mta.hu

Context

mta.hu is the website of the Hungarian Academy of Sciences (Magyar Tudományos Akadémia, MTA), the country’s top scientific institution. The data controller is MTA. Capture: 184 requests, 5 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via Google Analytics and Google Tag Manager. Hoefler&Co / Monotype (USA) — IP address via the font service cloud.typography.com. Piwik/Matomo is hosted on the academy’s own subdomain and does not transmit data to an external recipient.

Declared versus Actual

Under Hungarian law and common practice among scientific and government sites, analytics (statistical) cookies are classified as non-essential and are activated only after the visitor’s consent. The academy’s own materials name Google Analytics and Piwik/Matomo as the statistics tools in use.

The capture shows that on the home page, both analytics systems fire prior to any consent and without a banner. At +399 ms, Google Tag Manager connects (identifier G-45NN4EM3BG), and at +637 ms Google Analytics 4 sends a visit-registration hit request (region1.google-analytics.com/g/collect); the request carries no Consent Mode signal (the gcs parameter), meaning consent is not collected and this is not signaled to Google. A second analytics system operates in parallel: self-hosted Piwik/Matomo on the academy’s subdomain (doktar.titkarsag.mta.hu) sends, at +3262 ms, a request to piwik.php carrying the parameter rec=1, denoting the actual registration of the visit, together with a unique visitor identifier and the page URL. That is, the visit is recorded twice — both in Google and in the academy’s own Piwik — before any choice is made by the user.

Additionally, at +400 ms, fonts load from the third-party service cloud.typography.com (Hoefler&Co / Monotype, USA), transmitting the visitor’s IP address to a third-party recipient. No consent management platform or consent banner is present on the page at all. No cookies are set in the captured headers (Set-Cookie is zero).

Timing Relative to Consent

Google Tag Manager and the fonts load at +399–400 ms; Google Analytics visit registration at +637 ms; Piwik visit registration at +3262 ms. All of this occurs before any choice is made by the user. There is no consent banner on the page that could have preceded any of this. No consent was given during the session, and there is no Consent Mode signal in the Google Analytics request.

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion is drawn from the fact of GTM loading and from the visit-registration hit requests of Google Analytics and Piwik, rather than from cookie headers. Piwik/Matomo is hosted on the academy’s own subdomain, so its data is not transmitted to a third-party recipient; the issue here is the legal basis for recording the visit prior to consent. Google and Monotype may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the location of the nodes. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Hungarian Academy of Sciences launches two analytics systems at once — Google Analytics and self-hosted Piwik/Matomo — on page load, without any consent banner, and both actually register the visitor’s visit; Google Analytics, moreover, transmits data with no Consent Mode signal. Additionally, prior to consent, the visitor’s IP address is transmitted to Google and to a US-based font service. Under Hungarian law, analytics cookies require consent. Launching analytics and registering the visit by default, on every visit, and outside any consent mechanism, together with the transfer of the IP address to third-party recipients in the USA, constitutes a violation of the requirements concerning the legal basis for processing and cross-border transfer. Remedy: implement a consent banner and hold back Google Analytics, Piwik, and the third-party fonts until actual consent is given, or switch Piwik to a fully anonymous statistics mode without identifiers and host the fonts locally.