mek.hu

Context

mek.hu is the official professional portal of the Chamber of Hungarian Architects (Magyar Építész Kamara, MÉK), a body carrying out statutorily assigned public-administrative tasks in the field of architectural practice and providing information to practicing architects. The data controller is MÉK. The site is served by an Apache server. Capture: 67 requests, 3 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via Google Analytics and Google Tag Manager.

Declared versus Actual

The Chamber of Architects’ cookie policy states the legal basis directly: data processing via cookies is carried out on the basis of the data subject’s consent (GDPR Art. 6(1)(a)), with consent withdrawable through browser settings. The policy separately names Google Analytics as the statistics tool in use and states that the Chamber does not process personal data via cookies.

The capture reveals a different sequence. At +279 ms, immediately on page load, Google Tag Manager connects (identifier G-7299H38393). Google Analytics 4 then sends a visit-registration hit request — a call to region1.google-analytics.com/g/collect carrying the page address. That is, the visit is actually registered. No consent management platform or consent banner is present on the page at all, and the Google Analytics request carries no Consent Mode signal (the gcs parameter): consent is not collected, and this is not signaled to Google. The visitor’s IP address is, meanwhile, transmitted to Google (USA).

There are no other trackers — Facebook, advertising pixels, font services — in the capture. No cookies are set in the captured headers (Set-Cookie is zero). The discrepancy is direct: the policy promises analytics only with consent, while in fact it activates by default, without a banner and without a choice by the user.

Timing Relative to Consent

Google Tag Manager fires at +279 ms; GA4 visit registration at +5601 ms. Both occur before any choice is made by the user. There is no consent banner on the page that could have preceded any of this. No consent was given during the session, and there is no Consent Mode signal in the Google Analytics request.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion is drawn from the fact of GTM loading and from the Google Analytics visit-registration hit request, rather than from cookie headers. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation (a US company), not the location of the node. Server-side processing is not visible in a browser-based capture.

Conclusion

The official portal of the Chamber of Hungarian Architects launches Google Tag Manager and Google Analytics immediately on page load, without any consent banner, and actually registers the visitor’s visit — with the Google Analytics request lacking even a Consent Mode signal. The Chamber’s cookie policy states directly the opposite: that processing via cookies is carried out only on the basis of the data subject’s consent. The discrepancy between what is declared and what actually occurs here is direct. For the website of a body with public-administrative functions, launching analytics and registering the visit by default, on every visit, and outside any consent mechanism, together with the transfer of the IP address to Google (USA), constitutes a violation of the requirements concerning the legal basis for processing and cross-border transfer. Remedy: implement a consent banner and hold back Google Analytics and Google Tag Manager until actual consent is given, or switch to privacy-preserving self-hosted analytics without data transfer to the USA.