mol.hu

Context

mol.hu is the website of MOL (MOL Magyar Olaj- és Gázipari Nyrt.), Hungary’s largest oil and gas company, operator of a filling-station network and an energy business. The data controller is MOL. The site is built on nginx and equipped with its own consent management platform. Capture: 197 requests, 16 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — Analytics, Ads/AdSense, Tag Manager, Maps. Meta/Facebook (USA) — pixel, 3 hit requests. LinkedIn (USA) — Insight Tag, collect, attribution.

Declared versus Actual

MOL’s cookie policy is constructed in detail and categorizes cookies as necessary, functional, statistical, and advertising. It states directly that advertising and marketing cookies are activated only with the visitor’s consent, and separately acknowledges that for a number of third-party cookies, data is transferred outside the European Economic Area — specifically to Google LLC, Meta Platforms Inc., and Xandr Inc. (USA) — on the basis of Standard Contractual Clauses (SCCs). The site has its own consent management platform (mol.hu/js/cookie-consent), loading at +343 ms.

The capture shows that a consent mechanism is present, but it does not hold back advertising and tracking. The Facebook pixel sends its first hit request (facebook.com/tr) as early as +1175 ms, just a few hundred milliseconds after the consent script loads. Next, at +1862 ms, multiple calls begin to Google Ads/AdSense (pagead2.googlesyndication.com/ccm/collect) — these are conversion and remarketing tags (the container set includes AW- and DC- identifiers characteristic of advertising campaigns and Campaign Manager). At +2380 ms, Google Analytics 4 (identifier G-J41WQS5HPG) transmits data carrying the signal gcs=G100, corresponding to a state of “consent not given.” At +2679 ms, LinkedIn Ads fires: px.ads.linkedin.com/collect, attribution_trigger, and the Insight Tag from snap.licdn.com.

Thus, a consent manager is present on the site, but the actual transfer of data to advertising and analytics recipients does not depend on it and occurs before the user makes a choice. No cookies are set in the captured headers (Set-Cookie is zero), but the absence of cookies does not negate the transfer of data that has already taken place via pixels and collectors.

Timing Relative to Consent

The consent script loads at +343 ms, the Facebook pixel at +1175 ms, Google Ads from +1862 ms, Google Analytics (gcs=G100) at +2380 ms, and LinkedIn Ads at +2679 ms. All advertising and analytics calls precede any choice made by the user. No consent was given during the session, and Google Analytics explicitly flags the data as sent without consent.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion is drawn from the fact of script loading and from the hit requests of the pixels and collectors (Facebook /tr, Google Ads ccm/collect, GA g/collect, LinkedIn collect), as well as from the consent signal in the Google Analytics request. Google, Meta, and LinkedIn may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Behavior following a click on “accept” or “reject” is not observed in this session. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Hungary’s largest oil and gas company is equipped with its own consent management platform, but advertising and tracking launch without waiting for consent: the Facebook pixel, Google Ads/AdSense, Google Analytics, and LinkedIn Ads transmit data before the user makes a choice, and Google Analytics flags it as “consent not given.” MOL’s cookie policy, meanwhile, states directly that advertising and marketing cookies are activated only with consent, and acknowledges the transfer of data to the USA. The discrepancy between what is declared and what actually occurs here is fundamental: a consent mechanism is present, but it does not govern the actual transfer of data, which flows to advertising recipients in the USA by default. This constitutes a violation of the requirements concerning the legal basis for processing and cross-border transfer. Remedy: link all advertising and analytics tags to the consent manager and hold them back (including via Google Consent Mode) until actual consent is given.