RU EN
www.
Technical audit · 29.05.2026

birosag.hu

Judicial System of Hungary
HU

The Judicial System of Hungary (the courts' portal, operated by the National Office for the Judiciary, OBH) — 40 requests, 3 domains. There is no consent banner on the page whatsoever: Matomo analytics and — more seriously — the session-recording plugin (Heatmap & Session Recording) fire immediately on load, before any choice is made. The Cookie Policy, meanwhile, states that statistical cookies are applied only after clicking 'I accept.'

Request timeline

+0 ms · portal load
Markup, stylesheets, scripts, and fonts — served from the first-party domain birosag.hu (Drupal, served via CloudFront). Some fonts are local.
+204 ms · Font Awesome prior to consent
use.fontawesome.com — Font Awesome 5.13.1 scripts (all.js, v4-shims.js), served via Cloudflare. The visitor's IP address is transmitted to a third-party recipient.
+226 ms · Matomo prior to consent
birosaghu.matomo.cloud/matomo.js — Matomo analytics loads (idsite=1, trackerid 0c6n5A). Hosted on Matomo Cloud, served via CloudFront (Amazon, USA).
+319 ms · session recording prior to consent
birosaghu.matomo.cloud/plugins/HeatmapSessionRecording/configs.php — configuration for the Matomo session-recording plugin (heatmaps, cursor movements, clicks). Activated on load, prior to consent.
no consent banner present
There is no consent management platform or consent banner present in the capture. Matomo and session recording start unconditionally, without waiting for a choice.
session state — no consent
Set-Cookie is zero in the captured headers; no choice has been made by the user. Analytics and session recording are already active.
no other trackers
Google Analytics, GTM, advertising pixels, and cookie-sync are absent from the capture. External calls are limited to Matomo and Font Awesome.

Declared versus actual

✓ Cookie Policy ('Süti tájékoztató') — statistical cookies are applied only after clicking 'Elfogadom' ('I accept'), with the visitor's consent — declared
✓ General policy — processing based on the user's voluntary, prior, informed consent — declared
✓ Declared use of the Matomo analytics system for visitor statistics — declared
+ Matomo Heatmap & Session Recording — a session-recording module (cursor movements, clicks), not separately named in the policy; fires prior to consent — not declared
+ use.fontawesome.com (via Cloudflare) — third-party recipient of IP address, prior to consent, not named in the policy — not declared
+ Matomo Cloud hosting via CloudFront (Amazon, USA) — not declared

Transfer timings

+204 ms use.fontawesome.com

Font Awesome 5.13.1. Served via Cloudflare. Visitor's IP address.

+226 ms birosaghu.matomo.cloud

Matomo matomo.js. Matomo Cloud via CloudFront (Amazon, USA).

+319 ms birosaghu.matomo.cloud

HeatmapSessionRecording plugin — heatmaps and session recording.

Detected trackers

Indicators of GDPR non-compliance

Context

birosag.hu is the central portal of Hungary’s judicial system (Magyarország Bíróságai). The operator and data controller is the National Office for the Judiciary (Országos Bírósági Hivatal, OBH). The site is built on Drupal and served via the CloudFront network. The authority maintains a general data processing policy and a separate Cookie Policy (“Süti tájékoztató”). Capture: 40 requests, 3 domains, recorded in a clean browser.

Matomo Cloud via CloudFront (Amazon, USA) — visitor IP address and behavior via analytics and session recording. Cloudflare — visitor IP address via the delivery of Font Awesome.

Declared versus Actual

The court’s Cookie Policy describes various categories of cookies and states the condition directly: apart from strictly necessary cookies, all others — including statistical ones — are applied only after the visitor clicks the “Elfogadom” (“I accept”) button, that is, with explicit consent. The general data processing policy confirms that the legal basis is the user’s voluntary, prior, and informed consent. In the authority’s explanatory materials, the Matomo analytics system is described as a privacy-oriented visitor statistics tool.

The capture reveals a different sequence. There is no consent banner or consent management platform on the page whatsoever. Matomo analytics (birosaghu.matomo.cloud/matomo.js) fires already at +226 ms, immediately on load. The next request is more significant still: at +319 ms, the configuration for the Matomo HeatmapSessionRecording plugin loads — a session-recording module that captures cursor movements, clicks, and visitor behavior on the page, making it considerably more invasive than ordinary visit counting. Both calls occur before any choice is made by the user. In addition, at +204 ms, Font Awesome scripts load from use.fontawesome.com (served via Cloudflare), transmitting the visitor’s IP address to a third-party recipient; this service is not named in the policy.

The discrepancy is thus direct: the policy promises that statistics and other non-essential cookies apply only upon clicking “I accept,” while in fact analytics and session recording activate automatically, without a banner and without consent. Matomo itself is hosted in the Matomo Cloud and served via CloudFront (Amazon infrastructure, USA).

Font Awesome loads at +204 ms, Matomo at +226 ms, and the session-recording configuration at +319 ms. There is no consent banner on the page that could have preceded these calls — there is nothing to block them. No consent was given during the session. That is, all external calls, including invasive session recording, occur by default, on every visit.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the presence of the session-recording plugin is established by the loading of its configuration, not by the fact of recorded traffic actually being transmitted in this session. Matomo supports IP-anonymization and do-not-track modes — a browser-based capture cannot determine whether these are enabled server-side. Cloudflare and Amazon may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Server-side processing is not visible in a browser-based capture.

Conclusion

The portal of Hungary’s judicial system activates Matomo analytics and — more seriously — a session-recording plugin (heatmaps, cursor movements, clicks) immediately on page load, without any consent banner. The authority’s Cookie Policy states directly the opposite: that statistical and other non-essential cookies are applied only after clicking “I accept.” In addition, Font Awesome loads prior to consent via Cloudflare, transmitting the IP address to a third-party recipient not named in the policy, and Matomo itself is hosted in the cloud via Amazon infrastructure (USA). For the website of a judicial authority, launching analytics and visitor-behavior recording by default, on every visit, and outside any consent mechanism, indicates non-compliance with the requirements concerning the legal basis for processing, disclosure of recipients, and cross-border transfer. Remedy: hold back Matomo and the session-recording plugin until actual consent is given via the banner, host Font Awesome locally, and disclose the recipients and hosting location in the policy.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: hu/birosag-hu-2026-05-29.har
SHA-256: b8c3d040c67a4517305fe55d61dd0e023588d4bef44a04bb1860f08c44f567d4
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — birosag.hu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website birosag.hu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) On page load, without any consent banner whatsoever, Matomo analytics fires (birosaghu.matomo.cloud/matomo.js at +226 ms). This is followed, at +319 ms, by the loading of the configuration for the Matomo HeatmapSessionRecording plugin — a session-recording module (cursor movements, clicks, visitor behavior). No consent management platform or consent banner is present in the capture whatsoever. The court's Cookie Policy states directly that statistical cookies are applied only upon clicking the 'Elfogadom' ('I accept') button and only with the visitor's consent — in fact, however, Matomo and session recording start before any choice is made.

2) Font Awesome loads from use.fontawesome.com (served via Cloudflare) at +204 ms, prior to consent, transmitting the visitor's IP address to a third-party recipient. This service is not named in the policy. Matomo is hosted on matomo.cloud and served via CloudFront (Amazon infrastructure, USA).


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/hu-birosag-hu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — birosag.hu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website birosag.hu.

2. Circumstances
I visited the website birosag.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) On page load, without any consent banner whatsoever, Matomo analytics fires (birosaghu.matomo.cloud/matomo.js at +226 ms). This is followed, at +319 ms, by the loading of the configuration for the Matomo HeatmapSessionRecording plugin — a session-recording module (cursor movements, clicks, visitor behavior). No consent management platform or consent banner is present in the capture whatsoever. The court's Cookie Policy states directly that statistical cookies are applied only upon clicking the 'Elfogadom' ('I accept') button and only with the visitor's consent — in fact, however, Matomo and session recording start before any choice is made.

2) Font Awesome loads from use.fontawesome.com (served via Cloudflare) at +204 ms, prior to consent, transmitting the visitor's IP address to a third-party recipient. This service is not named in the policy. Matomo is hosted on matomo.cloud and served via CloudFront (Amazon infrastructure, USA).

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-birosag-hu/

3. GDPR provisions I ask you to examine
GDPR Art. 6 + ePrivacy (Hungarian implementation) — analytics and session recording prior to consent; GDPR Art. 13(1)(e) + Chapter V — third-party recipient prior to consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]