oktatas.hu

Context

oktatas.hu is the central portal of Hungary’s education system, operated by the Educational Authority (Oktatási Hivatal, OH). The portal provides access to information on examinations, registers, and educational services; a number of subsystems operate behind authentication. The data controller is OH. The site is served by an nginx server, with HSTS present. Capture: 47 requests, 6 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Prior to consent — only the Usercentrics consent management platform (Germany/EU), which loads to display the banner. There are no third-party trackers or advertising recipients in the capture.

Declared versus Actual

The site’s footer contains “Data Protection” (ADATVÉDELEM) and “Cookie Notice” (SÜTI TÁJÉKOZTATÓ) sections, and consent on the site is governed by the Usercentrics manager. OH’s internal data protection and information security regulations are addressed to the authority’s staff and do not describe web cookies, so the portal’s own cookie notice was used for this review.

The capture shows an implementation that is correctly structured. The only external resource that connects before any choice is made by the visitor is the Usercentrics consent manager itself: it loads its loader and SDK, pulls configuration, and renders the banner. No analytics, advertising, or other third-party services fire prior to consent — the capture contains no Google Analytics, no Google Tag Manager, no Google Fonts, no reCAPTCHA, no Facebook, and no pixels of any kind. Not a single cookie is set during the session (Set-Cookie is zero).

In other words, no discrepancy between “declared” and “actual” arises: non-essential services are held back until consent, and the only outbound call prior to the user’s choice is to the consent mechanism itself. This is precisely the sequencing a prior-consent model calls for.

Timing Relative to Consent

The consent manager loads at +146 ms, first among external resources; no trackers that it would need to hold back appear before it. No consent was given during the session, and in this state no third-party services are connected (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The capture covers the pre-consent state. Analytics or advertising services, if declared in the portal’s cookie notice, should by design launch only after acceptance — and in this capture they indeed do not fire; their behavior after consent cannot be assessed from this snapshot. Usercentrics is a consent management platform (Germany/EU); its own service calls transmit the IP address to Usercentrics, but this is a necessary part of the consent mechanism, and the recipient is located in the EU. Individual OH subsystems and authenticated sections are not covered by this capture. Server-side processing is not visible in a browser-based capture.

Conclusion

The Hungarian education system portal implements consent correctly: prior to any choice by the visitor, only the Usercentrics consent manager loads, and any non-essential services are held back until acceptance. The capture contains no analytics, advertising pixels, Google Fonts, or other third-party trackers; no data is transferred to a third-party recipient in a third country prior to consent, and the sole external contact is the consent mechanism itself, hosted in the EU. The site’s behavior matches a prior-consent model. No violations have been recorded in the capture.