mnb.hu

Context

mnb.hu is the website of the Central Bank of Hungary (Magyar Nemzeti Bank, MNB), the country’s national financial regulator and issuing bank. The data controller is MNB. The site is served with HSTS. Capture: 118 requests, 12 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address and viewing data via Google Analytics, Google Ads / DoubleClick (advertising and remarketing), GA Audiences, Google Ads conversion measurement, YouTube embeds, and Google Fonts.

Declared versus Actual

For the website of a central bank, this profile is unexpectedly heavy. The capture shows that, prior to any consent, the site does not merely load trackers — it actually sends calls to Google’s analytics and advertising infrastructure. At +1416 ms, GA4 hits are sent (region1.analytics.google.com/g/collect). At almost the same moment, a DoubleClick call (stats.g.doubleclick.net) is sent, along with the GA Audiences remarketing pixel (google.ee/ads/ga-audiences) and Google Ads conversion measurement (google.com/ccm/collect). Subsequently, owing to three embedded YouTube videos connected via the standard youtube.com/embed (rather than the private youtube-nocookie mode), DoubleClick advertising infrastructure (googleads.g.doubleclick.net/pagead/id, static.doubleclick.net) and YouTube telemetry are invoked repeatedly. All of this occurs prior to consent.

Now compare this against the policy. MNB’s separate cookie page acknowledges that measurement codes (web beacons) from Google and Yahoo are used to analyze user behavior, and that the data collected may also be used to display relevant advertising. That is, on this page, the fact of advertising-related analytics is disclosed — though neither Google Analytics, DoubleClick, nor YouTube is named specifically. But the consent model on it is invalid: “by using the site, you accept the use of cookies,” with no equally prominent rejection option and no holding back of advertising tags until a choice is made. MNB’s general privacy notice, meanwhile, in the section on data collected upon visiting the site, contains the directly opposite statement: “no data transfer occurs within this scope of processing.” The capture contradicts this literally: data is transferred to Google and YouTube on every visit.

The core issue here is not even non-disclosure but two other factors: first, advertising and remarketing calls fire (DoubleClick, GA Audiences, conversion measurement) — and these require explicit prior consent; second, they fire under an invalid consent model and alongside a direct statement in part of the policy that no data transfer occurs.

Timing Relative to Consent

Analytics and advertising calls occur at +1416–1456 ms; YouTube and its advertising infrastructure at +1562–4733 ms; the second GA4 hit at +6494 ms. All prior to any action by the visitor. The “consent by continued browsing” model holds nothing back. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The Yahoo measurement codes mentioned in the policy are not observed in this capture — only Google is visible. Client/device identifiers carried in the GA and DoubleClick calls are intentionally not reproduced in this card. GA4 communicates with an EU regional endpoint (region1), but the DoubleClick and Google Ads advertising infrastructure are Google’s (USA) advertising services. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation, not the location of the node. Set-Cookie is zero at the HTTP header level, but GA, DoubleClick, and YouTube set their own cookies via JavaScript, which is not reflected in this type of capture. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Central Bank of Hungary, prior to any consent, transmits visitor data to Google’s analytics and — more significantly — advertising infrastructure: GA4 hits, DoubleClick calls, the GA Audiences remarketing pixel, and Google Ads conversion measurement, and additionally loads three YouTube videos in standard, non-private mode, which pulls in advertising infrastructure as well. The site’s consent model — “by using the site, you accept cookies” — is invalid under the GDPR, and advertising and remarketing calls require explicit prior consent under the applicable rules, which is absent here. Additionally, the authority’s general policy, in the section on visiting the site, states directly that no data transfer occurs, which contradicts actual behavior. Launching advertising and remarketing tracking and transferring data to a third-party recipient in the USA prior to consent, under an invalid consent model, constitutes a violation of the requirements concerning the proper sequencing of consent, disclosure of recipients, and cross-border transfer — and for a national central bank, this carries particular weight. The remedy is within the authority’s own control: install a fully functioning consent banner with an equally prominent rejection option, launch GA4, Google Ads, and DoubleClick only after consent is given, switch the embedded videos to youtube-nocookie mode and connect them only after consent, host fonts locally, and bring the “no data transfer” statement into line with reality.