RU EN
www.
Technical audit · 2026-05-29

kormany.hu

Government Portal of Hungary
HU

Policy changed — see what exactly · 2026-08-14 →

The Government Portal of Hungary (kormany.hu, operated by the Prime Minister's Office / NISZ) — 189 requests, 6 domains. The analytics declared in the policy (Google Analytics, GTM) do not fire in the capture, but the Facebook SDK, Adobe Typekit fonts, and YouTube thumbnails load prior to any consent. The Cookie Policy, meanwhile, classifies third-party cookies, including Facebook, as consent-based.

Timeline of the leak

+0 ms · portal load
Markup, scripts, images — served from the first-party domain kormany.hu (nginx) and the site's own media CDN, cdn.kormany.hu. CSP, HSTS, and X-Frame-Options SAMEORIGIN are present.
+692 ms · Adobe Typekit fonts prior to consent
p.typekit.net and use.typekit.net — Adobe Fonts (Typekit). The visitor's IP address is transmitted to a third-party recipient (Adobe, USA).
+3007 ms · Facebook SDK prior to consent
connect.facebook.net/en_US/sdk.js — loading of the Facebook SDK (a social module). A call to Meta (USA) without prior consent.
no consent banner present in the capture
The policy describes a consent pop-up window with 'Accept' / 'Do not accept' buttons; however, in the capture it does not hold back the external calls that fire beforehand.
session state — no consent
Set-Cookie across the entire session is zero. No choice has been made by the user; the calls to Facebook, Typekit, and YouTube have already taken place.
+12492 ms · YouTube thumbnails
img.youtube.com — static thumbnails of embedded videos (sddefault.jpg). Google Analytics and GTM, though permitted by the CSP, do not fire in the capture.

Declared versus actual

✓ Cookie Policy — a consent mechanism via a pop-up window with 'Accept' / 'Do not accept' buttons — заявлен
✓ Upon rejection — only basic cookies (GDPR Art. 6(1)(e)), no processing of personal data takes place — заявлен
✓ Third-party cookies (Google Analytics, GTM, YouTube, Facebook Pixel) — on the basis of consent (GDPR Art. 6(1)(a)) — заявлен
+ The Facebook SDK loads prior to consent, outside the declared mechanism — не заявлен
+ Adobe Typekit (use.typekit.net, p.typekit.net) — third-party recipient of IP address from the USA, not named in the policy — не заявлен

Transfer timings

+692 ms use.typekit.net

Adobe Fonts (Typekit). Adobe, USA. Not named in the policy.

+3007 ms connect.facebook.net

Facebook SDK (social module). Meta, USA.

+12492 ms img.youtube.com

Static YouTube video thumbnails. Google, USA.

Detected trackers

Indicators of GDPR non-compliance

Context

kormany.hu is the central government portal of Hungary. The data controller is the Prime Minister’s Office (Miniszterelnökség); technical operation is carried out by the state-owned company NISZ (Nemzeti Infokommunikációs Szolgáltató Zrt.). The site is served by an nginx server, with media delivered from the site’s own CDN, cdn.kormany.hu. The portal publishes a data processing policy describing its consent mechanism. Capture: 189 requests, 6 domains, recorded in a clean browser.

Meta/Facebook (USA) — IP address via the loading of the Facebook SDK. Adobe (USA) — IP address via Typekit fonts. Google/YouTube (USA) — IP address via static video thumbnails.

Declared versus Actual

The government portal’s cookie policy describes its consent mechanism in detail: upon arrival, a pop-up window is shown, where the “Accept” button activates the use of cookies on the basis of voluntary consent (GDPR Art. 6(1)(a)), while the “Do not accept” button restricts the site to only basic, technically necessary cookies (GDPR Art. 6(1)(e)), in which case, as stated directly, no processing of personal data takes place. Third-party cookies — Google Analytics, Google Tag Manager, YouTube, and Facebook Pixel — are classified by the policy as consent-based, with “data subject’s consent” given as the legal basis.

The capture partially confirms this model: the declared Google analytics (Analytics, GTM) does not fire in a session without consent — there are no calls to it in the capture. However, three external calls occur before any choice is made by the user. First, at +3007 ms, the Facebook SDK loads (connect.facebook.net/en_US/sdk.js) — a Meta social module that transmits the visitor’s IP address to a third-party recipient in the USA. The policy classifies Facebook directly as a consent-based third-party cookie, yet in fact the SDK activates without waiting for consent. Second, even earlier, at +692 ms, Adobe Typekit fonts connect (p.typekit.net, use.typekit.net), transmitting the IP address to Adobe (USA); this service is not named in the policy at all. Third, at +12492 ms, static thumbnails of embedded YouTube videos load (img.youtube.com) — these are images rather than a full player, but the call to a Google domain likewise occurs prior to consent.

No cookies are set during the session (Set-Cookie is zero). Nevertheless, the absence of cookies does not negate the transfer of the IP address that has already taken place: Facebook, Adobe, and YouTube receive the visitor’s data before the visitor could have made a choice in the consent window described by the policy.

Adobe Typekit fonts load at +692 ms, the Facebook SDK at +3007 ms, and the YouTube thumbnails at +12492 ms. All of this occurs before any choice is made by the user. The consent pop-up window described by the policy does not hold back these calls in the capture — they occur independently of it. No consent was given during the session (Set-Cookie is zero). The declared Google analytics, meanwhile, correctly does not fire.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. The Facebook SDK is loaded as a script; whether it transmits interaction data in this session beyond the fact of the call itself cannot be determined from a browser-based capture. The YouTube thumbnails load as static images (img.youtube.com), which is less invasive than an embedded player. Adobe, Meta, and Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. The declared Google analytics is not observed in the capture — its behavior following consent was not tested. Server-side processing is not visible in a browser-based capture.

Conclusion

The government portal of Hungary correctly holds back the declared Google analytics until consent is given, but three third-party calls bypass the consent window described in the policy: the Facebook SDK, Adobe Typekit fonts, and YouTube video thumbnails load by default, transmitting the visitor’s IP address to third-party recipients in the USA. The policy classifies Facebook as a consent-based third-party cookie — meaning its loading prior to consent directly contradicts what is declared; Adobe Typekit is not named in the policy at all. For a central government portal, the transfer of the visitor’s IP address to third-party recipients in the USA prior to consent and outside the declared consent mechanism constitutes a violation of the requirements concerning the legal basis for processing, disclosure of recipients, and cross-border transfer. Remedy: hold back the Facebook SDK until consent is given via the mechanism already described in the policy, host fonts locally instead of using Adobe Typekit, and load YouTube thumbnails from the site’s own domain.

Evidence
Original (audit)
HAR file: hu/kormany-hu-2026-05-29.har
SHA-256: 762ed75a95ef07e638abc314594608d468430704258dda6a460362efdd36f442
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

To: Hungarian National Authority for Data Protection (NAIH)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website kormany.hu.

2. Circumstances
I visited the website kormany.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) On page load, before any choice is made by the user, the Facebook SDK loads (connect.facebook.net/en_US/sdk.js at +3007 ms). The Cookie Policy states directly that third-party cookies, including Facebook, are processed on the basis of consent (GDPR Art. 6(1)(a)), and that if cookies are declined, no processing of personal data takes place. The consent mechanism is described as a pop-up window with 'Accept' / 'Do not accept' buttons. In fact, the Facebook SDK activates without waiting for this choice.

2) Prior to consent, the visitor's IP address is transmitted to third-party recipients: Meta/Facebook (via the SDK), Adobe Typekit (fonts, use.typekit.net), and YouTube (static video thumbnails, img.youtube.com). Facebook and YouTube are named in the policy; Adobe Typekit is not. All three recipients are US companies.

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-kormany-hu/

3. Provisions violated
GDPR Art. 6 + ePrivacy (Hungarian implementation) — third-party social module prior to consent; GDPR Art. 13(1)(e) + Chapter V — third-party recipient prior to consent

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]