kozbeszerzes.hu

Context

kozbeszerzes.hu is the portal of the Public Procurement Authority of Hungary (Közbeszerzési Hatóság), the body responsible for oversight and regulation of public procurement and for publishing related statistics. The data controller is the Közbeszerzési Hatóság. Capture: 66 requests, 4 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via the loading of Google Fonts. Matomo analytics is hosted on a subdomain of the authority’s own domain and does not transmit data to an external recipient.

Declared versus Actual

The authority’s available data processing policy describes the mobile app in detail: push notifications, statistics, and crash reports via Google Firebase services (Analytics, Crashlytics, Cloud Messaging), with “the data subject’s consent” given as the legal basis. Data processing, as declared, is carried out to the extent necessary, and personal data is not transferred to third parties beyond what is required.

The capture relates to the web portal and reveals two things occurring prior to any consent. First, the site runs self-hosted Matomo analytics (analytics.kozbeszerzes.hu) — that is, on the authority’s own infrastructure, which is inherently preferable from a privacy standpoint to external analytics clouds. However, the request to analytics.kozbeszerzes.hu/matomo.php carries the parameter rec=1, denoting the actual recording of the visit, together with a unique visitor identifier, the page title, and the full URL. That is, the visit is recorded, not merely a script loaded. No consent banner or consent management platform is present on the page at all, and no signs of IP anonymization are visible in the tracking parameters.

Second, at +116–204 ms, Google Fonts loads: CSS from fonts.googleapis.com and Source Sans 3 font files from fonts.gstatic.com. Both loads transmit the visitor’s IP address to Google (USA). This service is not disclosed in the authority’s available materials.

No cookies are set during the session (Set-Cookie is zero). There are no other trackers — Google Analytics, advertising pixels, social media — in the capture; external calls are limited to Matomo on the authority’s own subdomain and Google Fonts.

Timing Relative to Consent

Google Fonts loads at +116 ms, Matomo at +200 ms, and the visit registration in Matomo (matomo.php, rec=1) at +259 ms. All of this occurs before any choice is made by the user. There is no consent banner on the page that could have preceded any of this. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Matomo is hosted on the authority’s own subdomain, so analytics data is not transmitted to a third-party recipient; the issue here is the legal basis for recording the visit prior to consent, not cross-border transfer. The tracking parameters do not reveal whether IP anonymization or other privacy-related Matomo settings are enabled server-side. Google may use edge nodes within the EU; the conclusion regarding Google Fonts therefore concerns the recipient’s corporate affiliation (a US company), not the location of the node. Server-side processing is not visible in a browser-based capture.

Conclusion

The portal of the Public Procurement Authority of Hungary uses privacy-preferable self-hosted Matomo analytics on its own subdomain, but registers the visitor’s visit (rec=1, with an identifier and full URL) immediately on page load, without any consent banner. Additionally, Google Fonts loads prior to consent, transmitting the visitor’s IP address to Google (USA). For a state supervisory authority, recording the visit via analytics and transferring the IP address to a third-party recipient in the USA by default, on every visit, and outside any consent mechanism, constitutes a violation of the requirements concerning the legal basis for processing, and, with respect to the fonts, of the requirements concerning disclosure of recipients and cross-border transfer. The remedy is simple: display a consent banner and hold back Matomo’s visit registration until consent is given (or switch Matomo to a fully anonymous statistics mode without cookies or identifiers), and host the fonts locally on the site’s own domain.