Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Website builder available as a desktop app and cloud service whose generated sites may load Google Fonts and analytics, with the editor account hosted in the US and Ukraine.
Nicepage is a website builder available both as a desktop application and as a cloud based online editor. It lets users design and publish websites visually, exporting to formats such as HTML, WordPress and other platforms. The editor account and the online builder are cloud hosted, with infrastructure linked to the United States and Ukraine. Importantly, the compliance profile of a Nicepage project depends less on the builder and more on what the published site ends up loading for its visitors.
Generated Nicepage sites can load Google Fonts, Google Analytics and Google Tag Manager, which set analytics and sometimes advertising cookies and can contact Google servers on every page view. When the site owner enters a Google Analytics identifier, the analytics cookies track visitor behaviour, and loading fonts from Google can expose visitor IP addresses to Google. Nicepage also offers a cookie popup and the option to self host fonts, which lets a site run with no non essential cookies at all. The builder account itself processes the user account data of the person designing the site.
Under Art. 5(3) of the ePrivacy Directive, any analytics or advertising cookie set by a generated site requires prior consent. Loading Google Fonts directly from Google servers has been treated by some European courts as a transfer of the visitor IP address that needs a lawful basis, which is why self hosting fonts is the safer pattern. Processing of visitor data through analytics rests on consent under Art. 6(1) GDPR, with the site owner acting as controller. The builder vendor acts as a processor for the account data, so a data processing agreement applies there.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
If your published site uses Google Analytics, Tag Manager or any advertising tag, you must obtain consent before those scripts run and before their cookies are set. The Nicepage cookie popup should be configured to block non essential scripts until the visitor agrees, not merely to display a notice. Consent must be specific, informed and as easy to withdraw as to give. A site that self hosts fonts and uses no analytics can avoid the need for cookie consent entirely.
The Nicepage editor account and online builder are cloud hosted with infrastructure linked to the United States and Ukraine, both third countries under the GDPR, so account data may be processed outside the EEA under Standard Contractual Clauses. On the public site, loading Google Fonts, Google Analytics or Tag Manager can transfer visitor data to Google in the United States, covered by the EU to US Data Privacy Framework. Self hosting fonts and disabling analytics removes these transfers and keeps visitor data within your own hosting. A transfer impact assessment should document any remaining flows.
Decide early whether your site really needs analytics, and if not, self host fonts and skip Google scripts to keep the site cookieless. If you do use analytics, enable the Nicepage cookie popup in a mode that blocks scripts until consent is given, and document the legal basis. Review the third party domains your published site contacts and record the Data Privacy Framework or Standard Contractual Clauses for any US transfer. Finally, sign a data processing agreement with Nicepage for the builder account and update your privacy and cookie policies to match what the live site actually loads.
Websites using Nicepage must obtain user consent under GDPR regulations.
DPIA considerations
The privacy risk of Nicepage depends mostly on what each generated site embeds rather than on the builder itself. A data protection impact assessment is worth considering when a site loads Google Analytics, Google Tag Manager or advertising tags that profile visitors, or when forms collect personal data sent to third parties. The assessment should record the cookies set on the live site, the third party domains contacted, whether Google Fonts are self hosted, and the transfer mechanism for any data sent outside the EEA. Sites that self host fonts and disable analytics carry a much lower risk.
Sample consent text
This site uses cookies and may load resources such as fonts and analytics from third parties, including Google, which can transfer data to the United States. By selecting Accept you consent to these cookies and to this loading of third party resources.
Third-party domains contacted
nicepage.comfonts.googleapis.comfonts.gstatic.comwww.google-analytics.comwww.googletagmanager.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _ga | third party | 2 years | Set by Google Analytics when enabled on a generated site to distinguish individual visitors |
| _ga_<id> | third party | 2 years | Set by Google Analytics 4 to persist session state for the configured measurement identifier |
| _gid | third party | 24 hours | Set by Google Analytics to distinguish visitors over a single day when analytics is enabled |
| np_cookie_consent | first party | up to 1 year | Stores the visitor cookie consent choice made through the Nicepage cookie popup |
Nicepage collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Nicepage itself does not force tracking cookies, but generated sites set cookies based on what the owner enables. If you add Google Analytics, cookies such as _ga and _gid are set, and Google Tag Manager or advertising tags can add more. A static Nicepage site with self hosted fonts and no analytics can run with no non essential cookies at all.
It depends on the published site. If the site loads Google Analytics, Tag Manager, advertising tags or fonts from Google servers, consent is required under Art. 5(3) ePrivacy before those run. A site that self hosts fonts and uses no analytics generally needs no cookie consent, although a privacy notice is still good practice.
Analytics and advertising cookies on a generated site rely on consent under Art. 6(1)(a) GDPR with Art. 5(3) ePrivacy. The account data in the builder is processed by Nicepage as a processor under an Art. 28 agreement, while the site owner is the controller for visitor data. Loading Google Fonts from Google also needs a lawful basis for the IP transfer it involves.
It can. The editor account and online builder use infrastructure linked to the United States and Ukraine, so account data may go outside the EEA under Standard Contractual Clauses. On the live site, Google Fonts, Analytics and Tag Manager can transfer visitor data to Google in the United States under the Data Privacy Framework. Self hosting fonts and dropping analytics removes these transfers.
It depends on the site content. A data protection impact assessment is worth doing when the site profiles visitors with analytics or advertising, or when forms collect personal data sent to third parties. For a simple brochure site with self hosted fonts and no tracking, a full assessment is usually not required. Document the cookies, third party domains and any transfers as part of the review.
Self host Google Fonts and avoid analytics if you do not need them, which keeps the site cookieless. If you do use analytics, enable the Nicepage cookie popup in a mode that blocks scripts until consent is given. Sign a data processing agreement with Nicepage for the builder account, review the third party domains your site contacts and align your privacy and cookie policies with the live site.
EU friendly website builders include tools that self host fonts by default or offer EU hosting, and open source options such as WordPress with privacy plugins give you full control over what loads. Other builders like Webflow, Wix or Squarespace exist but bring their own US transfer considerations. The key factor is whether the builder lets you avoid third party tracking and self host fonts.
List only the cookies your live site actually sets, which depends on whether you enabled analytics or advertising tags. If you load Google Fonts, Analytics or Tag Manager, note the possible transfer of data to Google in the United States under the Data Privacy Framework. If you self host fonts and use no analytics, you can state that the site sets no non essential cookies and keep the policy short.