CMS

Cargo

Cargo is a hosted website builder used by designers, photographers and creative studios to publish portfolios and editorial sites. Pages are served from Cargo infrastructure (cargo.site, cargocollective.com), with first party functional cookies for the login session and an optional Cargo Insights analytics module. Origin servers are located in the United States, which means EU sites built on Cargo create third country transfers that must be addressed under the GDPR and ePrivacy Directive.

Block Cargo until consent Scan my site

Overview

What does Cargo do?

What Cargo is

Cargo is a hosted website builder operated by Cargo Publishing, Inc. in Brooklyn. It powers thousands of portfolio and editorial sites for designers, photographers, illustrators and creative studios. Pages are published on cargo.site or on a custom domain pointed at the Cargo infrastructure. The platform handles hosting, image optimisation, CDN delivery and a basic analytics product called Cargo Insights.

What data Cargo handles

Out of the box, Cargo only sets functional first party cookies to keep the editor logged in (cargo_session) and to remember if a password protected page was unlocked. Visitor IP addresses, user agents and request metadata reach the Cargo origin servers and the CDN edges. If the site owner enables Cargo Insights, page views and basic device information are also stored on Cargo servers. Third party tools (Google Analytics, Plausible, Meta Pixel) can be added at the discretion of the site owner.

GDPR and ePrivacy implications

The base Cargo cookies qualify as strictly necessary and are exempt from consent under Article 5(3) ePrivacy. Cargo Insights and any third party analytics or pixel added by the site owner trigger the consent requirement. The IP processing and routing through US infrastructure constitute personal data processing under Article 4(1) GDPR and require a clear legal basis and transfer safeguards.

Consent and configuration

A vanilla Cargo portfolio with no analytics, no embedded video and no third party fonts can in many cases be published without a cookie banner, only with a privacy notice. As soon as the site owner enables Cargo Insights, embeds YouTube, Vimeo, Instagram or Spotify, or pulls Google Fonts dynamically, an opt in cookie banner becomes mandatory.

International data transfers

Cargo Publishing, Inc. is established in the United States. Origin servers are in the US. The CDN exposes content from a global network of edges including in the EU, but the canonical processing location is the US. Cargo signs Standard Contractual Clauses with European customers and relies on the EU/US Data Privacy Framework when applicable.

Practical compliance steps

Sign the Cargo DPA, document the legal basis for each integration, write a clear privacy notice that mentions Cargo as a US based processor, add a cookie banner only if Cargo Insights or third party trackers are active, prefer privacy aware embeds (YouTube nocookie, Vimeo do not track), and review the site after each Cargo template update.

Compliance

Cargo and the GDPR

Cargo is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary functional cookies used to deliver the published site and the editor session. Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy Directive) is required for any analytics or marketing integration the site owner activates on top of Cargo (Cargo Insights, Google Analytics, Meta Pixel) and for the password protection cookie when used outside an authentication context.
Risk level: medium
Applicable regulations: GDPR, ePrivacy Directive, French CNIL guidelines, German TTDSG, Spanish LSSI, Italian Garante guidelines, UK PECR, US state privacy laws via the Cargo platform DPA

Impact assessment (DPIA)

A DPIA is generally not required for a standard Cargo portfolio with only the functional cookies. It can become relevant if the site owner activates Cargo Insights, Google Analytics, Meta Pixel or password protected sections that handle special categories of personal data (e.g. health, political opinions in editorial projects).

Sample text for your banner

This site is built on Cargo. Cargo serves the pages from US infrastructure and uses functional cookies to keep you logged in. We also use [Cargo Insights / Google Analytics] for audience measurement, which sets analytics cookies. We only enable analytics after you click Accept. You can change your choice at any time in the cookie settings.

Cookies and trackers

What Cargo sets and contacts

Tracking method: Hosted website builder (cargo.site / cargocollective.com) used to publish portfolios. Pages are served from Cargo infrastructure with first party functional cookies (login session, editor state) and an optional analytics integration (Cargo Insights, Google Analytics, Plausible) controlled by the site owner. No advertising profiling at the platform level.
Server location: Cargo Publishing, Inc. is headquartered in Brooklyn, New York. Production hosting uses CDN edges including Cloudflare globally. Origin servers are in the United States.
Data transferred outside the EU: Pages are served from US origin servers and a global CDN. Visitor IP addresses, user agents and request metadata are processed in the United States. Transfers rely on Cargo Standard Contractual Clauses with EU customers and DPF certification of US sub processors. EU only data residency is not offered.

Cookies set (3)

Name	Type	Duration	Purpose
cargo_session	session	Session	Strictly necessary functional cookie that maintains the editor login session in the Cargo back office.
cargo_password	persistent	7 days	Stores a token that proves the visitor has unlocked a password protected page on the Cargo site.
cargo_insights_id	persistent	13 months	Optional first party identifier set by Cargo Insights when the site owner enables the platform analytics product.

Third-party domains contacted (4)

cargo.site
cargocollective.com
static.cargo.site
freight.cargo.site

Questions

Frequently asked questions about Cargo

Can't find your question? Write to us, we answer fast.

Write to us

What cookies does Cargo set?

Out of the box Cargo sets only functional cookies: cargo_session for the editor login, cargo_password for unlocked password protected pages, and cookies tied to the editor. Cargo Insights, when enabled, sets a small analytics identifier. No advertising cookies are set by Cargo itself.

Do I need consent to publish a Cargo site?

Not for the strictly necessary functional cookies of a vanilla Cargo portfolio. As soon as Cargo Insights or any third party analytics, video embed or font CDN is active, prior consent under Article 5(3) ePrivacy is required.

What is the legal basis for Cargo?

Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary functional cookies and the page delivery. Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) for Cargo Insights and any third party tracker added by the site owner.

Does Cargo transfer data to the US?

Yes. Cargo Publishing, Inc. is a US company. Origin servers are in the United States and visitor metadata reaches them. Cargo signs Standard Contractual Clauses with European customers and relies on the EU/US Data Privacy Framework for US sub processors.

Do I need a DPIA for a Cargo site?

Generally no for a portfolio with functional cookies only. A DPIA may be relevant if the site enables Cargo Insights at scale, embeds many third party trackers, password protects sections handling special category data or hosts editorial content with sensitive personal data.

How do I implement Cargo compliantly?

Sign the Cargo DPA, document Cargo as a US sub processor, write a privacy notice that names the company and the transfers, prefer privacy aware embeds (YouTube nocookie, Vimeo do not track, host fonts locally instead of Google Fonts), and add a cookie banner only if you enable analytics or third party trackers.

What are the alternatives to Cargo?

For privacy first portfolio hosting in Europe, alternatives include Format (Canada), Pixpa (India), Adobe Portfolio (US), Squarespace (US), and self hosted options on Webflow Cloud, Webflow EU regions, Hashnode, Ghost (EU hosting available) and Webflow alternatives like Framer (US) or Editor X. For full EU residency, self hosting on EU based providers (OVH, Scaleway, Hetzner) is the strongest path.

How do I update the cookie policy for Cargo?

List Cargo Publishing, Inc. as a US based processor with the purpose (website hosting and content delivery), the cookies it sets (cargo_session, cargo_password), the legal basis (legitimate interest for functional cookies, consent for any third party tracker you enable), the transfer destination (United States) and the safeguards (DPF, SCC).

CoffeeCup

CoffeeCup is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. CoffeeCup offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, CoffeeCup empowers organizations to optimize strategy and maximize return on investment.

CMS

Octopress

Octopress is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Octopress supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Octopress ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

Jalios

Jalios is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Jalios supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Jalios ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

AboutMyClinic

AboutMyClinic is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. AboutMyClinic supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, AboutMyClinic ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

SiteOrigin Widgets Bundle

SiteOrigin Widgets Bundle is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SiteOrigin Widgets Bundle offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SiteOrigin Widgets Bundle empowers organizations to optimize strategy and maximize return on investment.

CMS

Pimcore

Pimcore is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Pimcore supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Pimcore ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my banner Scan my site