hirado.hu

Context

hirado.hu is the news portal of the Hungarian public broadcaster. The operator and data controller is Duna Médiaszolgáltató Nonprofit Zrt. (DMSZ, the central body of Hungarian public television and radio, produced by MTVA). The site publishes a detailed cookie policy divided into categories and uses the InMobi consent management platform, built on the IAB TCF v2 standard. Capture: 303 requests, 33 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — Analytics, Ad Manager (GPT), Tag Manager, Fonts. Meta/Facebook (USA) — SDK and pixel. Twitter/X (USA), InMobi — embeds and consent infrastructure. atmedia, Publisher1st, GeoEdge — prebid advertising wrappers and verification.

Declared versus Actual

Hirado.hu’s cookie policy is constructed in detail: it divides cookies into strictly necessary (session, authentication, load balancing), analytics (traffic measurement), advertising (including external operational cookies for frequency capping, partnerships, click-fraud detection, marketing analysis), and social (tracking via social media plugins) categories. The site runs the InMobi consent management platform on the IAB TCF v2 standard, and under Hungarian law all non-essential categories — analytics, advertising, social — are activated only after the visitor’s consent.

The capture shows that a consent mechanism is present, but advertising and trackers do not wait for it. Advertising and social wrappers start before the banner even appears: prebid scripts from the Hungarian networks atmedia and Publisher1st load at +157–398 ms, the Facebook SDK with pixel (connect.facebook.net/fbevents.js) at +400 ms, the Google Publisher Tag advertising tag (securepubads.g.doubleclick.net/tag/js/gpt.js) at +515 ms, and the GeoEdge ad verifier within the same interval. Only at +558 ms does the InMobi consent management platform itself load (choice.js, cmp2.js, the TCF vendor list). That is, the Google advertising tag and the Facebook pixel execute before the visitor even sees a request for consent.

The key marker of consent not having been collected is visible in the Google Analytics traffic itself: the call to region1.google-analytics.com (identifier G-GK73FHZ3TH) carries the signal gcs=G100, corresponding to a state of “consent not given.” Yet the telemetry is sent regardless. Subsequently, without consent having been collected, Facebook embeds (www.facebook.com, fbcdn.net), Twitter/X (syndication.twitter.com), and YouTube (in youtube-nocookie mode) activate, along with Google Tag Manager. Additionally, at +210–409 ms, Google Fonts loads, transmitting the visitor’s IP address to Google.

Thus, an IAB TCF consent management platform is present on the site, but the actual transfer of data to advertising and analytics recipients does not depend on it and occurs before the user makes a choice.

Timing Relative to Consent

Prebid and the Facebook pixel fire at +157–400 ms, the Google advertising tag at +515 ms, the InMobi banner at +558 ms, and Google Analytics with the “consent not given” flag at +3159 ms. Advertising and social trackers precede the banner, while analytics fires after the banner appears but without consent having been collected. Set-Cookie is zero in the captured headers; no choice has been made by the user.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion regarding tracking is drawn from the fact of script loading (GPT, fbevents.js, GA) and from the consent signal in the Google Analytics request, rather than from cookie headers. YouTube loads in youtube-nocookie mode, which reduces cookie-based tracking. Google, Meta, and Twitter may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Behavior following a click on “accept” or “reject” is not observed in this session. Server-side processing is not visible in a browser-based capture.

Conclusion

The news portal of the Hungarian public broadcaster is equipped with an InMobi consent management platform built on the IAB TCF standard, but advertising, the Facebook pixel, and analytics launch without waiting for consent: the Google advertising tag and prebid wrappers start before the banner, the Facebook SDK loads prior to consent, and Google Analytics transmits data flagged as “consent not given.” The cookie policy, meanwhile, classifies these services as non-essential categories requiring consent. The discrepancy is fundamental: a consent mechanism is present in the form of a banner, but it does not govern the actual transfer of data. For a publicly funded public broadcaster’s portal, transferring audience IP addresses and behavior to advertising and social recipients (a significant proportion located in the USA) prior to consent having been collected and outside the consent mechanism constitutes a violation of the requirements concerning the legal basis for processing, disclosure of recipients, and cross-border transfer. Remedy: hold back the advertising tag, Facebook pixel, prebid, and analytics until actual consent is given via the already-installed consent management platform, host fonts and libraries locally, and disclose the composition of advertising recipients.