police.hu

Context

police.hu is the website of the Police of Hungary (Rendőrség). The operator is the National Police Headquarters (Országos Rendőr-főkapitányság, ORFK). The site is built on Drupal 8 (nginx), with strong HSTS (preload) present. Capture: 151 requests, 6 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Google (USA) — the visitor’s IP address via Google Analytics and reCAPTCHA. Cloudflare (USA) — the visitor’s IP address via the delivery of the jquery-mousewheel library from cdnjs.

Declared versus Actual

Here the discrepancy is especially stark, because the policy makes categorical and verifiable claims. The police’s privacy notice states directly that the site does not use cookies — only a session ID, containing no personal data and deleted upon logout. Technical data (the time the visit began, the IP address, browser and OS type), according to the policy’s text, is collected exclusively for traffic statistics and is not linked to other data. In a separate clause, the policy states that personal data is not transferred to third parties, except in cases mandated by law. Neither Google, Google Analytics, reCAPTCHA, nor Cloudflare is named in the policy.

The capture reveals a different picture. Prior to any consent, the site contacts several third-party recipients. At +232 ms, Google reCAPTCHA connects (api.js from www.google.com, the runtime from www.gstatic.com at +382 ms). At +343 ms, the jquery-mousewheel library loads from cdnjs.cloudflare.com. At +379 ms, the classic Universal Analytics connects (analytics.js), and at +601 ms its hit, carrying the identifier UA-41385412-1, is actually sent to www.google-analytics.com/j/collect; next, at +640 ms, GA4 loads (gtag.js, G-1B1E2T7ZMX). All of these calls transmit the visitor’s IP address to third-party recipients in the USA — Google and Cloudflare.

Thus, two categorical claims made by the policy turn out to be false at once. The claim that the site “does not use cookies” does not square with the presence of Google Analytics and reCAPTCHA, which employ their own storage mechanisms. And the claim that data is not transferred to third parties is directly disproven by the transfer of the IP address to Google and Cloudflare on every visit. Moreover, the very statistics for which the policy collects technical data are, in fact, gathered via Google Analytics — a US third-party service not mentioned in the policy.

Timing Relative to Consent

All external calls occur at +232–640 ms, with the analytics hit actually sent, all before any action by the visitor. The policy cites consent implemented via continued use of the site as the basis — but the transfer of the IP address to third-party recipients occurs unconditionally and in advance. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

Google Analytics and reCAPTCHA set their own cookies via JavaScript, which is not reflected in the zero Set-Cookie count at the HTTP header level; nevertheless, this disproves the policy’s literal statement that no cookies are used. The identifier UA-41385412-1 belongs to the deprecated Universal Analytics; the hit is sent, but whether it is processed on Google’s side cannot be established from the capture — the fact of IP address transmission did, however, occur. reCAPTCHA on a site with forms can be regarded as a protective measure; this negates neither the transfer of the IP address to Google nor the fact that it is not disclosed in the policy. Google and Cloudflare may use edge nodes within the EU; the conclusion drawn therefore concerns the recipient’s corporate affiliation (US companies), not the location of the node. Server-side processing is not visible in a browser-based capture.

Conclusion

The website of the Police of Hungary, prior to any consent, transmits the visitor’s IP address to several third-party recipients in the USA: to Google, via Google Analytics (in two versions) and reCAPTCHA, and to Cloudflare, via a library from cdnjs. Meanwhile, the authority’s own policy states directly that the site does not use cookies and does not transfer data to third parties — the capture disproves both statements, and none of the actual recipients is named in the policy. For a national law-enforcement authority, the transfer of the IP address to undisclosed third-party recipients in the USA by default, on every visit, and contrary to the direct statements of its own policy, constitutes a violation of the requirements concerning disclosure of recipients, cross-border transfer, and the proper sequencing of consent. The remedy is within the operator’s control: host statistics on a self-managed solution (such as local Matomo) instead of Google Analytics, host the library locally, load reCAPTCHA only on pages containing forms and after consent, disable the deprecated Universal Analytics identifier, and bring the policy into line with reality.