6191 ms; Clarity session-recording calls continue through +14585 ms. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page. The GA4 client identifier is not reproduced in full in this publication. In the absence of consent, Google Ad Manager may serve non-personalized advertising; however, the tags load and make calls to Google’s servers, and the fact of data transfer is recorded. The second supplied document (in .doc format) is not disclosed textually as part of this review. Recipients may use edge nodes within the EU; the conclusion drawn therefore concerns their corporate affiliation. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Bulgarian National Television launches, prior to consent, the publisher’s Google advertising stack (Ad Manager, AdSense, DoubleClick), GA4 analytics, Microsoft Clarity session recording, Meta Pixel, and the embedded SoundCloud player, transmitting data to recipients in the USA. The Google Funding Choices consent tool loads only after advertising has already started and does not hold it back, and none of these services is named in the policy. The firing of advertising, analytics, and session recording prior to consent, together with the transfer of data to the USA, constitutes a violation of the requirements concerning prior consent, disclosure of recipients, and cross-border transfer. Remedy: ensure that the consent tool loads first and genuinely holds back the advertising stack, GA4, Clarity, Meta Pixel, and embedded players until the user makes a choice; disclose all services actually in use in the policy.