RU EN
www.
Technical audit · 29.05.2026

honvedelem.hu

Ministry of Defence of Hungary
HU

Policy changed — see what exactly · 2026-07-11 →

The Ministry of Defence of Hungary (the armed forces portal, operated by HM Zrínyi Nonprofit Kft.) — 98 requests, 13 domains. There is no consent banner on the page whatsoever: Google Analytics (three counters), the Facebook SDK, Google Ads remarketing, and the third-party tracker ShareThis fire immediately on load, before any choice is made. Google Analytics sends data flagged as 'consent not given.' The Cookie Policy, meanwhile, states that trackers requiring consent are activated only after a consent request.

Request timeline

+0 ms · portal load
Markup and resources — served from the first-party domain honvedelem.hu (behind Cloudflare).
+316 ms · analytics, advertising, social media prior to consent
www.googletagmanager.com/gtag/js and connect.facebook.net/sdk.js — Google Tag Manager and the Facebook SDK; platform-api.sharethis.com — a third-party ShareThis widget. All immediately on load.
+346 ms · Google Fonts prior to consent
fonts.googleapis.com and fonts.gstatic.com — the Bebas Neue and Roboto fonts. The visitor's IP address is transmitted to Google (USA).
+465 ms · Google Analytics counters
www.google-analytics.com/analytics.js (legacy UA) and gtag (GA4 G-L9J1SX4H20). Loaded without consent.
no consent banner present
There is no consent management platform or consent banner in the capture. The only consent-related object found is a service call to ShareThis (l.sharethis.com/pview), not a consent mechanism belonging to the site.
session state — no consent
Set-Cookie is zero in the captured headers. Google Analytics (G-L9J1SX4H20) transmits telemetry with gcs=G100 (consent not given) and dma=1. No choice has been made by the user.
+1025…+1346 ms · tracking and remarketing without consent
l.sharethis.com/pview — the ShareThis tracking pixel; stats.g.doubleclick.net/g/collect and google.ee/ads/ga-audiences — Google Ads remarketing. All without consent having been collected.

Declared versus actual

✓ Cookie Policy ('Sütikezelés tájékoztató') — cookies requiring consent are activated after a consent request on the first visit — declared
✓ Declared: the authority 'does not use or permit third-party cookies that collect data without consent' — declared
✓ Google Analytics (legal basis — legitimate interest), Google Ads and Facebook (legal basis — consent) — declared
+ ShareThis (platform-api.sharethis.com, l.sharethis.com) — third-party tracking widget, not named in the policy — not declared
+ Google Ads remarketing (stats.g.doubleclick.net, ga-audiences) — prior to consent, not separately disclosed — not declared
+ Google Analytics transmits data carrying the signal gcs=G100 (consent not given); no consent banner is present in the capture — not declared

Transfer timings

+316 ms connect.facebook.net

Facebook SDK. Meta, USA.

+465 ms www.google-analytics.com

Google Analytics. Google, USA. gcs=G100.

+1025 ms l.sharethis.com

ShareThis pview with hostname honvedelem.hu. Not named in the policy.

+1346 ms www.google.ee

ga-audiences — Google Ads remarketing.

Detected trackers

Indicators of GDPR non-compliance

Context

honvedelem.hu is the official portal of the Ministry of Defence and the armed forces of Hungary. The operator and data controller is HM Zrínyi Térképészeti és Kommunikációs Szolgáltató Nonprofit Kft. (a mapping and communications company under the Ministry of Defence). The site is served through the Cloudflare network. The ministry publishes a cookie policy (“Sütikezelés tájékoztató”). Capture: 98 requests, 13 domains, recorded in a clean browser.

Google (USA) — Analytics (three counters), Ads/remarketing, Tag Manager, Fonts. Meta/Facebook (USA) — SDK. ShareThis — a third-party tracking pixel carrying the hostname honvedelem.hu.

Declared versus Actual

The Ministry of Defence’s cookie policy states the condition clearly. It divides cookies into those not requiring consent (authentication, multimedia, load balancing, interface, and user security cookies) and those requiring consent, about which, it states, the visitor is notified on the first visit and asked for consent. Moreover, the policy states directly that the authority “does not use or permit third-party cookies through which third parties could collect data without the visitor’s consent.” Among the services named specifically are Google Analytics (with the stated legal basis of “legitimate interest”), Google Ads, and Facebook.

The capture reveals a different picture, on several counts at once. First, there is no consent banner or consent management platform on the page whatsoever — what the policy describes as “notification and a request for consent on the first visit” does not appear in the capture. Second, analytics and trackers fire immediately on load: Google Tag Manager and the Facebook SDK at +316 ms, the Google Analytics counters (GA4 G-L9J1SX4H20 plus the legacy counters UA-144750657-1 and UA-174562729-1) at +316–466 ms. Google Analytics, meanwhile, transmits data carrying the signal gcs=G100, corresponding to a state of “consent not given,” along with the parameter dma=1. Third, Google Ads remarketing activates — calls to stats.g.doubleclick.net/g/collect and google.ee/ads/ga-audiences — meaning the visitor’s data is used to build advertising audiences, not merely for statistics.

A separate problem is the third-party ShareThis widget. It loads at +316 ms (platform-api.sharethis.com), and at +1025 ms sends a tracking pixel to l.sharethis.com/pview, transmitting the hostname honvedelem.hu. This service is not named anywhere in the cookie policy — which directly contradicts the policy’s assertion that no third-party data collectors operate without consent. Additionally, Google Fonts loads prior to consent, transmitting the visitor’s IP address to Google.

The Facebook SDK, GTM, and ShareThis fire at +316 ms; Google Fonts at +346 ms; the Google Analytics counters at +465 ms; the ShareThis tracking pixel at +1025 ms; Google Ads remarketing at +1087–1346 ms. There is no consent banner on the page that could have preceded any of this. No consent was given during the session (Set-Cookie is zero), and Google Analytics explicitly flags the data as sent without consent. That is, all trackers fire by default, on every visit.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion is drawn from the fact of script loading (GA, the Facebook SDK, ShareThis, remarketing) and from the consent signal in the Google Analytics requests, rather than from cookie headers. Google and Meta may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Server-side processing is not visible in a browser-based capture.

Conclusion

The portal of the Hungarian Ministry of Defence launches Google Analytics (three counters, including deprecated ones), the Facebook SDK, Google Ads remarketing, and the third-party tracker ShareThis immediately on page load, without any consent banner, and Google Analytics explicitly flags the data as sent without consent. The Cookie Policy, meanwhile, states the opposite: that trackers requiring consent are activated only after a consent request, and that third-party data collectors operating without consent are not permitted. The discrepancy is direct and multi-fold: the declared consent mechanism is absent, remarketing and the ShareThis tracker are undisclosed, and data is transferred to third-party recipients in the USA by default. For the website of a defence ministry, launching analytics, advertising remarketing, and third-party tracking on every visit and outside any consent mechanism indicates non-compliance with the requirements concerning the legal basis for processing, disclosure of recipients, and cross-border transfer. Remedy: implement a functioning consent banner and hold back all non-essential trackers until consent is given, remove or disclose ShareThis, and host fonts locally.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: hu/honvedelem-hu-2026-05-29.har
SHA-256: 80453f138b9012b1f4ef55eb5acd5b1dce114cfb110cf010aedd0f207903f7fb
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — honvedelem.hu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website honvedelem.hu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) On page load, without any consent banner whatsoever, analytics and advertising trackers fire: Google Analytics 4 (G-L9J1SX4H20) and two legacy counters (UA-144750657-1, UA-174562729-1) at +316–466 ms, the Facebook SDK at +316 ms, and Google Ads remarketing — stats.g.doubleclick.net/g/collect and google.ee/ads/ga-audiences. Google Analytics transmits data carrying the signal gcs=G100 (consent not given) and dma=1. The Cookie Policy states directly that cookies requiring consent are activated only after a consent request, and that the authority 'does not use or permit third-party cookies that collect data without consent' — in fact, however, analytics, advertising, and remarketing occur before any choice is made.

2) Prior to consent, the visitor's IP address is transmitted to third-party recipients in the USA: Google (Analytics, Ads/remarketing, Tag Manager, Fonts) and Meta/Facebook. Additionally, a third-party ShareThis widget loads, sending a tracking pixel to l.sharethis.com/pview with the hostname honvedelem.hu — this service is not named in the policy at all, despite the policy's assertion that no third-party collectors operate without consent.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/hu-honvedelem-hu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — honvedelem.hu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website honvedelem.hu.

2. Circumstances
I visited the website honvedelem.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) On page load, without any consent banner whatsoever, analytics and advertising trackers fire: Google Analytics 4 (G-L9J1SX4H20) and two legacy counters (UA-144750657-1, UA-174562729-1) at +316–466 ms, the Facebook SDK at +316 ms, and Google Ads remarketing — stats.g.doubleclick.net/g/collect and google.ee/ads/ga-audiences. Google Analytics transmits data carrying the signal gcs=G100 (consent not given) and dma=1. The Cookie Policy states directly that cookies requiring consent are activated only after a consent request, and that the authority 'does not use or permit third-party cookies that collect data without consent' — in fact, however, analytics, advertising, and remarketing occur before any choice is made.

2) Prior to consent, the visitor's IP address is transmitted to third-party recipients in the USA: Google (Analytics, Ads/remarketing, Tag Manager, Fonts) and Meta/Facebook. Additionally, a third-party ShareThis widget loads, sending a tracking pixel to l.sharethis.com/pview with the hostname honvedelem.hu — this service is not named in the policy at all, despite the policy's assertion that no third-party collectors operate without consent.

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-honvedelem-hu/

3. GDPR provisions I ask you to examine
GDPR Art. 6 + ePrivacy (Hungarian implementation) — analytics, advertising, and social trackers prior to consent, with no banner; GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and cross-border transfer

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]