honvedelem.hu

Context

honvedelem.hu is the official portal of the Ministry of Defence and the armed forces of Hungary. The operator and data controller is HM Zrínyi Térképészeti és Kommunikációs Szolgáltató Nonprofit Kft. (a mapping and communications company under the Ministry of Defence). The site is served through the Cloudflare network. The ministry publishes a cookie policy (“Sütikezelés tájékoztató”). Capture: 98 requests, 13 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — Analytics (three counters), Ads/remarketing, Tag Manager, Fonts. Meta/Facebook (USA) — SDK. ShareThis — a third-party tracking pixel carrying the hostname honvedelem.hu.

Declared versus Actual

The Ministry of Defence’s cookie policy states the condition clearly. It divides cookies into those not requiring consent (authentication, multimedia, load balancing, interface, and user security cookies) and those requiring consent, about which, it states, the visitor is notified on the first visit and asked for consent. Moreover, the policy states directly that the authority “does not use or permit third-party cookies through which third parties could collect data without the visitor’s consent.” Among the services named specifically are Google Analytics (with the stated legal basis of “legitimate interest”), Google Ads, and Facebook.

The capture reveals a different picture, on several counts at once. First, there is no consent banner or consent management platform on the page whatsoever — what the policy describes as “notification and a request for consent on the first visit” does not appear in the capture. Second, analytics and trackers fire immediately on load: Google Tag Manager and the Facebook SDK at +316 ms, the Google Analytics counters (GA4 G-L9J1SX4H20 plus the legacy counters UA-144750657-1 and UA-174562729-1) at +316–466 ms. Google Analytics, meanwhile, transmits data carrying the signal gcs=G100, corresponding to a state of “consent not given,” along with the parameter dma=1. Third, Google Ads remarketing activates — calls to stats.g.doubleclick.net/g/collect and google.ee/ads/ga-audiences — meaning the visitor’s data is used to build advertising audiences, not merely for statistics.

A separate problem is the third-party ShareThis widget. It loads at +316 ms (platform-api.sharethis.com), and at +1025 ms sends a tracking pixel to l.sharethis.com/pview, transmitting the hostname honvedelem.hu. This service is not named anywhere in the cookie policy — which directly contradicts the policy’s assertion that no third-party data collectors operate without consent. Additionally, Google Fonts loads prior to consent, transmitting the visitor’s IP address to Google.

Timing Relative to Consent

The Facebook SDK, GTM, and ShareThis fire at +316 ms; Google Fonts at +346 ms; the Google Analytics counters at +465 ms; the ShareThis tracking pixel at +1025 ms; Google Ads remarketing at +1087–1346 ms. There is no consent banner on the page that could have preceded any of this. No consent was given during the session (Set-Cookie is zero), and Google Analytics explicitly flags the data as sent without consent. That is, all trackers fire by default, on every visit.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion is drawn from the fact of script loading (GA, the Facebook SDK, ShareThis, remarketing) and from the consent signal in the Google Analytics requests, rather than from cookie headers. Google and Meta may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Server-side processing is not visible in a browser-based capture.

Conclusion

The portal of the Hungarian Ministry of Defence launches Google Analytics (three counters, including deprecated ones), the Facebook SDK, Google Ads remarketing, and the third-party tracker ShareThis immediately on page load, without any consent banner, and Google Analytics explicitly flags the data as sent without consent. The Cookie Policy, meanwhile, states the opposite: that trackers requiring consent are activated only after a consent request, and that third-party data collectors operating without consent are not permitted. The discrepancy is direct and multi-fold: the declared consent mechanism is absent, remarketing and the ShareThis tracker are undisclosed, and data is transferred to third-party recipients in the USA by default. For the website of a defence ministry, launching analytics, advertising remarketing, and third-party tracking on every visit and outside any consent mechanism constitutes a violation of the requirements concerning the legal basis for processing, disclosure of recipients, and cross-border transfer. Remedy: implement a functioning consent banner and hold back all non-essential trackers until consent is given, remove or disclose ShareThis, and host fonts locally.