Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Breakdance is a visual website builder plugin for WordPress that runs entirely on your own WordPress installation. The builder itself is first party software: it does not track visitors, run its own analytics or set third party cookies, so the page building tool needs no consent to operate. The privacy nuance lies in the elements you place on a page, because a Breakdance block can embed third party content such as Google Fonts, YouTube videos, maps or forms that load from external servers and carry their own consent and data transfer obligations.
Breakdance is a visual website builder plugin for WordPress. It lets you design pages, headers, footers and full templates through a drag and drop interface that runs inside your own WordPress dashboard. Because it is a self hosted plugin, Breakdance renders the finished pages directly from your server, with no external builder service sitting between your site and the visitor.
The Breakdance builder core does not track visitors, run analytics or set third party cookies of its own. At most it relies on the standard WordPress session and security cookies that any logged in editor needs, and those apply to the administrator rather than the public visitor. The privacy questions arise from the elements you place on a page. A Breakdance block can embed Google Fonts, a YouTube video, an interactive map or an external form, and each of those embeds loads from its provider and can read the visitor IP address and set its own cookies.
Serving a page built with Breakdance from your own hosting does not by itself process personal data beyond what any web server handles. The GDPR and ePrivacy questions attach to the third party content you embed. When a page loads Google Fonts from Google servers, the visitor IP address is disclosed to Google in the United States; the CNIL in France and German courts and data protection authorities have found that this disclosure needs a lawful basis and cannot simply be assumed. A YouTube embed behaves the same way, reading and writing cookies on the visitor device under Article 5(3) of the ePrivacy Directive.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
No consent is needed to run the Breakdance builder or to serve the pages it produces, because that is strictly necessary to deliver the content the visitor asked for. Consent becomes necessary for the non essential third party embeds you add with Breakdance. Before a Google Fonts stylesheet loaded from Google servers, a YouTube video or an external map fires, the visitor should be given a freely given, specific, informed and unambiguous choice, and the embed should stay blocked until they accept.
The Breakdance core keeps data on your own European hosting and transfers nothing to a third country. Transfers appear only through embeds. Google Fonts requested from Google servers and YouTube videos both send the visitor IP address to infrastructure in the United States, which is a transfer that must be covered by the EU Standard Contractual Clauses and a Transfer Impact Assessment under the Schrems II ruling. The cleanest way to avoid this is to self host your fonts so no request ever leaves your server.
Self host Google Fonts through the Breakdance settings or a WordPress plugin so no request reaches Google servers. Gate every remaining third party embed, such as YouTube videos, maps and external forms, behind your consent management platform so they load only after the visitor accepts. List those embeds and any cookies they set in your cookie policy, and prefer privacy friendly variants such as the no cookie YouTube domain where possible. Because the builder core is first party and quiet, these few steps are usually enough to keep pages built with Breakdance compliant.
Websites using Breakdance must obtain user consent under GDPR regulations.
DPIA considerations
A full Data Protection Impact Assessment is rarely needed for the Breakdance builder itself, because the core plugin runs first party and does not profile visitors. Focus your assessment on the third party elements you embed with it. Document any Google Fonts loaded from Google servers, YouTube or map embeds and external forms, the identifiers and IP based data those embeds disclose to their providers, and the resulting transfers to the United States. Where you self host fonts and gate every non essential embed behind consent, the residual risk for the pages built with Breakdance stays low.
Sample consent text
This page was built with Breakdance and may include content loaded from third party services such as Google Fonts, YouTube or maps. These providers can receive your IP address and set cookies on your device, and some may transfer data to the United States. This external content will only load if you click Accept.
Breakdance collects user analytics data — you legally need a consent banner. Try FlowConsent free.
The Breakdance builder core sets no tracking cookies on public visitors. It relies only on the standard WordPress session and security cookies used while an editor is logged in. Any visitor facing cookies come from third party elements you embed, such as a YouTube video or a map, not from Breakdance itself.
No consent is needed for the builder itself, because serving a page from your own WordPress installation is strictly necessary and falls within the ePrivacy exemption. Consent is only required for the non essential third party embeds you place with Breakdance, such as Google Fonts loaded from Google servers or YouTube videos.
The builder core needs no separate legal basis, as it is strictly necessary to deliver the requested page under the Article 5(3) ePrivacy exemption. For third party embeds, the basis is consent under Article 6(1)(a) GDPR combined with the prior consent requirement of Article 5(3) of the ePrivacy Directive. Legitimate interest does not cover those non essential embeds.
The builder core transfers nothing, because it runs first party on your own hosting. Transfers arise only from embeds. Google Fonts requested from Google servers and YouTube videos send the visitor IP address to the United States, so self host your fonts and gate other embeds behind consent to avoid unmanaged transfers.
A Data Protection Impact Assessment is rarely required for the Breakdance builder itself, because it does not profile visitors. Assess instead the third party embeds you add, the identifiers and IP data they disclose and any resulting United States transfers. Self hosting fonts and gating embeds keeps the residual risk low.
Self host Google Fonts so no request reaches Google servers, gate every remaining third party embed behind your consent management platform, and document those embeds in your cookie policy. Prefer privacy friendly options such as the no cookie YouTube domain, and keep the builder core, which sets no tracking cookies, as your default.
Alternatives include Elementor, Bricks, Oxygen, Beaver Builder and the native WordPress block editor. Like Breakdance they run first party on your own hosting, so the main privacy questions come from the third party elements you embed rather than the builder, whichever one you choose.
You do not need a Breakdance entry for the builder itself, because it sets no visitor tracking cookies. Instead list each third party embed you add with it, such as Google Fonts, YouTube or maps, the cookies those providers set, their lifetimes and any United States transfer, and keep that list aligned with your consent categories.
