mavcsoport.hu

Context

mavcsoport.hu is the corporate website of the MÁV group (Magyar Államvasutak, Hungarian State Railways), the state railway holding company that brings together passenger transport (MÁV-START), infrastructure (MÁV Pályaműködtetési), and the parent company MÁV Zrt. The data controller is the companies of the MÁV group. The site is built on Drupal. Capture: 54 requests, 5 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via the GA4 and Google Ads (Adwords) tags, as well as via Google Fonts. There are no other third-party recipients in the capture.

Declared versus Actual

MÁV’s cookie policy describes tracking honestly and by name: it names the necessary cookies, Google Analytics for traffic measurement, and — in a separate line — marketing cookies, explicitly naming Google Adwords and Facebook Pixel as tools for measuring advertising campaign effectiveness. That is, at the level of the document, recipients are disclosed, including advertising ones.

The capture, however, reveals a problem not with disclosure but with timing. At +863 ms, before any consent, two tags load simultaneously via Google Tag Manager: the analytics tag GA4 (G-1MXJFLK4V8) and the advertising tag Google Ads / Adwords (AW-786697798). The second tag is a marketing tag, and under the policy’s own classification, it falls precisely within the marketing cookie category. Under the ePrivacy rules, marketing tags require prior consent: they should launch only after the visitor has given it. Here, however, the tag fires unconditionally, in the complete absence of any recorded consent (Set-Cookie is zero).

Additionally, at +1147 ms, Google Fonts connects (the Open Sans font), transmitting the visitor’s IP address and Referer header to Google (USA). Unlike Analytics and the advertising services, Google Fonts is not named in the policy at all.

Timing Relative to Consent

The Google tags (GA4 and Google Ads) fire at +863 ms; Google Fonts at +1147–1540 ms — all before any action by the visitor. The key point: the Google Ads advertising tag, which under the rules should wait for consent, fires before it. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The GA4 and Google Ads tags are loaded in the capture — this alone has already transmitted the IP address to Google — but there are no separate GA /g/collect or Google Ads conversion beacon calls within the capture window, so the HAR cannot establish exactly which events were sent; the fact of IP address transmission upon tag loading did, however, occur. The Facebook Pixel declared in the policy is not observed in this capture — no conclusion about its behavior can be drawn from this snapshot. The calls to mavstart.hu at the start of the capture are redirects from a related domain within the MÁV group, not a third-party tracker. The tags may operate in Consent Mode, holding back part of the processing until consent is given; this does not negate the transfer of the IP address upon their loading. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation (Google, USA), not the location of the node. The capture was recorded in a lean form without response bodies, so the visual state of the banner cannot be reconstructed from it. Server-side processing is not visible in a browser-based capture.

Conclusion

The corporate website of the Hungarian State Railways group transmits the visitor’s IP address to Google, prior to any consent, via several channels at once: the GA4 analytics tag, the Google Ads (Adwords) advertising tag, and Google Fonts. MÁV’s cookie policy, unlike many sites, discloses both analytics and marketing services by name — but this is precisely what makes the violation particularly stark: the advertising tag, which the policy itself classifies as marketing and which under the rules requires prior consent, fires before the visitor makes any choice. The IP address is additionally transmitted via the undisclosed Google Fonts. Launching a marketing tag and transferring the IP address to a third-party recipient in the USA prior to consent constitutes a violation of the requirements concerning the proper sequencing of consent and cross-border transfer. The remedy is within the operator’s control: launch the Google Ads and Google Analytics tags only after consent is given via a correctly configured consent mechanism, and host Google Fonts locally on the site’s own domain.