e-epites.hu

Context

e-epites.hu is the official Hungarian construction administration portal (É-Építés Portál), part of the National Construction Register (Országos Építésügyi Nyilvántartás). Professional content is prepared by the responsible ministry, while operation is carried out by Lechner Tudásközpont Nonprofit Kft., a state-owned non-profit enterprise. The portal provides access to building permit information, an electronic construction log, and related registry services (some of which require registration). The site is built on Drupal 11 (Apache, PHP 8.3). Capture: 174 requests, 6 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via Google Tag Manager and GA4. Hotjar (Malta/EU) — the visitor’s IP address via session-recording scripts. Cloudflare (USA) — the visitor’s IP address via select2 from cdnjs. jsDelivr (EU) — the visitor’s IP address via library loading.

Declared versus Actual

The portal has done something simpler sites have not: it has a genuine consent manager — the open-source cookiesjsr — and its cookie table honestly lists its own session cookie, the consent manager’s own cookie, and Google Analytics loaded via Google Tag Manager. That is, the intent to manage consent is evident, and analytics is disclosed.

The capture, however, reveals two problems. The first is the loading order. The cookiesjsr consent manager connects only at +597–687 ms, whereas Google Tag Manager loads at +273 ms, GA4 at +390 ms, and Hotjar at +391–520 ms. In other words, tracker scripts connect before the mechanism intended to govern them has initialized; by the time the consent manager starts, calls to Google and Hotjar — and with them, the visitor’s IP address — have already been sent to their providers.

The second, and more serious, issue is Hotjar. This is not a statistics counter but a service for recording user sessions and building heatmaps: it captures cursor movements, clicks, scrolling, and is capable of capturing interaction with page elements. Hotjar is not mentioned anywhere in the portal’s cookie table, even though Google Analytics is named there specifically. The portal thus runs an undeclared behavioral tracker, which loads prior to consent. Additionally, the visitor’s IP address is transmitted to Cloudflare (select2 from cdnjs) and to jsDelivr during library loading — these CDNs are likewise not named in the policy.

Timing Relative to Consent

All external calls occur at +174–687 ms. The key point is that the trackers (GTM at +273 ms, GA4 at +390 ms, Hotjar at +391–520 ms) load before the cookiesjsr consent manager (+597 ms). The consent mechanism could not, physically, have held back what had already connected before it. No valid consent is recorded during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The GTM, GA4, and Hotjar scripts are loaded in the capture — this alone has already transmitted the IP address to their providers — but there is no separate GA /g/collect call within the capture window, and the HAR cannot establish whether Hotjar began actual session recording prior to consent; this depends on the consent-mode configuration, which is not visible in a browser-based capture. The fact of IP address transmission upon script loading occurred in any case. Hotjar (Hotjar Ltd, Malta; parent company Contentsquare, France) is an EU-based recipient, so the question of cross-border transfer to third countries is weaker in its case; the principal concern is non-disclosure and behavioral recording prior to consent. Google and Cloudflare are US companies. Google and Cloudflare may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation, not the location of the node. The capture was recorded in a lean form without response bodies, so the visual state of the banner cannot be reconstructed from it; the conclusion regarding order rests on the timing of the calls. Server-side processing is not visible in a browser-based capture.

Conclusion

Hungary’s construction administration portal is built more carefully than average: it has a cookiesjsr consent manager, and Google Analytics is declared in the cookie table. Nevertheless, the implementation fails in two places at once. First, the tracker scripts — Google Tag Manager, GA4, and Hotjar — load before the consent manager itself initializes, so the visitor’s IP address has already been sent to their providers prior to consent. Second, Hotjar — a session-recording service — is not disclosed in the policy at all, despite being a more sensitive behavioral tracker than the declared statistics tool. The transfer of the IP address to an undisclosed recipient (Hotjar), as well as to Google and Cloudflare, prior to actual consent, despite the presence of a consent mechanism that does not function effectively, constitutes a violation of the requirements concerning disclosure of recipients and the proper sequencing of consent. The remedy is within the operator’s control: load GTM, GA4, and Hotjar only after the consent manager initializes and only with consent given; add Hotjar (and the CDNs in use) to the cookie table as recipients; and, where possible, host the libraries locally.