birosag.hu

Context

birosag.hu is the central portal of Hungary’s judicial system (Magyarország Bíróságai). The operator and data controller is the National Office for the Judiciary (Országos Bírósági Hivatal, OBH). The site is built on Drupal and served via the CloudFront network. The authority maintains a general data processing policy and a separate Cookie Policy (“Süti tájékoztató”). Capture: 40 requests, 3 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Matomo Cloud via CloudFront (Amazon, USA) — visitor IP address and behavior via analytics and session recording. Cloudflare — visitor IP address via the delivery of Font Awesome.

Declared versus Actual

The court’s Cookie Policy describes various categories of cookies and states the condition directly: apart from strictly necessary cookies, all others — including statistical ones — are applied only after the visitor clicks the “Elfogadom” (“I accept”) button, that is, with explicit consent. The general data processing policy confirms that the legal basis is the user’s voluntary, prior, and informed consent. In the authority’s explanatory materials, the Matomo analytics system is described as a privacy-oriented visitor statistics tool.

The capture reveals a different sequence. There is no consent banner or consent management platform on the page whatsoever. Matomo analytics (birosaghu.matomo.cloud/matomo.js) fires already at +226 ms, immediately on load. The next request is more significant still: at +319 ms, the configuration for the Matomo HeatmapSessionRecording plugin loads — a session-recording module that captures cursor movements, clicks, and visitor behavior on the page, making it considerably more invasive than ordinary visit counting. Both calls occur before any choice is made by the user. In addition, at +204 ms, Font Awesome scripts load from use.fontawesome.com (served via Cloudflare), transmitting the visitor’s IP address to a third-party recipient; this service is not named in the policy.

The discrepancy is thus direct: the policy promises that statistics and other non-essential cookies apply only upon clicking “I accept,” while in fact analytics and session recording activate automatically, without a banner and without consent. Matomo itself is hosted in the Matomo Cloud and served via CloudFront (Amazon infrastructure, USA).

Timing Relative to Consent

Font Awesome loads at +204 ms, Matomo at +226 ms, and the session-recording configuration at +319 ms. There is no consent banner on the page that could have preceded these calls — there is nothing to block them. No consent was given during the session. That is, all external calls, including invasive session recording, occur by default, on every visit.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the presence of the session-recording plugin is established by the loading of its configuration, not by the fact of recorded traffic actually being transmitted in this session. Matomo supports IP-anonymization and do-not-track modes — a browser-based capture cannot determine whether these are enabled server-side. Cloudflare and Amazon may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Server-side processing is not visible in a browser-based capture.

Conclusion

The portal of Hungary’s judicial system activates Matomo analytics and — more seriously — a session-recording plugin (heatmaps, cursor movements, clicks) immediately on page load, without any consent banner. The authority’s Cookie Policy states directly the opposite: that statistical and other non-essential cookies are applied only after clicking “I accept.” In addition, Font Awesome loads prior to consent via Cloudflare, transmitting the IP address to a third-party recipient not named in the policy, and Matomo itself is hosted in the cloud via Amazon infrastructure (USA). For the website of a judicial authority, launching analytics and visitor-behavior recording by default, on every visit, and outside any consent mechanism, constitutes a violation of the requirements concerning the legal basis for processing, disclosure of recipients, and cross-border transfer. Remedy: hold back Matomo and the session-recording plugin until actual consent is given via the banner, host Font Awesome locally, and disclose the recipients and hosting location in the policy.