e-cegjegyzek.hu

Context

e-cegjegyzek.hu is the official website of Hungary’s online company information service (e-cégjegyzék). The operator is the Company Information Service and the Service Assisting Electronic Company Proceedings (Céginformációs és az Elektronikus Cégeljárásban Közreműködő Szolgálat), under the Ministry of Justice. Through the site, users can access, from the primary, publicly authoritative register, current and deleted data on Hungarian companies, along with the underlying official documents. The site is served by an Apache server, with HSTS strongly configured (max-age of one year, preload). Capture: 67 requests, 5 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address, via Google Fonts and reCAPTCHA. There are no other third-party recipients in the capture.

Declared versus Actual

Compared with a typical government site, the register appears carefully built: there is no analytics (Google Analytics, Matomo), no advertising pixels, no Facebook, and HSTS is strongly configured. The register’s own cookie notice describes the system’s cookies honestly and in detail: it explains that the system recognizes returning users and collects behavioral data — the country from which the site is viewed, the browser and operating system in use, the IP address, and which site features have been used.

This description, however, covers only the system’s own cookies and names no third-party recipients. The capture shows that, prior to any consent, the site contacts Google twice. At +88 ms, Google Fonts loads (CSS from fonts.googleapis.com, followed by Roboto font files from fonts.gstatic.com at +167 ms), transmitting the visitor’s IP address and Referer header to Google (USA). At +294 ms, Google reCAPTCHA loads (api.js from www.google.com and the runtime from www.gstatic.com at +349 ms), likewise transmitting the IP address to Google. Neither Google Fonts nor reCAPTCHA is mentioned in the register’s cookie notice.

Thus, against an otherwise restrained site profile, one discrepancy remains: two calls to Google prior to consent, transmitting the IP address to a third-party recipient in the USA that the policy does not name.

Timing Relative to Consent

External calls occur at +88–349 ms, all prior to any action by the visitor. Neither Google Fonts nor reCAPTCHA is held back by any consent mechanism — they fire unconditionally. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

reCAPTCHA on a register with search and login forms can be regarded as an anti-abuse safeguard; this does not change the fact that its loading transmits the IP address to Google or that it is not disclosed as a recipient. Its api.js is preloaded; the form to which it is attached is not necessarily visible in the capture. The capture was recorded in a lean form without response bodies, so the exact appearance of the cookie banner on the home page cannot be reconstructed from it; the conclusion regarding what is declared rests on the system’s published cookie notice. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation (Google, USA), not the physical location of the node. Server-side processing is not visible in a browser-based capture.

Conclusion

Hungary’s official electronic company register is, on the whole, implemented in a restrained manner: it uses no analytics, advertising pixels, or social modules, and secures transport with strong HSTS. Nevertheless, prior to any consent, it transmits the visitor’s IP address to Google — via Google Fonts (the Roboto font) and Google reCAPTCHA. The register’s own cookie notice describes only the system’s own cookies and the collection of behavioral data, but names neither Google, Google Fonts, nor reCAPTCHA as third-party recipients. For an official state register used by lawyers, journalists, and business owners, the transfer of the IP address to an undisclosed third-party recipient in the USA by default, on every visit, and outside any consent mechanism, constitutes a violation of the requirements concerning disclosure of recipients and cross-border transfer. The remedy is simple and entirely within the operator’s control: host the Roboto font locally on the site’s own domain, and load reCAPTCHA only on pages containing forms and, where possible, only after consent; this would eliminate all external calls to Google prior to the visitor’s choice.