Boldizsár Szentgáli-Tóth, ELTE Centre for Social Sciences, Institute for Legal Studies, Budapest, Hungary
In June 2025, hundreds of thousands of people marched through Budapest in a Pride parade that the police had banned. Around the route stood large trucks equipped with biometric cameras, a visible reminder that the state had just given itself the power to identify participants by their faces. One year later, the picture looked very different. After Péter Magyar’s Tisza party won the April 2026 election and secured 141 of the 199 seats in parliament, the 2026 Budapest Pride took place with the official acknowledgement of the police.
A change of tone, however, is not the same as a change of law. The legal and technical infrastructure of surveillance built over sixteen years of Fidesz government did not disappear on election night. Facial recognition powers, a nationwide camera network, a long history of spyware abuse and newly revealed commercial location tracking all remain part of the Hungarian state’s toolkit.
This post maps that legacy and measures it against the standards developed by the European Court of Human Rights (ECtHR) and the Court of Justice of the EU (CJEU). It then looks at what the new government has done so far and sets out what a genuine reset would require. Surveillance may seem one step removed from the project’s core theme of online content regulation, but the two are closely linked: the knowledge that one can be identified, tracked or listened to shapes what people are willing to say, share and protest about, online and offline alike.
The most visible element is biometric identification. Hungary has operated a state facial image analysis system for years, but in March 2025 parliament went much further. Together with the ban on Pride events, it amended the law so that police could use automated facial recognition to identify people suspected of any petty offence, including simply attending a banned assembly. As a joint statement by six Hungarian NGOs put it in June 2026, this power was introduced clearly with the aim of deterring people from participating in Budapest Pride and Pécs Pride.
The technical backbone for such identification already exists. The police system known as Szitakötő (“Dragonfly”) is designed to connect around 35,000 CCTV cameras into a single searchable network, and according to reporting by HVG it includes facial recognition capabilities. Official documentation is scarce. A technical specification published on the police website describes Szitakötő as a system that makes public-space cameras from different networks centrally accessible, including licence plate recognition, but there is no public, detailed description of what data it processes, how facial recognition matches are verified, or who oversees its use.
Digital rights organisations have argued that this framework is incompatible with EU law. Writing in EUobserver, Eva Simon (Liberties), Aljosa Ajanovic Andelic (EDRi) and Karolina Iwanska (ECNL) point to Article 5 of the EU AI Act, which prohibits real-time remote biometric identification in publicly accessible spaces for law enforcement, except in narrowly defined serious cases. Identifying people at a peaceful demonstration for a minor offence falls well outside those exceptions. A European Commission spokesperson also stated in 2025 that real-time facial recognition at Pride events would breach the AI Act.
The Convention standard points in the same direction. In Glukhin v. Russia (no. 11519/20, 2023), the ECtHR found that using facial recognition technology to identify and arrest a peaceful protester for a minor administrative offence violated Articles 8 and 10 of the Convention. The Court stressed that such highly intrusive technology requires detailed rules and robust safeguards, and that its use against people exercising their freedom of expression could have a chilling effect. The Hungarian provisions of 2025 fit that fact pattern uncomfortably well.
The second layer is covert hacking. In 2021, the Pegasus Project revealed that Hungarian journalists, lawyers and businesspeople had been targeted with NSO Group’s spyware. A senior Fidesz official later confirmed that the government had bought and used Pegasus, insisting that every operation had been lawful. Investigations by the data protection authority and the prosecution service concluded without finding any wrongdoing, and the Hungarian Civil Liberties Union (HCLU) has spent years litigating on behalf of victims in domestic and European fora.
The core problem was never only the tool. Under Hungarian law, surveillance for national security purposes can be authorised by the Minister of Justice rather than a judge, and the people affected are never notified, even years later. The ECtHR criticised this model as early as 2016 in Szabó and Vissy v. Hungary, and its later Grand Chamber case law, notably Big Brother Watch and Others v. the United Kingdom (2021), has made clear that secret surveillance must be subject to independent authorisation, effective oversight and a meaningful remedy at every stage. Yet the Hungarian system was never fundamentally reformed. As long as a politician can sign off on secret surveillance without independent review, any spyware, old or new, can be used against critics with little risk of exposure.
The third layer is newer and less understood. In April 2026, the Citizen Lab at the University of Toronto published an investigation into Webloc, a surveillance system sold by Cobwebs Technologies and its successor Penlink. Webloc draws on location data harvested from consumer apps and the online advertising ecosystem. According to the report, it covers roughly 500 million mobile devices worldwide, offers up to three years of historical movement data, and allows “dragnet” searches for every device present in a given area.
The report, produced in cooperation with Hungarian investigative journalist Szabolcs Panyi, found that a Hungarian domestic intelligence service had been using Webloc since at least 2022 and was still using it when the report was published. Citizen Lab described this as the first confirmed use of ad based surveillance technology in Europe. The OECD has since logged the case in its AI incidents monitor as a realised harm to privacy and fundamental rights.
This kind of tracking sits in a legal grey zone. No hacking is required and no telecom provider is involved: the data is simply purchased. Existing safeguards for interception or data retention therefore do not apply, and the people being tracked have no way of knowing it.
The case also exposes a weakness at the European level. The location data that powers tools like Webloc is collected through the same advertising technology that EU data protection law was supposed to tame. Apps embed software development kits that share precise location with advertising networks, data brokers aggregate and resell it, and the end buyer may be an intelligence service. Each step in this chain may involve consent banners or legitimate interest claims that would not survive scrutiny, but enforcement against the data broker industry has been slow and fragmented across member states. For a Hungarian citizen, the practical result is that switching off location services on a single app offers little protection if dozens of others continue to feed the market. A credible national response therefore needs two parts: a clear prohibition on state agencies buying bulk personal data that they could not lawfully collect themselves, and active cooperation with other data protection authorities to trace where the data used by Webloc actually came from.
The fourth layer is the traditional backbone of state surveillance: communications metadata, such as who called whom, when and from where. Hungary kept its national data retention regime in place even after the CJEU invalidated the Data Retention Directive in 2014, and the HCLU has challenged it through litigation against service providers. The CJEU has since confirmed, in Tele2 Sverige (2016), La Quadrature du Net (2020) and SpaceNet (2022), that general and indiscriminate retention of traffic and location data for the purpose of fighting crime is incompatible with EU law, and that access to retained data requires prior review by a court or an independent body. Metadata can reveal as much about a person’s life as the content of their communications, yet access to it in Hungary has long been subject to weak and fragmented safeguards.
The new government has taken some important steps, mostly in the field of political freedoms rather than surveillance technology itself.
The clearest signal was the abolition of the Sovereignty Protection Office. The office, created in 2024 and officially tasked with investigating “foreign interference”, in practice targeted civil society organisations and independent media. On 30 June 2026, parliament voted to dissolve it by 135 votes to 44, terminating all of its ongoing proceedings. Press freedom groups welcomed the decision as the removal of a key instrument of intimidation.
The change of atmosphere was also visible on the streets. In June 2026, the police officially acknowledged the Budapest Pride march instead of banning it. This matters, because the previous year’s events showed how surveillance and prosecution work together. Although no petty offence proceedings were brought against the hundreds of thousands of participants in 2025, criminal proceedings were launched against the organisers, including the Mayor of Budapest, although prosecutors dropped the charges against him in June 2026, citing the CJEU ruling discussed below. The deterrent effect of facial recognition does not depend on whether the police actually fine anyone; it lies in the knowledge that they could. This is precisely the chilling effect that the ECtHR identified in Glukhin.
The legal context around LGBTQ+ rights has also shifted. On 21 April 2026, the CJEU ruled in Commission v Hungary (C-769/22) that the 2021 anti-LGBT “child protection” law breaches EU law and the values enshrined in the EU treaties. Human Rights Watch and Hungarian NGOs called on the new government to repeal the law without delay. On 13 October 2026, parliament amended the law by 139 votes to 51, removing its anti-LGBTQI provisions in line with the judgment. As Human Rights Watch noted, however, the reform left untouched the restrictions in the Freedom of Assembly Act that had been used to ban Pride.
On surveillance proper, the government’s autumn legislative programme includes an amendment to the Electronic Communications Act. According to the programme, it aims to set clearer limits and stronger safeguards for law enforcement access to communications metadata. The bill is expected to be submitted in October or November 2026, with adoption targeted for December.
On the legacy of covert surveillance, the signals are so far mostly promises. At his parliamentary hearing in May 2026, Interior Minister Gábor Pósfai pledged investigations at the domestic and foreign intelligence services, including into the Pegasus affair, and stronger powers for the parliamentary national security committee. Yet none of the five parliamentary inquiry committees set up by the new majority deals with surveillance. On Webloc, the data protection authority (NAIH) opened an ex officio investigation in April 2026, but no findings have been published so far.
What has not changed, as of mid-October 2026, is the legal basis for using facial recognition against people suspected of petty offences. The Pride ban provisions and the biometric surveillance framework introduced in 2025 remain on the statute book, as does the ministerial authorisation model for national security surveillance. The scale of the problem is telling: according to figures compiled by the HCLU, the Ministry of Justice approved every one of the 6,129 new national security surveillance requests it received between 2017 and July 2021.
The new government that came to power promising transparency and the restoration of public trust has a rare opportunity here. With a two-thirds majority, it can amend even cardinal laws that previous governments used to entrench the surveillance architecture. Drawing on the case law of the ECtHR and the CJEU, and on proposals developed by Hungarian civil society, I see six priorities.
1. Repeal the 2025 facial recognition amendment and bring biometric identification in line with the AI Act and the Convention. Facial recognition should not be available for petty offences at all, and real-time remote biometric identification in public spaces should be limited to the narrow exceptions allowed by Article 5 of the AI Act, with prior judicial authorisation in every case, as Glukhin requires.
2. Put Szitakötő under public scrutiny. The camera network and its analytical capabilities should be fully documented: how many cameras are connected, which databases are queried, how many searches are run and for what purposes, and how errors are handled. A regular, public statistical report would be a minimum.
3. Introduce independent authorisation and after-the-fact notification for secret surveillance. National security surveillance should require approval by a judge or a genuinely independent body, not a minister. People who were surveilled should, as a rule, be notified once this no longer jeopardises the purpose of the operation. This is what the ECtHR has been asking of Hungary since 2016.
4. Establish the full truth about Pegasus and Webloc. A parliamentary inquiry with access to classified documents should establish who was targeted, on what legal basis and with what results. Poland, a fellow V4 country, set up a dedicated parliamentary committee in January 2024, shortly after its own change of government, to investigate the use of Pegasus. Hungary should do no less, and should also clarify whether and how commercially purchased location data may lawfully be used by state agencies.
5. Make the metadata reform meaningful. The planned amendment of the Electronic Communications Act should go beyond procedural fine-tuning and implement the CJEU’s data retention case law in full. Access to retained data should require prior independent approval, be limited to serious crime, and be documented in annual transparency reports published by both the authorities and the service providers.
6. Make surveillance technology procurement visible. Spyware, location tracking platforms and facial recognition systems are bought from private vendors with public money. Contracts for such technologies should be identifiable in public procurement records, and a public register of algorithmic and biometric systems used by the state, similar to the ones operating in the Netherlands or the United Kingdom, would allow citizens to know what tools are being used on them. Exemptions for national security may be justified in individual cases, but they should be listed and reviewed, not assumed.
It is worth remembering how much of what we know about Hungarian surveillance comes from outside the state. The Pegasus targets were identified by a consortium of journalists and forensic researchers. Webloc was exposed by an investigative reporter working with an academic lab in Canada. The capabilities of Szitakötő are known mainly from press reports. The legal challenges to data retention and ministerial authorisation were brought by NGOs.
This dependency is itself a symptom of the problem. In a functioning democracy, citizens should not have to rely on leaked documents and forensic analysis of their phones to learn how the state watches them. The new government can change this by inviting civil society, academic researchers and independent experts into the reform process: by publishing draft bills well in advance, by giving the data protection authority and the parliamentary national security committee real access to surveillance systems, and by protecting the journalists who have done this work, some of whom were themselves targeted by smear campaigns as recently as spring 2026.
Hungary has often been described as a laboratory of “authoritarian innovation” inside the EU, a place where tools of control are tested and normalised before spreading elsewhere. The reverse can also be true. If a new government can dismantle a surveillance architecture built up over a decade and a half, and replace it with transparent, rights-based rules, that would be a powerful example for the whole region.
The Visegrad countries share more here than geography. Poland is still working through the consequences of its own Pegasus scandal, and our Slovak colleagues have shown on this blog how wide the gap between EU obligations and national implementation can be in the regulation of online content. A recurring finding across the V4 is that EU instruments and the Strasbourg case law set the standards, while the decisive questions of independent oversight, transparency and effective remedies are answered, or left unanswered, at national level.
The timing matters. The AI Act’s prohibitions have applied since February 2025, while the rules for high-risk systems, including many biometric and law enforcement applications, have been postponed to December 2027 under the EU’s digital omnibus deal. National governments therefore carry most of the responsibility for the next year and a half. Hungary’s new majority has the mandate and the legal means to act. Whether it uses them will show if the promise of a more transparent state extends to the parts of the state that prefer to remain unseen.
