Web analytics, cookies, tag managers, CMPs, ad pixels, and session-replay tools as deployed on websites and apps targeting Hungary. Sectoral rules (healthcare, banking, employment) are touched only where they intersect with the analytics layer.
Applicable laws
The legal framework that governs personal data processing here.
National addons
Country-specific statutes layered on the EU baseline.
- § 2 Scope — extends GDPR rules to processing outside EU law (national security, law enforcement) where Union law does not apply
- § 25 DPO designation — mirrors GDPR Art 37 with no lower headcount threshold
- § 38 NAIH powers — investigation, audit, administrative fines up to 20M HUF or GDPR ceilings, whichever higher
- § 60 Administrative procedure — NAIH official inquiry process (hatósági eljárás) and binding decisions
- § 155(4) Storage/read access on terminal equipment requires prior, informed consent — analytics, marketing, A/B testing all require opt-in
- § 155(5) Strictly-necessary exception — narrowly construed; user-explicit-request communications + technical session continuity only
- § 156 Traffic and location data — separate consent regime for value-added services
- § 6(1) Direct marketing communications — prior express consent required, must be specific, voluntary, and informed
- § 6(2) Consent record-keeping — controller must be able to prove consent at any time; double-opt-in is the de facto standard
- § 6(5) Opt-out at every contact — every marketing message must offer free, simple unsubscribe
Regulators
Supervisory authorities that interpret and enforce privacy law here.
Coordination body
- 2022-02-10 · Google Analytics — NAIH alignment with Austrian DSB / French CNIL post-Schrems II — GA Universal flagged as problematic; GA4 acceptable post-DPF subject to consent + TIA documentation.
- 2024-03 · Biometric attendance systems — NAIH issued multiple decisions against employer biometric attendance systems (fingerprint, facial recognition) — disproportionate under Art 9 + Hungarian Labour Code.
- 2024-11 · AI systems and Clearview-style scraping — NAIH active on AI/biometric processing — fines and warnings for facial-recognition databases assembled from public-web scraping; aligned with Italian Garante and Greek DPA on Clearview-related cases.
Notable enforcement
NAIH is moderately active by EU standards — not as headline-grabbing as Italian Garante or Spanish AEPD, but consistent on its enforcement priorities: AI/biometric processing, employer monitoring, and unencrypted personal-data exposures. Fines tend to fall in the 1M–100M HUF range (≈€2.5K–€250K) with occasional higher penalties. The 2024–2025 enforcement wave on biometric attendance systems and Clearview-style facial-recognition databases marks NAIH's active stance on AI-era data protection. Controllers should prioritize Hungarian-language privacy notices and documented consent records — both are recurring deficiency findings.
-
Bank (anonymized) NAIH · Art 6, 22 stood
Use of AI-driven voice-emotion analysis on customer-service calls without lawful basis or transparency — ~250M HUF fine. Landmark NAIH AI-systems case.
-
Digi Kft. NAIH · Art 5, 32 stood
Major Hungarian ISP — unencrypted customer database exposed via test server; ~100M HUF fine for security failures and excessive retention. NAIH's largest pre-2024 fine.
-
Fintech (anonymized) NAIH · Art 32, 33 stood
Insufficient breach notification + access-control failures at Hungarian fintech; ~55M HUF.
-
Retail chain (CCTV) NAIH · Art 5, 6, 13 stood
Excessive CCTV retention + missing Hungarian-language signage — ~35M HUF; Hungarian-language transparency cited as recurring deficiency.
GA4 status
GA4 is usable in Hungary with prior, explicit, granular consent under Eht. § 155 + GDPR Art 6/7. After EU-US DPF (10 Jul 2023), transfers to Google's US servers are lawful in principle while Google LLC remains DPF-certified. NAIH posture is moderate — aligned with EDPB Schrems II coordinated action but not a leading enforcer on this dimension. Hungarian-language privacy notice required.
| DPA | Stance |
|---|---|
| NAIH | Moderate — aligned with EDPB. Post-DPF acceptable; expects consent + Hungarian-language disclosure + TIA documentation for non-DPF transfers. No proactive cookie-banner sweeps as of 2026. |
Cross-border transfers + Schrems II
NAIH posture on transfers is moderate — it followed the EDPB Schrems II coordinated action in 2022 but did not lead. Post-DPF (10 Jul 2023) NAIH accepts adequacy for DPF-certified US importers. For non-DPF transfers, NAIH expects EU 2021/914 SCCs + a documented Transfer Impact Assessment, but enforcement is reactive rather than proactive on this dimension.
EU 2021/914 SCCs are the standard fallback when DPF certification is absent. NAIH has not published a Hungarian-specific TIA template — controllers rely on EDPB Recommendations 01/2020 and joint EU DPA guidance.
Employee data
Key thresholds
Vendor signals
Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.
Analytics tools · 4 · 0 green · 3 yellow · 1 red
| Vendor | Status | Rationale |
|---|---|---|
| YELLOW | Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation. | |
| YELLOW | EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain. | |
| YELLOW | EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green. | |
| RED | Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization. |
Consent management platforms · 5 · 5 green · 0 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate. | |
| GREEN | Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan. | |
| GREEN | Open-source, self-hosted. No managed updates — site owner maintains vendor list. | |
| GREEN | GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults. | |
| GREEN | German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites. |
Ad pixels · 3 · 0 green · 0 yellow · 3 red
| Vendor | Status | Rationale |
|---|---|---|
| RED | Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set. | |
| RED | Schrems II concerns persist; advanced matching hashes PII but does not fix EU→US transfer problem. | |
| RED | PRC-parent ownership flagged by Italian Garante and EDPB; transfers to China contested. Consent + risk acknowledgement required. |
Server-side · 3 · 2 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic. | |
| GREEN | EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings. | |
| YELLOW | "EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing. |
Compare with neighbors
Side-by-side rule comparison.
Common questions
Is Google Analytics legal in Hungary in 2026?
Which DPA is competent in Hungary?
What is NAIH most active on?
What's the difference between Infotörvény and GDPR?
What is the child consent age in Hungary?
What language must my privacy notice be in?
Can I use biometric attendance systems for employees?
Do I need an Article 27 representative for Hungary?
Is double-opt-in required for email marketing in Hungary?
Does Schrems II still affect transfers post-DPF?
// EDITORIAL · NOT LEGAL ADVICE This page summarises Hungary's privacy framework as of 2026-05-05. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.