nmhh.hu

Context

nmhh.hu is the website of the National Media and Infocommunications Authority of Hungary (Nemzeti Média- és Hírközlési Hatóság, NMHH), the country’s media and electronic communications regulator. The data controller is NMHH. The site is served by an Apache/2.4.58 server (Ubuntu). Capture: 76 requests, 7 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address and Referer header via Google Fonts, hosted jQuery, and the GTM/Google Analytics container. Infogram (a Prezi subsidiary) — the visitor’s IP address via the embed loader.

Declared versus Actual

NMHH has a functioning consent framework: a banner with “accept all,” “reject,” and “details and settings” buttons, and a separate cookie policy, “Tájékoztató a sütikről.” The policy names Google Analytics directly, explaining that GA cookies are used by default with IP masking and are classified within the base layer, with non-anonymized statistics enabled only upon explicit consent. Hotjar is additionally mentioned — temporarily, from 19.07.2024, for user-experience research.

The capture confirms the presence of Google Analytics and clarifies its behavior: the GTM container (gtag.js) loads at +300 ms, and at +1569 and +6571 ms GA4 sends page_view and scroll events to the regional (EU) endpoint region1.google-analytics.com across two streams at once (G-D5LQSMBZTF and G-9TVCG3TVNV), carrying a client identifier and device/browser metadata. All of this occurs before any interaction with the consent banner (Set-Cookie across the session is zero). That is, the analytics tool is declared, but it is dispatched without prior consent — a separate, legally contestable point under the Hungarian implementation of ePrivacy.

The main discrepancy, however, lies elsewhere than Analytics. The capture reveals three third-party recipients that the policy does not name at all. At +296 ms, Google Fonts connects (CSS from fonts.googleapis.com, followed by Inter and Arsenal font files from fonts.gstatic.com at +832–926 ms). Almost simultaneously, at +297 ms, jQuery 1.12.4 loads from Google Hosted Libraries (ajax.googleapis.com). Both loads transmit the visitor’s IP address and the Referer header https://nmhh.hu/ to Google (USA). At +900 ms, the Infogram embed loader connects (e.infogram.com), transmitting the visitor’s IP address to Infogram, a Prezi subsidiary. Neither Google Fonts, hosted jQuery, nor Infogram is mentioned in the cookie policy, even though the policy names its recipients specifically (Google Analytics, Hotjar).

Timing Relative to Consent

All external calls occur at +296–926 ms, and the Analytics calls at +1569–6580 ms, all before any action by the visitor. The site has a consent banner, but it holds back neither the loading of fonts and libraries nor the initialization of GA4 — these calls occur outside the consent mechanism. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

GA4, by its operating configuration, applies IP anonymization and, in this capture, communicates with the EU regional endpoint (region1), with the npa=1 parameter indicating a non-personalized mode; for Google Analytics, therefore, the issue is not non-disclosure (it is declared) but dispatch prior to consent. The GA client identifier is intentionally not reproduced in this card. Google may use edge nodes within the EU, so for Google Fonts and hosted jQuery, the conclusion drawn concerns the recipient’s corporate affiliation (a US company), not the physical location of the node. Infogram is a Prezi subsidiary: the corporate group is managed from the USA (San Francisco/Oakland), while development has historically been based in Latvia (EU); the conclusion drawn concerns the recipient’s corporate affiliation, not the specific jurisdiction of processing. Hotjar, declared in the policy, is not observed in this capture (it is temporary and may have expired) — no conclusion about it can be drawn from this snapshot. The capture covers the home page in its pre-consent state; server-side processing is not visible in a browser-based capture.

Conclusion

The website of Hungary’s media and infocommunications regulator is carefully built: it has a consent banner and a cookie policy, and Google Analytics is declared within it, with IP masking stated. Nevertheless, prior to any consent, the site transmits the visitor’s IP address and Referer header to several third-party recipients not named in the policy: to Google, via Google Fonts and hosted jQuery, and to Infogram (Prezi), via the embed loader. In parallel, Google Analytics sends page_view and scroll events before any interaction with the banner. For a national regulator, the transfer of the IP address to undisclosed third-party recipients by default, on every visit, and outside any consent mechanism, constitutes a violation of the requirements concerning disclosure of recipients and cross-border transfer. The remedy lies largely within the authority’s own control: host the fonts and JavaScript libraries locally on the site’s own domain, and enable the Infogram embed and the initialization of Analytics only after consent is given — this would eliminate all external calls prior to the visitor’s choice.