mavir.hu

Context

mavir.hu is the website of MAVIR (Magyar Villamosenergia-ipari Átviteli Rendszerirányító Zrt.), Hungary’s electricity transmission system operator, responsible for managing and balancing the national power grid. The data controller is MAVIR. Capture: 68 requests, 5 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via Google Analytics (GA4 and legacy) and Google Tag Manager. The subdomain rtdwweb.mavir.hu (power-system load data) belongs to the operator itself and does not transmit data to an external recipient.

Declared versus Actual

Under Hungarian law and common practice among government sites, analytics (statistical) cookies are classified as non-essential and are activated only after the visitor’s consent, with “the data subject’s consent” (GDPR Art. 6(1)(a)) as the legal basis.

The capture reveals otherwise. At +844 ms, immediately on page load, Google Tag Manager connects (identifier G-XE63M79CMC). At +1773 ms, the deprecated Universal Analytics counter loads (analytics.js), and at +2706–2782 ms, GA4 sends visit-registration hit requests — calls to www.google-analytics.com/j/collect and region1.google-analytics.com/g/collect. That is, the visit is actually registered, not merely a script loaded. No consent management platform or consent banner is present on the page at all. Moreover, the Google Analytics requests carry no Consent Mode signal (the gcs parameter): consent is not only not collected, it is not even signaled to Google. The visitor’s IP address is, meanwhile, transmitted to Google (USA).

The only other external call is to the operator’s own subdomain, rtdwweb.mavir.hu, from which power-grid load data is loaded; this is the operator’s own infrastructure, not a third-party recipient. No cookies are set in the captured headers (Set-Cookie is zero).

Timing Relative to Consent

Google Tag Manager fires at +844 ms, legacy Analytics at +1773 ms, and GA4 visit registration at +2706–2782 ms. All of this occurs before any choice is made by the user. There is no consent banner on the page that could have preceded any of this. No consent was given during the session, and there is no Consent Mode signal in the Google Analytics requests.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion is drawn from the fact of GTM loading and from the Google Analytics visit-registration hit requests, rather than from cookie headers. The exact text of mavir.hu’s own cookie policy is not separately confirmed as part of this capture; the conclusion regarding the requirement of consent for analytics rests on applicable Hungarian law and common practice. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation (a US company), not the location of the node. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Hungary’s electricity transmission system operator launches Google Tag Manager and Google Analytics (GA4 plus a deprecated counter) immediately on page load, without any consent banner, and actually registers the visitor’s visit — with the Google Analytics requests lacking even a Consent Mode signal. The visitor’s IP address is transmitted to Google (USA). For the operator of critical energy infrastructure, launching analytics and registering the visit by default, on every visit, and outside any consent mechanism, constitutes a violation of the requirements concerning the legal basis for processing and cross-border transfer. Remedy: implement a consent banner and hold back Google Analytics and Google Tag Manager until actual consent is given, or switch to privacy-preserving self-hosted analytics without data transfer to the USA.