RU EN
www.
Technical audit · 29.05.2026

mnb.hu

Central Bank of Hungary
HU

The Central Bank of Hungary (Magyar Nemzeti Bank) — 118 requests, 12 domains. A heavy profile for a central bank: prior to any consent, Google Analytics hits are sent, along with advertising and remarketing calls to Google Ads / DoubleClick (including GA Audiences and conversion measurement), plus three embedded YouTube videos in standard (non-private) mode. The consent model — 'by using the site, you accept cookies' — is invalid. The general policy, meanwhile, states that no data transfer occurs upon visiting the site.

Request timeline

+0 ms · portal load
Markup and assets — served from the first-party domain www.mnb.hu. HSTS is present.
+732 ms · Google Tag Manager prior to consent
gtag.js (GA4, stream G-8R38V2GJB1) — the Google tag-orchestration container. The visitor's IP address is transmitted to Google (USA).
+1416…+1456 ms · analytics and advertising prior to consent
GA4 hits are sent (region1.analytics.google.com/g/collect), along with a DoubleClick call (stats.g.doubleclick.net/g/collect), the GA Audiences remarketing pixel (google.ee/ads/ga-audiences), and Google Ads conversion measurement (google.com/ccm/collect). All prior to consent.
+1562…+3003 ms · YouTube embeds prior to consent
Three videos are embedded via standard youtube.com/embed (not youtube-nocookie). The player, thumbnails from i.ytimg.com, and DoubleClick advertising infrastructure load (googleads.g.doubleclick.net/pagead/id, static.doubleclick.net/instream/ad_status.js).
+1859…+4733 ms · Google Fonts and telemetry prior to consent
Roboto font files from fonts.gstatic.com; YouTube telemetry (youtubei/v1/log_event) and continuing DoubleClick calls. A second GA4 hit at +6494 ms.
consent model invalid
The sole mechanism is a notice stating 'by using the site, you accept cookies.' There is no equally prominent rejection option and no holding back of advertising tags until a choice is made; all calls to Google and YouTube occur prior to any consent.
session state — no consent
Set-Cookie across the entire session is zero. No choice has been made by the user; hits have already been sent to Google's analytics and advertising infrastructure.
tracking profile
The central bank's site simultaneously runs web analytics (GA4), a Google Ads / DoubleClick advertising and remarketing complex, and embedded YouTube video — all active prior to consent.

Declared versus actual

✓ Cookie page (mnb.hu/cookie) — the model 'by using the site, you accept cookies'; acknowledges the use of Google and Yahoo measurement codes (web beacons) for behavior analysis and ad targeting — declared
✓ The general privacy notice (Adatkezelési tájékoztató), in the section on visiting the site, states that 'no data transfer occurs within this scope of processing' (a direct contradiction of the facts) — declared
✓ Google Analytics, DoubleClick/Google Ads, and YouTube are not named specifically in the policy — declared
+ Google Ads / DoubleClick, GA Audiences, conversion measurement — advertising/remarketing recipients of IP address from the USA, prior to consent, not named specifically — not declared
+ YouTube embeds in standard (non-private) mode — recipient of IP address from the USA, prior to consent, not named — not declared
+ Google Fonts (fonts.gstatic.com) — third-party recipient of IP address from the USA, prior to consent, not named — not declared

Transfer timings

+1416 ms region1.analytics.google.com

GA4 /g/collect — hit sent. Google, USA (EU regional endpoint).

+1418 ms stats.g.doubleclick.net

DoubleClick /g/collect — sent. Google, USA.

+1455 ms www.google.ee

GA Audiences — remarketing pixel. Google, USA.

+1456 ms www.google.com

ccm/collect — Google Ads conversion measurement. Google, USA.

+1562 ms www.youtube.com

Three embeds (standard, not nocookie) + telemetry. Google, USA.

+2421 ms googleads.g.doubleclick.net

DoubleClick pagead/id (×12) from the YouTube embeds. Google, USA.

+1859 ms fonts.gstatic.com

Roboto font files. Google, USA.

Detected trackers

Indicators of GDPR non-compliance

Context

mnb.hu is the website of the Central Bank of Hungary (Magyar Nemzeti Bank, MNB), the country’s national financial regulator and issuing bank. The data controller is MNB. The site is served with HSTS. Capture: 118 requests, 12 domains, recorded in a clean browser.

Google (USA) — the visitor’s IP address and viewing data via Google Analytics, Google Ads / DoubleClick (advertising and remarketing), GA Audiences, Google Ads conversion measurement, YouTube embeds, and Google Fonts.

Declared versus Actual

For the website of a central bank, this profile is unexpectedly heavy. The capture shows that, prior to any consent, the site does not merely load trackers — it actually sends calls to Google’s analytics and advertising infrastructure. At +1416 ms, GA4 hits are sent (region1.analytics.google.com/g/collect). At almost the same moment, a DoubleClick call (stats.g.doubleclick.net) is sent, along with the GA Audiences remarketing pixel (google.ee/ads/ga-audiences) and Google Ads conversion measurement (google.com/ccm/collect). Subsequently, owing to three embedded YouTube videos connected via the standard youtube.com/embed (rather than the private youtube-nocookie mode), DoubleClick advertising infrastructure (googleads.g.doubleclick.net/pagead/id, static.doubleclick.net) and YouTube telemetry are invoked repeatedly. All of this occurs prior to consent.

Now compare this against the policy. MNB’s separate cookie page acknowledges that measurement codes (web beacons) from Google and Yahoo are used to analyze user behavior, and that the data collected may also be used to display relevant advertising. That is, on this page, the fact of advertising-related analytics is disclosed — though neither Google Analytics, DoubleClick, nor YouTube is named specifically. But the consent model on it is invalid: “by using the site, you accept the use of cookies,” with no equally prominent rejection option and no holding back of advertising tags until a choice is made. MNB’s general privacy notice, meanwhile, in the section on data collected upon visiting the site, contains the directly opposite statement: “no data transfer occurs within this scope of processing.” The capture contradicts this literally: data is transferred to Google and YouTube on every visit.

The core issue here is not even non-disclosure but two other factors: first, advertising and remarketing calls fire (DoubleClick, GA Audiences, conversion measurement) — and these require explicit prior consent; second, they fire under an invalid consent model and alongside a direct statement in part of the policy that no data transfer occurs.

Analytics and advertising calls occur at +1416–1456 ms; YouTube and its advertising infrastructure at +1562–4733 ms; the second GA4 hit at +6494 ms. All prior to any action by the visitor. The “consent by continued browsing” model holds nothing back. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The Yahoo measurement codes mentioned in the policy are not observed in this capture — only Google is visible. Client/device identifiers carried in the GA and DoubleClick calls are intentionally not reproduced in this card. GA4 communicates with an EU regional endpoint (region1), but the DoubleClick and Google Ads advertising infrastructure are Google’s (USA) advertising services. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation, not the location of the node. Set-Cookie is zero at the HTTP header level, but GA, DoubleClick, and YouTube set their own cookies via JavaScript, which is not reflected in this type of capture. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Central Bank of Hungary, prior to any consent, transmits visitor data to Google’s analytics and — more significantly — advertising infrastructure: GA4 hits, DoubleClick calls, the GA Audiences remarketing pixel, and Google Ads conversion measurement, and additionally loads three YouTube videos in standard, non-private mode, which pulls in advertising infrastructure as well. The site’s consent model — “by using the site, you accept cookies” — is invalid under the GDPR, and advertising and remarketing calls require explicit prior consent under the applicable rules, which is absent here. Additionally, the authority’s general policy, in the section on visiting the site, states directly that no data transfer occurs, which contradicts actual behavior. Launching advertising and remarketing tracking and transferring data to a third-party recipient in the USA prior to consent, under an invalid consent model, indicates non-compliance with the requirements concerning the proper sequencing of consent, disclosure of recipients, and cross-border transfer — and for a national central bank, this carries particular weight. The remedy is within the authority’s own control: install a fully functioning consent banner with an equally prominent rejection option, launch GA4, Google Ads, and DoubleClick only after consent is given, switch the embedded videos to youtube-nocookie mode and connect them only after consent, host fonts locally, and bring the “no data transfer” statement into line with reality.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: hu/mnb-hu-2026-05-29.har
SHA-256: 51ed0f2ba3552bc63952af1f24e76e95c8ed42e12687a523a45c493cf91f6f1b
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — mnb.hu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website mnb.hu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) Prior to any consent, advertising and remarketing calls are sent to Google's infrastructure: DoubleClick (googleads.g.doubleclick.net ×12, static.doubleclick.net, stats.g.doubleclick.net/g/collect), the GA Audiences remarketing pixel (google.ee/ads/ga-audiences), Google Ads conversion measurement (google.com/ccm/collect), and GA4 hits (region1.analytics.google.com/g/collect ×2). This is not merely library loading — the calls are actually sent (HTTP 200/204 status codes). Meanwhile, the site's consent model is 'by using the site, you accept the use of cookies,' i.e., consent by continued browsing, with no equally prominent rejection option. Advertising and remarketing cookies require explicit prior consent under the applicable rules; here they fire before it. Set-Cookie across the session is zero.

2) Prior to consent, the visitor's IP address and viewing data are transmitted to Google (USA) via all the services listed above, as well as to YouTube (Google) — three videos are embedded on the page via the standard youtube.com/embed (not youtube-nocookie mode), which loads DoubleClick advertising infrastructure and YouTube telemetry (youtubei/v1/log_event). Google Fonts (Roboto) additionally loads. MNB's general privacy policy, in the section on visiting the site, states directly that 'no data transfer occurs within this scope of processing,' which directly contradicts the site's actual behavior; a separate cookie page acknowledges Google (and Yahoo) measurement codes for behavior analysis and ad targeting, but names neither Google Analytics, DoubleClick, nor YouTube specifically.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/hu-mnb-hu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — mnb.hu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website mnb.hu.

2. Circumstances
I visited the website mnb.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) Prior to any consent, advertising and remarketing calls are sent to Google's infrastructure: DoubleClick (googleads.g.doubleclick.net ×12, static.doubleclick.net, stats.g.doubleclick.net/g/collect), the GA Audiences remarketing pixel (google.ee/ads/ga-audiences), Google Ads conversion measurement (google.com/ccm/collect), and GA4 hits (region1.analytics.google.com/g/collect ×2). This is not merely library loading — the calls are actually sent (HTTP 200/204 status codes). Meanwhile, the site's consent model is 'by using the site, you accept the use of cookies,' i.e., consent by continued browsing, with no equally prominent rejection option. Advertising and remarketing cookies require explicit prior consent under the applicable rules; here they fire before it. Set-Cookie across the session is zero.

2) Prior to consent, the visitor's IP address and viewing data are transmitted to Google (USA) via all the services listed above, as well as to YouTube (Google) — three videos are embedded on the page via the standard youtube.com/embed (not youtube-nocookie mode), which loads DoubleClick advertising infrastructure and YouTube telemetry (youtubei/v1/log_event). Google Fonts (Roboto) additionally loads. MNB's general privacy policy, in the section on visiting the site, states directly that 'no data transfer occurs within this scope of processing,' which directly contradicts the site's actual behavior; a separate cookie page acknowledges Google (and Yahoo) measurement codes for behavior analysis and ad targeting, but names neither Google Analytics, DoubleClick, nor YouTube specifically.

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-mnb-hu/

3. GDPR provisions I ask you to examine
ePrivacy (Hungarian implementation) — advertising and remarketing prior to consent, invalid consent model; GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and cross-border transfer

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]