RU EN
www.
Technical audit · 29.05.2026

mol.hu

Hungarian Oil and Gas Company
HU

MOL, the Hungarian oil and gas company — 197 requests, 16 domains. The site has its own consent management platform, but advertising and tracking do not wait for it: the Facebook pixel, Google Ads, Google Analytics, and LinkedIn Ads transmit data prior to consent, and Google Analytics flags it as 'consent not given.' The cookie policy, meanwhile, declares that advertising cookies operate only with consent.

Request timeline

+0 ms · portal load
Markup and resources — served from the first-party domain mol.hu (nginx). The site's own consent management platform (js/cookie-consent) loads at +343 ms.
+343 ms · Google Maps and the consent script
maps.googleapis.com — a fuel-station map; in parallel, the site's own consent manager loads from mol.hu/js/cookie-consent.
+887…+1175 ms · Facebook prior to consent
connect.facebook.net (SDK, fbevents.js) and www.facebook.com/tr — the Facebook pixel sends its first hit request before any choice is made.
a consent manager is present but does not hold back the trackers
The site has its own cookie-consent tool, but advertising and analytics calls do not depend on it and are sent before the user makes a choice.
+1862…+2380 ms · Google Ads and Analytics without consent
pagead2.googlesyndication.com/ccm/collect (multiple calls, Google Ads/AdSense) and region1.google-analytics.com/g/collect carrying gcs=G100 (consent not given). Set-Cookie across the session is zero; no choice has been made by the user.
+2679 ms · LinkedIn Ads without consent
px.ads.linkedin.com/collect, /attribution_trigger, /wa/, and snap.licdn.com (Insight Tag) — LinkedIn tracking with no consent having been collected.

Declared versus actual

✓ The site's own consent management platform (mol.hu/js/cookie-consent) — declared
✓ Cookie Policy — advertising and marketing cookies (Google, Meta, Xandr) only with consent — declared
✓ Transfer of data outside the EEA (Google LLC, Meta Platforms Inc., Xandr Inc.) under Standard Contractual Clauses (SCCs) is acknowledged — declared
+ The Facebook pixel, Google Ads, Google Analytics, and LinkedIn Ads fire prior to consent — not declared
+ Google Analytics transmits data carrying the signal gcs=G100 (consent not given) — not declared

Transfer timings

+1175 ms www.facebook.com

Facebook pixel hit request. Meta, USA.

+1862 ms pagead2.googlesyndication.com

ccm/collect (conversion/remarketing). Google, USA.

+2380 ms region1.google-analytics.com

GA4 G-J41WQS5HPG. Flagged 'consent not given.'

+2679 ms px.ads.linkedin.com

collect + attribution_trigger. LinkedIn, USA.

Detected trackers

Indicators of GDPR non-compliance

Context

mol.hu is the website of MOL (MOL Magyar Olaj- és Gázipari Nyrt.), Hungary’s largest oil and gas company, operator of a filling-station network and an energy business. The data controller is MOL. The site is built on nginx and equipped with its own consent management platform. Capture: 197 requests, 16 domains, recorded in a clean browser.

Google (USA) — Analytics, Ads/AdSense, Tag Manager, Maps. Meta/Facebook (USA) — pixel, 3 hit requests. LinkedIn (USA) — Insight Tag, collect, attribution.

Declared versus Actual

MOL’s cookie policy is constructed in detail and categorizes cookies as necessary, functional, statistical, and advertising. It states directly that advertising and marketing cookies are activated only with the visitor’s consent, and separately acknowledges that for a number of third-party cookies, data is transferred outside the European Economic Area — specifically to Google LLC, Meta Platforms Inc., and Xandr Inc. (USA) — on the basis of Standard Contractual Clauses (SCCs). The site has its own consent management platform (mol.hu/js/cookie-consent), loading at +343 ms.

The capture shows that a consent mechanism is present, but it does not hold back advertising and tracking. The Facebook pixel sends its first hit request (facebook.com/tr) as early as +1175 ms, just a few hundred milliseconds after the consent script loads. Next, at +1862 ms, multiple calls begin to Google Ads/AdSense (pagead2.googlesyndication.com/ccm/collect) — these are conversion and remarketing tags (the container set includes AW- and DC- identifiers characteristic of advertising campaigns and Campaign Manager). At +2380 ms, Google Analytics 4 (identifier G-J41WQS5HPG) transmits data carrying the signal gcs=G100, corresponding to a state of “consent not given.” At +2679 ms, LinkedIn Ads fires: px.ads.linkedin.com/collect, attribution_trigger, and the Insight Tag from snap.licdn.com.

Thus, a consent manager is present on the site, but the actual transfer of data to advertising and analytics recipients does not depend on it and occurs before the user makes a choice. No cookies are set in the captured headers (Set-Cookie is zero), but the absence of cookies does not negate the transfer of data that has already taken place via pixels and collectors.

The consent script loads at +343 ms, the Facebook pixel at +1175 ms, Google Ads from +1862 ms, Google Analytics (gcs=G100) at +2380 ms, and LinkedIn Ads at +2679 ms. All advertising and analytics calls precede any choice made by the user. No consent was given during the session, and Google Analytics explicitly flags the data as sent without consent.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion is drawn from the fact of script loading and from the hit requests of the pixels and collectors (Facebook /tr, Google Ads ccm/collect, GA g/collect, LinkedIn collect), as well as from the consent signal in the Google Analytics request. Google, Meta, and LinkedIn may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Behavior following a click on “accept” or “reject” is not observed in this session. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Hungary’s largest oil and gas company is equipped with its own consent management platform, but advertising and tracking launch without waiting for consent: the Facebook pixel, Google Ads/AdSense, Google Analytics, and LinkedIn Ads transmit data before the user makes a choice, and Google Analytics flags it as “consent not given.” MOL’s cookie policy, meanwhile, states directly that advertising and marketing cookies are activated only with consent, and acknowledges the transfer of data to the USA. The discrepancy between what is declared and what actually occurs here is fundamental: a consent mechanism is present, but it does not govern the actual transfer of data, which flows to advertising recipients in the USA by default. This indicates non-compliance with the requirements concerning the legal basis for processing and cross-border transfer. Remedy: link all advertising and analytics tags to the consent manager and hold them back (including via Google Consent Mode) until actual consent is given.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: hu/mol-hu-2026-05-29.har
SHA-256: c1d0929978c5cf3904ec068ab9e3be893ea0bf50bb9cbe229289336e21fa00d3
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — mol.hu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website mol.hu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) The site has its own consent management platform (mol.hu/js/cookie-consent/, loading at +343 ms), yet advertising and tracking services fire without waiting for consent. The Facebook pixel sends hit requests to facebook.com/tr (the first at +1175 ms), Google Ads/AdSense sends multiple calls to pagead2.googlesyndication.com/ccm/collect (at +1862 ms), Google Analytics 4 (G-J41WQS5HPG) sends a call to region1.google-analytics.com/g/collect carrying the signal gcs=G100 (consent not given), and LinkedIn Ads calls px.ads.linkedin.com/collect and attribution_trigger (at +2679 ms). MOL's cookie policy states directly that advertising and marketing cookies (Google, Meta, Xandr) are activated only with consent. In fact, however, they execute before any choice is made.

2) Prior to consent, the visitor's IP address and identifiers are transmitted to advertising recipients in the USA: Google (Analytics, Ads, Maps), Meta/Facebook (pixel), LinkedIn. The cookie policy itself acknowledges that data is transferred outside the EEA (Google LLC, Meta Platforms Inc., Xandr Inc.) under Standard Contractual Clauses (SCCs) — but in fact this transfer occurs before consent is collected.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/hu-mol-hu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — mol.hu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website mol.hu.

2. Circumstances
I visited the website mol.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) The site has its own consent management platform (mol.hu/js/cookie-consent/, loading at +343 ms), yet advertising and tracking services fire without waiting for consent. The Facebook pixel sends hit requests to facebook.com/tr (the first at +1175 ms), Google Ads/AdSense sends multiple calls to pagead2.googlesyndication.com/ccm/collect (at +1862 ms), Google Analytics 4 (G-J41WQS5HPG) sends a call to region1.google-analytics.com/g/collect carrying the signal gcs=G100 (consent not given), and LinkedIn Ads calls px.ads.linkedin.com/collect and attribution_trigger (at +2679 ms). MOL's cookie policy states directly that advertising and marketing cookies (Google, Meta, Xandr) are activated only with consent. In fact, however, they execute before any choice is made.

2) Prior to consent, the visitor's IP address and identifiers are transmitted to advertising recipients in the USA: Google (Analytics, Ads, Maps), Meta/Facebook (pixel), LinkedIn. The cookie policy itself acknowledges that data is transferred outside the EEA (Google LLC, Meta Platforms Inc., Xandr Inc.) under Standard Contractual Clauses (SCCs) — but in fact this transfer occurs before consent is collected.

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-mol-hu/

3. GDPR provisions I ask you to examine
GDPR Art. 6 + ePrivacy (Hungarian implementation) — advertising and tracking prior to consent; GDPR Art. 13(1)(e) + Chapter V — cross-border transfer prior to consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]