RU EN
www.
Technical audit · 29.05.2026

ogyei.gov.hu

National Institute of Pharmacy and Nutrition of Hungary
HU

The National Institute of Pharmacy and Nutrition of Hungary (OGYÉI, now part of NNGYK) — 33 requests, 9 domains. A specialized drug regulator. A consent banner is present but invalid (only 'accept,' consent 'by continued browsing,' marketing mentioned). Prior to any consent, the visitor's IP address is transmitted to Google via Google Fonts, reCAPTCHA, and Google Tag Manager, as well as to jsDelivr and the jQuery CDN. Only Google Analytics is named in the policy — and even that is described with deprecated cookies and unrelated domains copied into the template; the other recipients are not named.

Request timeline

+0 ms · portal load
Markup, scripts, and images — served from the first-party domain ogyei.gov.hu (Apache, HSTS present).
+110…+114 ms · Google, CDNs, and GTM prior to consent
Google Fonts CSS (fonts.googleapis.com ×3), Bootstrap 5.2.3 and Alpine.js from jsDelivr (cdn.jsdelivr.net), jQuery 1.12.4 and jQuery UI 1.12.1 (code.jquery.com), the gtag.js / Google Tag Manager container (googletagmanager.com, stream G-VSYV8EV4LC), and Google reCAPTCHA (www.google.com/recaptcha/api.js). The visitor's IP address is transmitted to Google (USA), jsDelivr, and the jQuery CDN. Also at this point: a logo loaded from the related government domain nngyk.gov.hu.
+185…+192 ms · reCAPTCHA and fonts prior to consent
The reCAPTCHA runtime from www.gstatic.com and Roboto/Material Icons font files from fonts.gstatic.com. The visitor's IP address is transmitted to Google (USA).
the consent banner is invalid and does not hold back the resources
A banner is present, but with a single 'Elfogadom' button and consent 'by continued browsing,' mentioning marketing purposes. External calls occur before and independently of any interaction with it; the consent mechanism does not block them.
session state — no valid consent
Set-Cookie across the entire session is zero. No valid choice has been made by the user; the transfer of the IP address to third-party recipients has already taken place.
the GA library is loaded, no beacon recorded
gtag.js (G-VSYV8EV4LC) is loaded, but there are no /g/collect calls within the capture window. Advertising pixels and session recording are also absent from the capture.

Declared versus actual

✓ Consent banner — a single 'Elfogadom' (accept) button, consent 'by continued browsing,' mentioning marketing purposes — declared
✓ Cookie Policy (Süti tájékoztató) — the site's own session cookie, PHPSESSID, + Google Analytics as a third-party service — declared
✓ GA is described in the policy via deprecated Universal Analytics cookies (__utma, __utmb, __utmc, __utmt, __utmz), whereas the site actually runs GA4 (gtag) — declared
✓ The policy contains a template fragment with unrelated domains (webfolio.hu, fotofolio.hu) — a copy-paste artifact unrelated to OGYÉI — declared
+ Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — third-party recipient of IP address from the USA, prior to consent, not named in the policy — not declared
+ Google reCAPTCHA (www.google.com, www.gstatic.com) — third-party recipient of IP address from the USA, prior to consent, not named in the policy — not declared
+ jsDelivr (cdn.jsdelivr.net) — third-party recipient of IP address, prior to consent, not named in the policy — not declared
+ jQuery CDN (code.jquery.com) — third-party recipient of IP address, prior to consent, not named in the policy — not declared

Transfer timings

+110 ms fonts.googleapis.com

Google Fonts CSS (Roboto, Material Icons). Google, USA.

+111 ms cdn.jsdelivr.net

Bootstrap 5.2.3, Alpine.js. Operated by Prospect One, EU.

+113 ms code.jquery.com

jQuery 1.12.4, jQuery UI 1.12.1. jQuery CDN.

+113 ms www.googletagmanager.com

gtag.js — the GTM container, stream G-VSYV8EV4LC. Google, USA.

+114 ms www.google.com

reCAPTCHA api.js. Google, USA.

+185 ms www.gstatic.com

reCAPTCHA runtime. Google, USA.

+190 ms fonts.gstatic.com

Google font files (×3). Google, USA.

Detected trackers

Indicators of GDPR non-compliance

Context

ogyei.gov.hu is the website of the National Institute of Pharmacy and Nutrition of Hungary (Országos Gyógyszerészeti és Élelmezés-egészségügyi Intézet, OGYÉI), the specialized authority for medicinal products and nutrition, now part of the National Center for Public Health and Pharmacy (NNGYK). The data controller is OGYÉI/NNGYK. The site is served by an Apache server, with HSTS present. Capture: 33 requests, 9 domains, recorded in a clean browser.

Google (USA) — the visitor’s IP address via Google Fonts, reCAPTCHA, and Google Tag Manager. jsDelivr (operated by Prospect One, EU) and the jQuery CDN — the visitor’s IP address via the loading of libraries.

Declared versus Actual

OGYÉI has both a banner and a separate cookie policy, but both are weak. The banner is built on a “consent by continued browsing” model: it states that by continuing to browse and clicking the single “accept” button, the visitor consents to cookies, including for marketing purposes. There is no equally prominent rejection button. Such a consent model is invalid under the GDPR: there is no free, unambiguous choice, and cookies and external resources fire before any action is taken.

The cookie policy names Google Analytics as a third-party service — meaning analytics is formally disclosed. The policy itself, however, is in poor condition: it lists deprecated Universal Analytics cookies (__utma, __utmb, __utmc, __utmt, __utmz), whereas the site actually runs GA4 (the gtag.js container, stream G-VSYV8EV4LC), and it contains a template fragment with the unrelated domains webfolio.hu and fotofolio.hu — a clear copy-paste artifact from someone else’s template, unrelated to the authority.

The capture shows that a whole set of third-party resources connects to the visitor prior to consent. At +110–114 ms, Google Fonts loads (CSS, followed by Roboto and Material Icons files at +190–192 ms), along with Bootstrap and Alpine.js from jsDelivr, jQuery 1.12.4 and jQuery UI 1.12.1 from code.jquery.com, the Google Tag Manager container (gtag.js), and Google reCAPTCHA (api.js from www.google.com, the runtime from www.gstatic.com). All of these calls transmit the visitor’s IP address to third-party recipients. Of these, the policy names only Google Analytics; Google Fonts, reCAPTCHA, jsDelivr, and the jQuery CDN are not mentioned at all. reCAPTCHA is particularly notable here: it is not a passive font but a Google service that profiles behavior, and it is preloaded prior to consent.

All external calls occur at +110–192 ms, before any action by the visitor. A consent banner is present, but it does not hold back these loads and is itself invalid as a consent mechanism. No valid consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The gtag.js container is loaded (which alone has already sent a call and the IP address to Google), but there are no actual analytics /g/collect calls within the capture window — no conclusion about the actual transmission of GA4 events can be drawn from this snapshot. Google may use edge nodes within the EU; for Fonts, reCAPTCHA, and GTM, the conclusion drawn therefore concerns the recipient’s corporate affiliation (Google, USA), not the physical location of the node. jsDelivr is operated by Prospect One (EU, Poland) and is served through several CDN providers; the jQuery CDN is likewise served through third-party infrastructure — the conclusion drawn concerns the recipient operator, not a specific node. The call to nngyk.gov.hu is the loading of a logo from a related government domain, not a third-party tracker. reCAPTCHA is present in the form of api.js; no visible form to which it is attached is observed in the home-page capture — the library is preloaded. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Hungary’s medicinal products regulator transmits the visitor’s IP address to several third-party recipients prior to any valid consent: to Google, via Google Fonts, reCAPTCHA, and Google Tag Manager, and to the jsDelivr and jQuery CDNs, via the loading of libraries. The site has a consent banner, but it is invalid: a single “accept” button, consent “by continued browsing,” and the mention of marketing purposes do not constitute a free and unambiguous choice. The cookie policy names only Google Analytics, and even then describes it with deprecated cookies and contains unrelated domains from a copied template; Google Fonts, reCAPTCHA, jsDelivr, and the jQuery CDN are not disclosed. For a specialized medical regulator, the transfer of the IP address to undisclosed third-party recipients by default, on every visit, and outside any valid consent mechanism, indicates non-compliance with the requirements concerning disclosure of recipients and cross-border transfer. The remedy is largely within the authority’s own control: host the fonts and JavaScript libraries locally, enable reCAPTCHA and analytics only after valid consent with an equally prominent rejection button, and bring the cookie policy into line with the GA4 actually in use, removing the unrelated domains.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: hu/ogyei-gov-hu-2026-05-29.har
SHA-256: 181ac66b51bcfc3fe32d6105b19e66438cd83e0f11903217f9af58bb4982d115
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — ogyei.gov.hu

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website ogyei.gov.hu.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:

1) On page load, prior to any consent, Google Fonts loads (fonts.googleapis.com ×3 at +110 ms, Roboto and Material Icons files from fonts.gstatic.com at +190–192 ms), as does Google reCAPTCHA (www.google.com/recaptcha/api.js at +114 ms and the runtime from www.gstatic.com at +185 ms), the Google Tag Manager / gtag.js container (stream G-VSYV8EV4LC at +113 ms), libraries from jsDelivr (Bootstrap 5.2.3, Alpine.js — cdn.jsdelivr.net at +111–114 ms), and jQuery 1.12.4 with jQuery UI 1.12.1 (code.jquery.com at +113 ms). All of these transmit the visitor's IP address to third-party recipients — to Google (USA) via Fonts, reCAPTCHA, and GTM, and to jsDelivr and the jQuery CDN. OGYÉI's cookie policy names only Google Analytics; it does not name Google Fonts, reCAPTCHA, jsDelivr, or the jQuery CDN as recipients.

2) The site's banner is built on a 'consent by continued browsing' model: a single 'Elfogadom' (accept) button, with no equally prominent rejection option, and the text itself declares consent by the fact of continued browsing, mentioning marketing purposes among others. All external resources (Google Fonts, reCAPTCHA, GTM, jsDelivr, jQuery) fire at +110–192 ms, before any interaction with the banner. Set-Cookie across the entire session is zero; no valid consent has been obtained, yet the transfer of the IP address to third-party recipients has already taken place.


2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/hu-ogyei-gov-hu/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Hungarian National Authority for Data Protection (NAIH) — file a complaint online →

The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)

Subject: Complaint regarding personal data processing — ogyei.gov.hu

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ogyei.gov.hu.

2. Circumstances
I visited the website ogyei.gov.hu and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) On page load, prior to any consent, Google Fonts loads (fonts.googleapis.com ×3 at +110 ms, Roboto and Material Icons files from fonts.gstatic.com at +190–192 ms), as does Google reCAPTCHA (www.google.com/recaptcha/api.js at +114 ms and the runtime from www.gstatic.com at +185 ms), the Google Tag Manager / gtag.js container (stream G-VSYV8EV4LC at +113 ms), libraries from jsDelivr (Bootstrap 5.2.3, Alpine.js — cdn.jsdelivr.net at +111–114 ms), and jQuery 1.12.4 with jQuery UI 1.12.1 (code.jquery.com at +113 ms). All of these transmit the visitor's IP address to third-party recipients — to Google (USA) via Fonts, reCAPTCHA, and GTM, and to jsDelivr and the jQuery CDN. OGYÉI's cookie policy names only Google Analytics; it does not name Google Fonts, reCAPTCHA, jsDelivr, or the jQuery CDN as recipients.

2) The site's banner is built on a 'consent by continued browsing' model: a single 'Elfogadom' (accept) button, with no equally prominent rejection option, and the text itself declares consent by the fact of continued browsing, mentioning marketing purposes among others. All external resources (Google Fonts, reCAPTCHA, GTM, jsDelivr, jQuery) fire at +110–192 ms, before any interaction with the banner. Set-Cookie across the entire session is zero; no valid consent has been obtained, yet the transfer of the IP address to third-party recipients has already taken place.

Full technical documentation is published at: https://gdpru.eu/en/audits/hu-ogyei-gov-hu/

3. GDPR provisions I ask you to examine
GDPR Art. 13(1)(e) + Chapter V — disclosure of recipients and cross-border transfer; ePrivacy (Hungarian implementation) — invalid consent and third-party resources prior to consent

4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]