vedelem.hu

Context

vedelem.hu is the website of “Védelem Online,” a professional news portal covering fire safety and civil (disaster) protection, publisher of Védelem Katasztrófavédelmi Szemle (ISSN 2064-1559). The data controller is the editorial team of “Védelem Online.” Hosting is provided by the National Radio Emergency Call and Infocommunications Association (Rádiós Segélyhívó és Infokommunikációs Országos Egyesület); subscriptions are handled by HBU Kft., and billing by Billingo. The site is served by an Apache server; HSTS is set to max-age=0, meaning it is effectively disabled. Capture: 54 requests, 5 domains, recorded in a clean browser.

Direct Recipients of Data (prior to consent)

Meta/Facebook (USA) — the visitor’s IP address via the Facebook SDK. Google (USA) — the visitor’s IP address via Google Analytics (GA4, a page_view event). Cloudflare (USA) — the visitor’s IP address via the delivery of Font Awesome from maxcdn.bootstrapcdn.com.

Declared versus Actual

The portal’s privacy notice describes data processing in reasonable detail: it names cookies, states directly that statistical analysis is carried out via Google Analytics, and lists three processors — the association providing hosting and cookie storage, HBU Kft. for subscriptions, and Billingo for billing. The policy states that data processing occurs with the user’s consent, and that the visitor’s attention is drawn to the use of cookies via a pop-up window at the bottom of the page.

The capture confirms Google Analytics, but reveals what the policy is silent about. At +519 ms, before any action by the visitor, the Facebook SDK loads (sdk.js, followed by a bundle at +629 ms) — the loader for Facebook social plugins and the pixel, which transmits the visitor’s IP address to Meta (USA). At +303 ms, Font Awesome connects from maxcdn.bootstrapcdn.com, served via Cloudflare (USA). Google Analytics itself fires at +868 ms, sending a page_view event to region1.google-analytics.com. All of these calls occur prior to consent. Facebook and Cloudflare, meanwhile, are not named in the policy at all, even though the policy names other recipients specifically and declares consent-based processing.

The central problem here is the Facebook SDK. This is neither a passive font nor declared statistics: it is a Meta advertising/social tracker present on the site, operating prior to consent, and undisclosed in the policy. Combined with Google Analytics, this means the portal runs both statistical and advertising/social tracking simultaneously, while disclosing only the former.

Timing Relative to Consent

All external calls occur at +303–868 ms, before any action by the visitor. The policy provides for a cookie notice on the site, but it does not hold back the loading of the Facebook SDK, Google Analytics, or Font Awesome — these calls occur outside the consent mechanism. No consent was given during the session (Set-Cookie is zero).

What Cannot Be Asserted from This Capture

The Facebook SDK is loaded, and this alone has already transmitted the visitor’s IP address to Meta; however, there is no separate conversion call to facebook.com/tr within the capture window — no conclusion about the actual transmission of conversion events can be drawn from this snapshot, though the fact of IP address transmission upon SDK loading did occur. The Facebook SDK and Google Analytics set their own cookies (_fbp, _ga) via JavaScript rather than the Set-Cookie header, so their absence from Set-Cookie does not mean such cookies are absent. GA4 communicates with an EU regional endpoint (region1). Google, Meta, and Cloudflare may use edge nodes within the EU; the conclusion drawn therefore concerns the recipients’ corporate affiliation (US companies), not the physical location of the nodes. Server-side processing is not visible in a browser-based capture.

Conclusion

The “Védelem Online” civil protection professional portal, prior to any consent, transmits the visitor’s IP address to three third-party recipients in the USA: to Meta, via the Facebook SDK; to Google, via Google Analytics; and to Cloudflare, via Font Awesome. The portal’s own policy names only Google Analytics and its subscription processors, mentioning neither Facebook/Meta nor Cloudflare as recipients — despite stating directly that data processing is consent-based. The presence of an undeclared Facebook SDK, operating prior to consent, is the central finding: the portal runs advertising/social tracking that the policy does not disclose. The transfer of the visitor’s IP address to undisclosed third-party recipients in the USA by default, on every visit, and outside any consent mechanism, constitutes a violation of the requirements concerning disclosure of recipients and cross-border transfer. The remedy is within the editorial team’s control: remove the Facebook SDK or load it only after consent, host Font Awesome locally, load Google Analytics only after consent as well, and bring the policy into line by adding Facebook/Meta as a recipient if the social module is retained.