RU EN
www.
Technical audit · 29.05.2026

hirado.hu

News Portal of the Hungarian Public Broadcaster
HU

Policy changed — see what exactly · 2026-08-14 →

The news portal of the Hungarian public broadcaster (hirado.hu, operated by Duna Médiaszolgáltató) — 303 requests, 33 domains. An InMobi consent management platform (IAB TCF) is present, but advertising and trackers do not wait for it: the Google advertising tag, the Facebook pixel, and prebid wrappers load before and in parallel with the banner, while Google Analytics sends data flagged as 'consent not given.' The cookie policy, meanwhile, classifies these services as non-essential and requiring consent.

Request timeline

+0 ms · portal load
Markup and some resources — served from the first-party domain hirado.hu and the public broadcaster's media CDN (cdn.cms.mtv.hu). jQuery libraries are pulled from external CDNs (ajax.googleapis.com, code.jquery.com, cdnjs).
+157…+400 ms · advertising and Facebook prior to the banner
cdn.atmedia.hu and cdn.publisher1st.com — prebid header bidding from Hungarian advertising networks; connect.facebook.net/fbevents.js — the Facebook pixel; rumcdn.geoedge.be — ad verification. All prior to the appearance of the consent banner.
+515 ms · Google advertising tag prior to the banner
securepubads.g.doubleclick.net/tag/js/gpt.js — the Google Publisher Tag. Loads before the consent management platform is ready.
+558 ms · the InMobi CMP appears
cmp.inmobi.com — loading of the InMobi consent management platform, built on IAB TCF v2 (choice.js, cmp2.js, geoip, vendor list). By this point, advertising and Facebook have already executed.
session state — no consent
Set-Cookie is zero in the captured headers; no choice has been made by the user. Google Analytics (G-GK73FHZ3TH) transmits telemetry with gcs=G100 (consent not given).
+1450…+3800 ms · trackers and embeds without consent
www.facebook.com, static.xx.fbcdn.net, syndication.twitter.com, www.youtube-nocookie.com, region1.google-analytics.com (+3159 ms), googletagmanager.com (+2872 ms) — all activate without consent having been collected.

Declared versus actual

✓ Cookie Policy ('A sütik (cookie-k) alkalmazásáról') — divides cookies into strictly necessary, analytics, advertising, and social categories — declared
✓ InMobi consent management platform (IAB TCF v2) — collection of visitor consent — declared
✓ Non-essential cookies (analytics, advertising, social media) require consent under Hungarian law — declared
+ The Google advertising tag (GPT) and Facebook pixel fire before the consent banner appears — not declared
+ Google Analytics transmits data with the signal gcs=G100 (consent not given) — not declared
+ The named composition of prebid advertising partners (atmedia, Publisher1st, GeoEdge, and TCF vendors) is generalized in the policy — not declared

Transfer timings

+400 ms connect.facebook.net

Facebook SDK / pixel (fbevents.js). Meta, USA.

+515 ms securepubads.g.doubleclick.net

Google Publisher Tag (GPT). Google, USA. Before the CMP.

+558 ms cmp.inmobi.com

InMobi CMP (IAB TCF v2). The consent banner.

+3159 ms region1.google-analytics.com

Google Analytics G-GK73FHZ3TH. Telemetry flagged as 'consent not given.'

Detected trackers

Indicators of GDPR non-compliance

Context

hirado.hu is the news portal of the Hungarian public broadcaster. The operator and data controller is Duna Médiaszolgáltató Nonprofit Zrt. (DMSZ, the central body of Hungarian public television and radio, produced by MTVA). The site publishes a detailed cookie policy divided into categories and uses the InMobi consent management platform, built on the IAB TCF v2 standard. Capture: 303 requests, 33 domains, recorded in a clean browser.

Google (USA) — Analytics, Ad Manager (GPT), Tag Manager, Fonts. Meta/Facebook (USA) — SDK and pixel. Twitter/X (USA), InMobi — embeds and consent infrastructure. atmedia, Publisher1st, GeoEdge — prebid advertising wrappers and verification.

Declared versus Actual

Hirado.hu’s cookie policy is constructed in detail: it divides cookies into strictly necessary (session, authentication, load balancing), analytics (traffic measurement), advertising (including external operational cookies for frequency capping, partnerships, click-fraud detection, marketing analysis), and social (tracking via social media plugins) categories. The site runs the InMobi consent management platform on the IAB TCF v2 standard, and under Hungarian law all non-essential categories — analytics, advertising, social — are activated only after the visitor’s consent.

The capture shows that a consent mechanism is present, but advertising and trackers do not wait for it. Advertising and social wrappers start before the banner even appears: prebid scripts from the Hungarian networks atmedia and Publisher1st load at +157–398 ms, the Facebook SDK with pixel (connect.facebook.net/fbevents.js) at +400 ms, the Google Publisher Tag advertising tag (securepubads.g.doubleclick.net/tag/js/gpt.js) at +515 ms, and the GeoEdge ad verifier within the same interval. Only at +558 ms does the InMobi consent management platform itself load (choice.js, cmp2.js, the TCF vendor list). That is, the Google advertising tag and the Facebook pixel execute before the visitor even sees a request for consent.

The key marker of consent not having been collected is visible in the Google Analytics traffic itself: the call to region1.google-analytics.com (identifier G-GK73FHZ3TH) carries the signal gcs=G100, corresponding to a state of “consent not given.” Yet the telemetry is sent regardless. Subsequently, without consent having been collected, Facebook embeds (www.facebook.com, fbcdn.net), Twitter/X (syndication.twitter.com), and YouTube (in youtube-nocookie mode) activate, along with Google Tag Manager. Additionally, at +210–409 ms, Google Fonts loads, transmitting the visitor’s IP address to Google.

Thus, an IAB TCF consent management platform is present on the site, but the actual transfer of data to advertising and analytics recipients does not depend on it and occurs before the user makes a choice.

Prebid and the Facebook pixel fire at +157–400 ms, the Google advertising tag at +515 ms, the InMobi banner at +558 ms, and Google Analytics with the “consent not given” flag at +3159 ms. Advertising and social trackers precede the banner, while analytics fires after the banner appears but without consent having been collected. Set-Cookie is zero in the captured headers; no choice has been made by the user.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion regarding tracking is drawn from the fact of script loading (GPT, fbevents.js, GA) and from the consent signal in the Google Analytics request, rather than from cookie headers. YouTube loads in youtube-nocookie mode, which reduces cookie-based tracking. Google, Meta, and Twitter may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Behavior following a click on “accept” or “reject” is not observed in this session. Server-side processing is not visible in a browser-based capture.

Conclusion

The news portal of the Hungarian public broadcaster is equipped with an InMobi consent management platform built on the IAB TCF standard, but advertising, the Facebook pixel, and analytics launch without waiting for consent: the Google advertising tag and prebid wrappers start before the banner, the Facebook SDK loads prior to consent, and Google Analytics transmits data flagged as “consent not given.” The cookie policy, meanwhile, classifies these services as non-essential categories requiring consent. The discrepancy is fundamental: a consent mechanism is present in the form of a banner, but it does not govern the actual transfer of data. For a publicly funded public broadcaster’s portal, transferring audience IP addresses and behavior to advertising and social recipients (a significant proportion located in the USA) prior to consent having been collected and outside the consent mechanism indicates non-compliance with the requirements concerning the legal basis for processing, disclosure of recipients, and cross-border transfer. Remedy: hold back the advertising tag, Facebook pixel, prebid, and analytics until actual consent is given via the already-installed consent management platform, host fonts and libraries locally, and disclose the composition of advertising recipients.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: hu/hirado-hu-2026-05-29.har
SHA-256: 14ebcf22f032c2df32c54615f38687ddf2aa702bacd48aa8533d5ccc33e43b4a
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — hirado.hu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website hirado.hu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) On page load, before and in parallel with the appearance of the InMobi consent management platform (cmp.inmobi.com at +558 ms), advertising and tracking services fire. The Google advertising tag (GPT, securepubads.g.doubleclick.net/tag/js/gpt.js) loads at +515 ms, the Facebook SDK/pixel (connect.facebook.net/en_US/fbevents.js) at +400 ms, and the prebid wrappers atmedia and Publisher1st at +157–398 ms. Google Analytics (G-GK73FHZ3TH) transmits telemetry with the signal gcs=G100, corresponding to a state of 'consent not given.' Hirado.hu's cookie policy divides cookies into categories and, under Hungarian law, classifies the non-essential ones (analytics, advertising, social) as requiring consent — in fact, however, they are activated before the user makes a choice.

2) Prior to consent, the visitor's IP address and Referer header are transmitted to numerous third-party recipients, a significant proportion of them in the USA: Google (Analytics, Ad Manager, GTM, reCAPTCHA infrastructure), Meta/Facebook, Twitter/X, InMobi. The loading of Google Fonts (fonts.googleapis.com, fonts.gstatic.com) additionally transmits the IP address to Google. The Facebook SDK (fbevents.js) loads prior to consent.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/hu-hirado-hu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — hirado.hu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website hirado.hu.

2. Circumstances
I visited the website hirado.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) On page load, before and in parallel with the appearance of the InMobi consent management platform (cmp.inmobi.com at +558 ms), advertising and tracking services fire. The Google advertising tag (GPT, securepubads.g.doubleclick.net/tag/js/gpt.js) loads at +515 ms, the Facebook SDK/pixel (connect.facebook.net/en_US/fbevents.js) at +400 ms, and the prebid wrappers atmedia and Publisher1st at +157–398 ms. Google Analytics (G-GK73FHZ3TH) transmits telemetry with the signal gcs=G100, corresponding to a state of 'consent not given.' Hirado.hu's cookie policy divides cookies into categories and, under Hungarian law, classifies the non-essential ones (analytics, advertising, social) as requiring consent — in fact, however, they are activated before the user makes a choice.

2) Prior to consent, the visitor's IP address and Referer header are transmitted to numerous third-party recipients, a significant proportion of them in the USA: Google (Analytics, Ad Manager, GTM, reCAPTCHA infrastructure), Meta/Facebook, Twitter/X, InMobi. The loading of Google Fonts (fonts.googleapis.com, fonts.gstatic.com) additionally transmits the IP address to Google. The Facebook SDK (fbevents.js) loads prior to consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-hirado-hu/

3. GDPR provisions I ask you to examine
GDPR Art. 6 + ePrivacy (Hungarian implementation) — analytics, advertising, and social trackers prior to consent; GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and cross-border transfer

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]