emag.hu

Context

emag.hu is the Hungarian storefront of eMAG, a large online marketplace, retail chain for consumer electronics and appliances, and platform for third-party sellers. The data processing operator is Dante International Kft. (Budapest); the general terms of use name eMAG Magyarország Kft. as the licensee. The main document is served via nginx behind Amazon CloudFront; static assets are served from Akamai (s13emagst.akamaized.net). Capture: 121 requests, 9 domains, recorded in a clean browser.

Note on the nature of this capture. This HAR was recorded during a Google reCAPTCHA verification state: the overwhelming majority of external traffic consists of an interactive v2 challenge (anchor, bframe, reload, payload, graphics). This means the capture reflects a bot-verification process rather than the ordinary eMAG storefront, and the platform’s full set of marketing trackers is not represented in it. The conclusions below apply only to the state actually recorded.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via Google Fonts, Google Tag Manager, and reCAPTCHA. Árukereső / Heureka Group (EU) — the visitor’s IP address via the “trusted shop” badge.

Declared versus Actual

Unlike simpler commercial sites, eMAG has built out its consent infrastructure: it has a separate cookie policy, a separate data protection policy, category-based cookie management (necessary, statistics, marketing), and marketing profiling described in the policy. That is, at the level of documentation, the platform is well prepared.

The capture, however, shows that in the recorded state — prior to any consent — the site nonetheless contacts several external recipients. At +307 ms, Google Fonts connects (Open Sans, then Roboto), transmitting the IP address and Referer header to Google (USA). At +366 ms, Google Tag Manager loads (GTM-KXG49B). At +490 ms, the “trusted shop” badge loads from image.arukereso.hu, transmitting the IP address to Árukereső (Heureka Group). Finally, an extensive Google reCAPTCHA verification unfolds, during which the visitor’s IP address is repeatedly transmitted to Google. Set-Cookie across the session is zero — no consent is recorded.

Of this set, two items are least ambiguous: Google Fonts and the Árukereső badge. Neither is strictly necessary for the page’s basic functioning, both transmit the IP address to third-party recipients prior to consent, and neither is named specifically in the reviewed portion of the policy. reCAPTCHA and GTM present a separate, more nuanced case (see below).

Timing Relative to Consent

All recorded external calls occur at +307–2512 ms, prior to any action by the visitor. eMAG does have cookie management, but in this (verification-constrained) state, no banner is recorded, and the calls to Google and Árukereső occurred unconditionally. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

This is the key section for this case. The capture was recorded during a reCAPTCHA verification state, and therefore does not reflect the ordinary eMAG storefront or its full tracking profile: marketing pixels (Facebook/Meta, Criteo, RTB House, Google Ads), which eMAG typically deploys, are absent from this snapshot, and no conclusion can be drawn from it regarding either their presence or their behavior relative to consent. Google Tag Manager may operate in Consent Mode, loading in a “pre-consent” state while holding back marketing tags until the user makes a choice; this capture cannot establish that any analytics or advertising tags fired via GTM (there are no GA /g/collect calls in the capture). reCAPTCHA on the platform serves to protect forms from bots and may be regarded as functionally necessary; this does not negate the transfer of the IP address to Google, but it does soften the assessment compared with the fonts. The Árukereső badge is served by Heureka Group (EU), so no cross-border-to-third-countries issue arises in its case; for Google (Fonts, GTM, reCAPTCHA), the recipient is a US company. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation, not the location of the node. A complete picture would require a further, clean capture of the eMAG storefront outside the reCAPTCHA verification state.

Conclusion

In the recorded state, the eMAG storefront transmits the visitor’s IP address, prior to any consent, to Google (via Google Fonts, Google Tag Manager, and reCAPTCHA) and to Árukereső / Heureka Group (via the “trusted shop” badge). Of these, Google Fonts and the Árukereső badge are the most clear-cut as violations: neither is strictly necessary, both transmit the IP address to third-party recipients prior to consent, and neither is named specifically in the reviewed portion of the policy — this constitutes a violation of the requirements concerning disclosure of recipients and (in Google’s case) cross-border transfer. At the same time, unlike simpler sites, eMAG has a fully developed cookie policy and category-based consent management, and this particular capture was recorded in an atypical state constrained by reCAPTCHA verification — it therefore captures only part of the platform’s behavior, and a full verdict on eMAG’s entire tracking profile would require a further, clean capture of the storefront. The minimum remedy based on what was recorded: host the fonts locally, and load the Árukereső badge and reCAPTCHA only where and when needed, after consent is given.