parlament.hu

Context

parlament.hu is the website of the National Assembly of Hungary (Országgyűlés), the country’s unicameral parliament. The data controller is the Office of the National Assembly (Országgyűlés Hivatala). The site is served with HSTS (includeSubDomains). Capture: 143 requests, 4 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address and viewing data via Google Analytics, in two versions (GA4 and the deprecated Universal Analytics). There are no other third-party recipients in the capture.

Declared versus Actual

Parliament’s cookie policy names Google Analytics directly as a third-party service — moreover, it lists its extended functions: remarketing, Google Display Network reports, and demographic and interest reports. That is, analytics is disclosed, and disclosed in detail. As the legal basis, the policy cites not consent but legitimate interest (GDPR Art. 6(1)(f)), for which a balancing test has been carried out; separately, the policy acknowledges in general terms that external providers may process data in countries not recognized as safe third countries.

The capture shows that analytics fires prior to any consent, and in two versions at once. At +414 ms, the GA4 container connects (gtag, stream G-K44KGQW81R); at +1815 ms, the classic Universal Analytics library (analytics.js). Both then actually send calls: at +3908 ms, a hit from the deprecated Universal Analytics (UA-50664080-1) goes to www.google-analytics.com/j/collect, and at +4020 ms, a GA4 page_view event goes to region1.google-analytics.com. This is not merely script loading: data has already been sent to Google (USA). Not a single cookie is set during the session (Set-Cookie is zero).

The discrepancy here lies not in disclosure but in two other things. First, the legal basis: the policy relies on legitimate interest, whereas under the ePrivacy rules, analytics cookies generally require prior consent — meaning that launching analytics before any choice by the visitor is problematic. Second, the configuration is outdated: alongside GA4, Universal Analytics — a version Google has discontinued — continues to run and send hits.

Timing Relative to Consent

Analytics fires at +414–4020 ms, with hits actually sent, all before any action by the visitor. There is no mechanism holding back analytics until consent — the policy relies on legitimate interest instead. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The GA calls were actually sent (HTTP 200 and 204 status codes), meaning the data has left; the client identifiers carried in these calls are intentionally not reproduced in this card. The identifier UA-50664080-1 belongs to Universal Analytics, processing for which Google has discontinued; the hit is nevertheless still sent, but the capture cannot establish whether it is processed on Google’s side — the fact of IP address transmission did, however, occur. GA4 communicates with an EU regional endpoint (region1), but Google is a US company. Google may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation, not the location of the node. The question of whether legitimate interest is an acceptable basis for analytics is a legal one; this card records the discrepancy itself (analytics prior to consent) rather than rendering a legal verdict. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of Hungary’s parliament transmits visitor data to Google Analytics, in two versions at once — the deprecated Universal Analytics and GA4 — prior to any consent, transferring the IP address to Google (USA) on every visit. Analytics is disclosed in the cookie policy, including its advertising-related functions, but it relies on legitimate interest, whereas analytics cookies generally require prior consent under the ePrivacy rules; as a result, analytics launches before the visitor makes a choice. Additionally, the configuration is outdated: alongside GA4, the discontinued Universal Analytics continues to run. Launching analytics and transferring data to a third-party recipient in the USA prior to consent constitutes a violation of the requirements concerning the proper sequencing of consent and cross-border transfer. The remedy is within the operator’s control: launch Google Analytics only after explicit consent via a fully functioning consent mechanism, disable the deprecated Universal Analytics identifier, and retain a single, current counter.