RU EN
www.
Technical audit · 29.05.2026

budapest.hu

Budapest City Hall
HU

Policy changed — see what exactly · 2026-10-14 →

Budapest City Hall (the official portal of the Hungarian capital) — 110 requests, a single domain. All resources, including fonts, are hosted locally on the site's own domain; there are no external calls, trackers, or cookies in the capture. The Matomo analytics declared in the policy (self-hosted at matomo.budapest.hu) does not fire prior to consent. No violations have been recorded.

Request timeline

+0 ms · portal load
All resources — markup, stylesheets, scripts, fonts, images — are served from the first-party domain budapest.hu (Next.js). CSP, HSTS, and X-Frame-Options SAMEORIGIN headers are present.
local fonts and images
Fonts (woff2) and images are served from the site's own domain via Next.js optimization; there are no calls to external font services.
pre-consent state
Under the policy, analytics cookies are non-essential and are set only with voluntary consent. In the capture, the consent banner does not trigger any external calls.
session state — no consent
Set-Cookie across the entire session is zero. Matomo analytics is not activated prior to consent.
no third-party calls
Google, Facebook, TikTok, YouTube, analytics, maps, and advertising are absent from the capture; the self-hosted Matomo instance does not fire without consent.

Declared versus actual

✓ Cookie Policy — strictly necessary cookies (cc_cookie, cookiesession1) on the basis of public interest; analytics cookies only with consent — declared
✓ Matomo analytics (self-hosted): _pk_id, _pk_ses, _pk_ref — with the visitor's consent (GDPR Art. 6(1)(a)) — declared

Context

budapest.hu is the official portal of the city of Budapest. The data controller is the Budapest Metropolitan City Hall (Budapest Főváros Főpolgármesteri Hivatal). The site is built on Next.js. The portal discloses a cookie policy that distinguishes between strictly necessary and analytics cookies. Capture: 110 requests, a single domain, recorded in a clean browser.

Declared versus Actual

The Cookie Policy divides cookies into two categories. Strictly necessary cookies (cc_cookie, for storing consent settings, and the session cookie cookiesession1) are set automatically on the basis of the performance of a task carried out in the public interest. Analytics cookies, by contrast, are declared non-essential: the policy states directly that their setting requires the visitor’s voluntary consent (legal basis: GDPR Art. 6(1)(a)), and these are the Matomo analytics cookies (_pk_id, _pk_ses, _pk_ref) on self-hosted infrastructure.

The capture confirms the declared model. All 110 requests go to the single domain budapest.hu; there is no external domain present in the capture — no font services, no analytics, no advertising pixels, no maps. Matomo analytics does not fire in a session without consent: there are no calls to matomo.budapest.hu in the capture. Scripts, stylesheets, fonts, and images are served locally via Next.js optimization. No cookies are set (Set-Cookie is zero).

The site’s Content Security Policy (CSP) lists a number of permitted domains for embedded content — among them the self-hosted Matomo instance, as well as Facebook, TikTok, YouTube, Google, Spotify, and Office/Forms. These are permissible sources for embedded elements (video, maps, forms) on individual pages, but on the home page in its pre-consent state, none of them is invoked: the CSP list describes what is potentially permitted, not what is actually loaded.

Accordingly, no discrepancy between “declared” and “actual” arises: analytics is declared as consent-based and does not activate prior to consent, and there are no external calls in the capture whatsoever.

All calls go to the site’s own domain. Analytics cookies are not set prior to consent, there are no third-party resources on the home page, and no cookies are set. For a municipal portal, this is the expected and correct behavior.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Matomo’s behavior after clicking “accept,” as well as embedded content (YouTube/TikTok video, maps, Office forms) permitted by the security policy on internal pages, are not covered by this capture; with correct configuration and consent given, their firing would be lawful. Server-side processing is not visible in a browser-based capture.

Conclusion

The official portal of Budapest demonstrates a configuration that is clean as captured: all resources, including fonts, are hosted locally on the site’s own domain, there are no external calls whatsoever, trackers and cookies are absent, and the declared Matomo analytics on self-hosted infrastructure does not fire prior to consent. Analytics is correctly declared in the policy as non-essential and consent-based. What is declared matches actual behavior. No violations have been recorded in the capture.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: hu/budapest-hu-2026-05-29.har
SHA-256: d1c8d1e0cd3a5f3bf08fc31130eecfa55a052c96370e164d5bc6d6999ec51737
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — budapest.hu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website budapest.hu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/hu-budapest-hu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]