ogyei.gov.hu

Context

ogyei.gov.hu is the website of the National Institute of Pharmacy and Nutrition of Hungary (Országos Gyógyszerészeti és Élelmezés-egészségügyi Intézet, OGYÉI), the specialized authority for medicinal products and nutrition, now part of the National Center for Public Health and Pharmacy (NNGYK). The data controller is OGYÉI/NNGYK. The site is served by an Apache server, with HSTS present. Capture: 33 requests, 9 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via Google Fonts, reCAPTCHA, and Google Tag Manager. jsDelivr (operated by Prospect One, EU) and the jQuery CDN — the visitor’s IP address via the loading of libraries.

Declared versus Actual

OGYÉI has both a banner and a separate cookie policy, but both are weak. The banner is built on a “consent by continued browsing” model: it states that by continuing to browse and clicking the single “accept” button, the visitor consents to cookies, including for marketing purposes. There is no equally prominent rejection button. Such a consent model is invalid under the GDPR: there is no free, unambiguous choice, and cookies and external resources fire before any action is taken.

The cookie policy names Google Analytics as a third-party service — meaning analytics is formally disclosed. The policy itself, however, is in poor condition: it lists deprecated Universal Analytics cookies (__utma, __utmb, __utmc, __utmt, __utmz), whereas the site actually runs GA4 (the gtag.js container, stream G-VSYV8EV4LC), and it contains a template fragment with the unrelated domains webfolio.hu and fotofolio.hu — a clear copy-paste artifact from someone else’s template, unrelated to the authority.

The capture shows that a whole set of third-party resources connects to the visitor prior to consent. At +110–114 ms, Google Fonts loads (CSS, followed by Roboto and Material Icons files at +190–192 ms), along with Bootstrap and Alpine.js from jsDelivr, jQuery 1.12.4 and jQuery UI 1.12.1 from code.jquery.com, the Google Tag Manager container (gtag.js), and Google reCAPTCHA (api.js from www.google.com, the runtime from www.gstatic.com). All of these calls transmit the visitor’s IP address to third-party recipients. Of these, the policy names only Google Analytics; Google Fonts, reCAPTCHA, jsDelivr, and the jQuery CDN are not mentioned at all. reCAPTCHA is particularly notable here: it is not a passive font but a Google service that profiles behavior, and it is preloaded prior to consent.

Timing Relative to Consent

All external calls occur at +110–192 ms, before any action by the visitor. A consent banner is present, but it does not hold back these loads and is itself invalid as a consent mechanism. No valid consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The gtag.js container is loaded (which alone has already sent a call and the IP address to Google), but there are no actual analytics /g/collect calls within the capture window — no conclusion about the actual transmission of GA4 events can be drawn from this snapshot. Google may use edge nodes within the EU; for Fonts, reCAPTCHA, and GTM, the conclusion drawn therefore concerns the recipient’s corporate affiliation (Google, USA), not the physical location of the node. jsDelivr is operated by Prospect One (EU, Poland) and is served through several CDN providers; the jQuery CDN is likewise served through third-party infrastructure — the conclusion drawn concerns the recipient operator, not a specific node. The call to nngyk.gov.hu is the loading of a logo from a related government domain, not a third-party tracker. reCAPTCHA is present in the form of api.js; no visible form to which it is attached is observed in the home-page capture — the library is preloaded. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Hungary’s medicinal products regulator transmits the visitor’s IP address to several third-party recipients prior to any valid consent: to Google, via Google Fonts, reCAPTCHA, and Google Tag Manager, and to the jsDelivr and jQuery CDNs, via the loading of libraries. The site has a consent banner, but it is invalid: a single “accept” button, consent “by continued browsing,” and the mention of marketing purposes do not constitute a free and unambiguous choice. The cookie policy names only Google Analytics, and even then describes it with deprecated cookies and contains unrelated domains from a copied template; Google Fonts, reCAPTCHA, jsDelivr, and the jQuery CDN are not disclosed. For a specialized medical regulator, the transfer of the IP address to undisclosed third-party recipients by default, on every visit, and outside any valid consent mechanism, constitutes a violation of the requirements concerning disclosure of recipients and cross-border transfer. The remedy is largely within the authority’s own control: host the fonts and JavaScript libraries locally, enable reCAPTCHA and analytics only after valid consent with an equally prominent rejection button, and bring the cookie policy into line with the GA4 actually in use, removing the unrelated domains.