RU EN
www.
Technical audit · 2026-05-29

nkfih.gov.hu

National Research, Development and Innovation Office of Hungary
HU

The National Research, Development and Innovation Office of Hungary (NKFIH) — 96 requests, 6 domains. There is no consent banner on the page: Google Analytics and Google Tag Manager fire on load and register the visit before any choice is made, transmitting the IP address to Google (USA). Additionally, Google Fonts and the GSAP library from Cloudflare load prior to consent. The cookie policy does not name Google Analytics specifically.

Timeline of the leak

+0 ms · portal load
Markup, stylesheets, scripts, and images — served from the first-party domain nkfih.gov.hu (Apache). Some fonts are local.
+1763 ms · GSAP library prior to consent
cdnjs.cloudflare.com — TweenMax (GSAP 1.18.2), served via Cloudflare. The visitor's IP address is transmitted to a third-party recipient.
+1795 ms · Google Fonts and GTM prior to consent
fonts.googleapis.com (CSS, the Raleway font) and www.googletagmanager.com/gtag/js (identifier G-FZW8NQ1RVQ). The visitor's IP address is transmitted to Google (USA).
no consent banner present
There is no consent management platform or consent banner in the capture. Analytics fires unconditionally.
+2968 ms · visit registration without consent
region1.google-analytics.com/g/collect — a GA4 hit request that actually registers the visit (carrying the page URL). There is no Consent Mode signal (gcs) in the request. Set-Cookie across the session is zero; no choice has been made by the user.
no other trackers
Facebook, advertising pixels, and cookie-sync are absent from the capture. External calls are limited to Google (Analytics, GTM, Fonts) and Cloudflare cdnjs.

Declared versus actual

✓ NKFIH's Cookie Policy — session and persistent cookies for site functionality and statistical purposes — declared
✓ Declared: servers automatically log the IP address, OS/browser type, URLs of pages visited, and the time of the visit — declared
+ Google Analytics (GA4 G-FZW8NQ1RVQ) and Google Tag Manager — not named specifically, fire and register the visit prior to consent — not declared
+ Google Fonts and Cloudflare cdnjs — third-party recipients of IP address from the USA, prior to consent, not disclosed — not declared
+ No consent banner is present; the Google Analytics request carries no Consent Mode signal (gcs) — not declared

Transfer timings

+1763 ms cdnjs.cloudflare.com

GSAP/TweenMax. Served via Cloudflare, USA.

+1829 ms www.googletagmanager.com

Google Tag Manager (G-FZW8NQ1RVQ). Google, USA.

+2968 ms region1.google-analytics.com

GA4 g/collect carrying the page URL. No Consent Mode signal (gcs) present.

Detected trackers

Indicators of GDPR non-compliance

Context

nkfih.gov.hu is the website of the National Research, Development and Innovation Office of Hungary (Nemzeti Kutatási, Fejlesztési és Innovációs Hivatal, NKFI Hivatal), the state body responsible for funding science, research, and innovation and for allocating related grants. The data controller is the NKFI Hivatal. The site is served by an Apache server. Capture: 96 requests, 6 domains, recorded in a clean browser (a section page for grant applicants).

Google (USA) — the visitor’s IP address via Google Analytics, Google Tag Manager, and Google Fonts. Cloudflare (USA) — the visitor’s IP address via the GSAP library from cdnjs.

Declared versus Actual

NKFIH’s cookie policy describes the cookies in use in general terms: session cookies to prevent data loss, and persistent cookies to recognize a returning visitor — and states that cookies are used to ensure the site functions, improve the user experience, and for statistical purposes. The policy also notes that the servers automatically log the IP address, operating system and browser type, the URLs of pages visited, and the time of the visit. However, neither Google Analytics nor Google Tag Manager is named specifically, and the transfer of data to a third-party recipient in the USA via analytics is not disclosed.

The capture shows that analytics fires prior to any consent and without a banner. At +1829 ms, Google Tag Manager connects (identifier G-FZW8NQ1RVQ), and at +2968 ms, Google Analytics 4 sends a visit-registration hit request (region1.google-analytics.com/g/collect) carrying the page address. The request carries no Consent Mode signal (the gcs parameter): consent is not collected, and this is not signaled to Google. No consent management platform or consent banner is present on the page at all.

Additionally, external resources load prior to consent: at +1763 ms, the GSAP animation library (TweenMax) from Cloudflare cdnjs, and at +1795 ms, Google Fonts (the Raleway font) from fonts.googleapis.com and fonts.gstatic.com. All of these calls transmit the visitor’s IP address to third-party recipients in the USA. No cookies are set in the captured headers (Set-Cookie is zero).

Thus, the statistical processing that the policy mentions only in general terms is, in practice, implemented via Google Analytics with data transferred to the USA, and the service itself is not named in the policy and activates without consent.

The GSAP library loads at +1763 ms, Google Fonts and GTM at +1795–1829 ms, and GA4 visit registration at +2968 ms. All of this occurs before any choice is made by the user. There is no consent banner on the page that could have preceded any of this. No consent was given during the session, and there is no Consent Mode signal in the Google Analytics request.

What Cannot Be Asserted from This Capture

The capture covers a grant-applicant section of the site in its pre-consent state. Set-Cookie is absent from the captured headers; the conclusion is drawn from the fact of GTM loading and from the Google Analytics visit-registration hit request, rather than from cookie headers. Google and Cloudflare may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the location of the nodes. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Hungary’s National Research, Development and Innovation Office launches Google Analytics and Google Tag Manager immediately on page load, without any consent banner, and actually registers the visitor’s visit — with the Google Analytics request lacking a Consent Mode signal. Additionally, prior to consent, the visitor’s IP address is transmitted to Google and to Cloudflare via fonts and an animation library. The authority’s cookie policy mentions statistical purposes only in general terms and names neither Google Analytics nor the transfer of data to the USA. Launching analytics and registering the visit by default, on every visit, and outside any consent mechanism, together with the transfer of the IP address to third-party recipients in the USA, constitutes a violation of the requirements concerning the legal basis for processing, disclosure of recipients, and cross-border transfer. Remedy: implement a consent banner and hold back Google Analytics and Google Tag Manager until actual consent is given, or switch to privacy-preserving self-hosted analytics, and host fonts and libraries locally.

Evidence
Original (audit)
HAR file: hu/nkfih-gov-hu-2026-05-29.har
SHA-256: cce32e1f9f2e4202e2143f5ac495428de6b38271e26ffaab0044cb123a85de36
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

To: Hungarian National Authority for Data Protection (NAIH)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website nkfih.gov.hu.

2. Circumstances
I visited the website nkfih.gov.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) On page load, without any consent banner whatsoever, Google Tag Manager fires (at +1829 ms), after which Google Analytics 4 (identifier G-FZW8NQ1RVQ) sends a visit-registration hit request to region1.google-analytics.com/g/collect (at +2968 ms) carrying the page URL. The request carries no Consent Mode signal (gcs), meaning consent is neither collected nor signaled. No consent management platform or consent banner is present in the capture. NKFIH's cookie policy describes cookies only for site functionality and statistics, but does not name Google Analytics specifically.

2) Prior to consent, the visitor's IP address is transmitted to Google (Analytics, Tag Manager, Fonts) and to Cloudflare cdnjs (the GSAP library), both US companies. These third-party recipients are not disclosed in the policy, and the transfer of data outside the EEA via analytics is not described.

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-nkfih-gov-hu/

3. Provisions violated
GDPR Art. 6 + ePrivacy (Hungarian implementation) — analytics prior to consent, with no banner; GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and cross-border transfer

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]