mtva.hu

Context

mtva.hu is the website of the Media Support and Asset Management Fund (Médiaszolgáltatás-támogató és Vagyonkezelő Alap, MTVA), the state body that funds and supports content production for Hungarian public broadcasting. The data controller is MTVA. Capture: 163 requests, 17 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — Ad Manager (GPT), Tag Manager, the Google+ platform, Fonts. Meta/Facebook (USA) — SDK and share buttons. atmedia, Publisher1st — prebid advertising wrappers.

Declared versus Actual

Here the discrepancy is especially stark. MTVA’s official policy (in its legal and privacy notice section) states directly: personal data is not transferred to third parties, except in legally required cases — contractual obligations, judicial, prosecutorial, supervisory, and other lawful procedures. The policy says nothing about advertising monetization or advertising partners.

The capture reveals the opposite. The site runs a full-scale advertising machine, and does so before the consent management platform even appears. At +498–500 ms, prebid wrappers from the Hungarian advertising networks atmedia (cdn.atmedia.hu) and Publisher1st (cdn.publisher1st.com) connect. At +604 ms, the Google Ad Manager advertising tag starts (securepubads.g.doubleclick.net/tag/js/gpt.js), and at +608 ms, the Facebook SDK (connect.facebook.net). Only at +645 ms does the InMobi consent management platform itself load (cmp.inmobi.com/choice), built on the IAB TCF standard. That is, the Google advertising tag, the Facebook SDK, and prebid execute before the visitor even sees the consent banner.

Subsequently, at +2160 ms, Google Tag Manager loads, and at +2190–2615 ms, Facebook social share buttons (www.facebook.com/plugins/share_button.php, static.xx.fbcdn.net). Additionally, at +226 ms, the Google+ platform (apis.google.com) and Google Fonts connect. No cookies are set in the captured headers (Set-Cookie is zero), but the absence of cookies does not negate the transfer of the IP address to advertising and social recipients that has already taken place. Thus, the policy’s statement that data is not transferred to third parties directly contradicts the site’s actual advertising monetization.

Timing Relative to Consent

Prebid fires at +498 ms, Google Ad Manager at +604 ms, the Facebook SDK at +608 ms, the InMobi banner at +645 ms, and GTM plus the share buttons at +2160–2615 ms. Advertising and social modules precede the consent banner. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the home page in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion is drawn from the fact of script loading (GPT, the Facebook SDK, prebid, GTM), rather than from cookie headers. Behavior following a click on “accept” or “reject” in the InMobi banner is not observed in this session. Google and Meta may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Hungary’s public media fund is equipped with an InMobi consent management platform, but advertising and social modules do not wait for it: Google Ad Manager, the Facebook SDK, and prebid wrappers start before the banner, transmitting the visitor’s IP address to advertising recipients in the USA and to advertising networks. It is particularly significant that MTVA’s official policy states directly the opposite — that personal data is not transferred to third parties. The discrepancy between what is declared and what actually occurs here is fundamental: the policy denies any data transfer, while the site runs full-scale advertising monetization prior to consent. For a state body responsible for public broadcasting, this constitutes a violation of the requirements concerning the legal basis for processing, disclosure of recipients, and cross-border transfer. Remedy: link advertising and social tags to the consent management platform and hold them back until actual consent is given, and bring the policy into line with the actual set of data recipients.