Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Cargo is a hosted website builder used by designers, photographers and creative studios to publish portfolios and editorial sites. Pages are served from Cargo infrastructure (cargo.site, cargocollective.com), with first party functional cookies for the login session and an optional Cargo Insights analytics module. Origin servers are located in the United States, which means EU sites built on Cargo create third country transfers that must be addressed under the GDPR and ePrivacy Directive.
Cargo is a hosted website builder operated by Cargo Publishing, Inc. in Brooklyn. It powers thousands of portfolio and editorial sites for designers, photographers, illustrators and creative studios. Pages are published on cargo.site or on a custom domain pointed at the Cargo infrastructure. The platform handles hosting, image optimisation, CDN delivery and a basic analytics product called Cargo Insights.
Out of the box, Cargo only sets functional first party cookies to keep the editor logged in (cargo_session) and to remember if a password protected page was unlocked. Visitor IP addresses, user agents and request metadata reach the Cargo origin servers and the CDN edges. If the site owner enables Cargo Insights, page views and basic device information are also stored on Cargo servers. Third party tools (Google Analytics, Plausible, Meta Pixel) can be added at the discretion of the site owner.
The base Cargo cookies qualify as strictly necessary and are exempt from consent under Article 5(3) ePrivacy. Cargo Insights and any third party analytics or pixel added by the site owner trigger the consent requirement. The IP processing and routing through US infrastructure constitute personal data processing under Article 4(1) GDPR and require a clear legal basis and transfer safeguards.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
A vanilla Cargo portfolio with no analytics, no embedded video and no third party fonts can in many cases be published without a cookie banner, only with a privacy notice. As soon as the site owner enables Cargo Insights, embeds YouTube, Vimeo, Instagram or Spotify, or pulls Google Fonts dynamically, an opt in cookie banner becomes mandatory.
Cargo Publishing, Inc. is established in the United States. Origin servers are in the US. The CDN exposes content from a global network of edges including in the EU, but the canonical processing location is the US. Cargo signs Standard Contractual Clauses with European customers and relies on the EU/US Data Privacy Framework when applicable.
Sign the Cargo DPA, document the legal basis for each integration, write a clear privacy notice that mentions Cargo as a US based processor, add a cookie banner only if Cargo Insights or third party trackers are active, prefer privacy aware embeds (YouTube nocookie, Vimeo do not track), and review the site after each Cargo template update.
Websites using Cargo must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is generally not required for a standard Cargo portfolio with only the functional cookies. It can become relevant if the site owner activates Cargo Insights, Google Analytics, Meta Pixel or password protected sections that handle special categories of personal data (e.g. health, political opinions in editorial projects).
Sample consent text
This site is built on Cargo. Cargo serves the pages from US infrastructure and uses functional cookies to keep you logged in. We also use [Cargo Insights / Google Analytics] for audience measurement, which sets analytics cookies. We only enable analytics after you click Accept. You can change your choice at any time in the cookie settings.
Third-party domains contacted
cargo.sitecargocollective.comstatic.cargo.sitefreight.cargo.siteCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| cargo_session | session | Session | Strictly necessary functional cookie that maintains the editor login session in the Cargo back office. |
| cargo_password | persistent | 7 days | Stores a token that proves the visitor has unlocked a password protected page on the Cargo site. |
| cargo_insights_id | persistent | 13 months | Optional first party identifier set by Cargo Insights when the site owner enables the platform analytics product. |
Cargo collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Out of the box Cargo sets only functional cookies: cargo_session for the editor login, cargo_password for unlocked password protected pages, and cookies tied to the editor. Cargo Insights, when enabled, sets a small analytics identifier. No advertising cookies are set by Cargo itself.
Not for the strictly necessary functional cookies of a vanilla Cargo portfolio. As soon as Cargo Insights or any third party analytics, video embed or font CDN is active, prior consent under Article 5(3) ePrivacy is required.
Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary functional cookies and the page delivery. Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) for Cargo Insights and any third party tracker added by the site owner.
Yes. Cargo Publishing, Inc. is a US company. Origin servers are in the United States and visitor metadata reaches them. Cargo signs Standard Contractual Clauses with European customers and relies on the EU/US Data Privacy Framework for US sub processors.
Generally no for a portfolio with functional cookies only. A DPIA may be relevant if the site enables Cargo Insights at scale, embeds many third party trackers, password protects sections handling special category data or hosts editorial content with sensitive personal data.
Sign the Cargo DPA, document Cargo as a US sub processor, write a privacy notice that names the company and the transfers, prefer privacy aware embeds (YouTube nocookie, Vimeo do not track, host fonts locally instead of Google Fonts), and add a cookie banner only if you enable analytics or third party trackers.
For privacy first portfolio hosting in Europe, alternatives include Format (Canada), Pixpa (India), Adobe Portfolio (US), Squarespace (US), and self hosted options on Webflow Cloud, Webflow EU regions, Hashnode, Ghost (EU hosting available) and Webflow alternatives like Framer (US) or Editor X. For full EU residency, self hosting on EU based providers (OVH, Scaleway, Hetzner) is the strongest path.
List Cargo Publishing, Inc. as a US based processor with the purpose (website hosting and content delivery), the cookies it sets (cargo_session, cargo_password), the legal basis (legitimate interest for functional cookies, consent for any third party tracker you enable), the transfer destination (United States) and the safeguards (DPF, SCC).