budapest.hu

Context

budapest.hu is the official portal of the city of Budapest. The data controller is the Budapest Metropolitan City Hall (Budapest Főváros Főpolgármesteri Hivatal). The site is built on Next.js. The portal discloses a cookie policy that distinguishes between strictly necessary and analytics cookies. Capture: 110 requests, a single domain, recorded in a clean browser.

Declared versus Actual

The Cookie Policy divides cookies into two categories. Strictly necessary cookies (cc_cookie, for storing consent settings, and the session cookie cookiesession1) are set automatically on the basis of the performance of a task carried out in the public interest. Analytics cookies, by contrast, are declared non-essential: the policy states directly that their setting requires the visitor’s voluntary consent (legal basis: GDPR Art. 6(1)(a)), and these are the Matomo analytics cookies (_pk_id, _pk_ses, _pk_ref) on self-hosted infrastructure.

The capture confirms the declared model. All 110 requests go to the single domain budapest.hu; there is no external domain present in the capture — no font services, no analytics, no advertising pixels, no maps. Matomo analytics does not fire in a session without consent: there are no calls to matomo.budapest.hu in the capture. Scripts, stylesheets, fonts, and images are served locally via Next.js optimization. No cookies are set (Set-Cookie is zero).

The site’s Content Security Policy (CSP) lists a number of permitted domains for embedded content — among them the self-hosted Matomo instance, as well as Facebook, TikTok, YouTube, Google, Spotify, and Office/Forms. These are permissible sources for embedded elements (video, maps, forms) on individual pages, but on the home page in its pre-consent state, none of them is invoked: the CSP list describes what is potentially permitted, not what is actually loaded.

Accordingly, no discrepancy between “declared” and “actual” arises: analytics is declared as consent-based and does not activate prior to consent, and there are no external calls in the capture whatsoever.

Timing Relative to Consent

All calls go to the site’s own domain. Analytics cookies are not set prior to consent, there are no third-party resources on the home page, and no cookies are set. For a municipal portal, this is the expected and correct behavior.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Matomo’s behavior after clicking “accept,” as well as embedded content (YouTube/TikTok video, maps, Office forms) permitted by the security policy on internal pages, are not covered by this capture; with correct configuration and consent given, their firing would be lawful. Server-side processing is not visible in a browser-based capture.

Conclusion

The official portal of Budapest demonstrates a configuration that is clean as captured: all resources, including fonts, are hosted locally on the site’s own domain, there are no external calls whatsoever, trackers and cookies are absent, and the declared Matomo analytics on self-hosted infrastructure does not fire prior to consent. Analytics is correctly declared in the policy as non-essential and consent-based. What is declared matches actual behavior. No violations have been recorded in the capture.