> Danneo CMS is a Russian self hosted PHP CMS. Which cookies it sets, when GDPR consent is required, where data is stored and what your cookie policy needs.
>
> Canonical: https://www.flowconsent.com/en/services/cms/danneo-cms

CMS

# Danneo CMS

Unclassified · [Official website](https://danneo.ru/)

Russian open source PHP content management system. Self hosted on the operator infrastructure. Sets a PHP session cookie (PHPSESSID) and an admin authentication cookie. No third party telemetry by default.

[Block Danneo CMS until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [CMS](https://www.flowconsent.com/en/services/cms)

- Consent

  Unclassified

- Prior consent

  Not required

- Documented cookies

  3

- Third-party domains

  2

- Servers

  Self hosted (server location depends on the operator)

Overview

## What does Danneo CMS do?

## **What is Danneo CMS**

Danneo CMS is a Russian open source content management system written in PHP and distributed under a free licence. It targets small to mid size editorial sites, corporate websites and community portals. The platform is self hosted, which means the operator chooses the server, the database and the location of all data. Out of the box it ships with a public site, an admin back office and a modular extension system.

## **What data and cookies Danneo CMS collects**

By default Danneo CMS sets a PHP session cookie (PHPSESSID) on every request, an authentication cookie for users who log in to the admin or member area, and a CSRF token cookie that protects form submissions. The web server records standard access logs with IP address, user agent and timestamp. No analytics, advertising or social network telemetry is loaded unless the operator installs a dedicated module.

## **GDPR and ePrivacy implications**

The PHP session cookie, the authentication cookie and the CSRF cookie fall under the strictly necessary exemption of Article 5(3) ePrivacy Directive and can be set without consent. The processing of account data is covered by Article 6(1)(b) GDPR when it serves the contract between the operator and the user, or by Article 6(1)(f) GDPR for the legitimate interest in operating the site. Any additional plugin (web analytics, advertising, social embed) requires its own legal basis and, for non essential cookies, consent.

## **Consent requirements and user controls**

A vanilla Danneo CMS installation does not need a consent banner because it only sets strictly necessary cookies. As soon as the operator adds analytics (Yandex Metrica, Google Analytics, Matomo) or social widgets (VK, Telegram, YouTube), a banner becomes mandatory under the ePrivacy Directive and the national implementations. The banner must let the user refuse as easily as accept and provide a way to withdraw consent.

## **Data transfers and hosting**

Danneo CMS does not perform any default data transfer. Where the application is installed determines the storage location. If the operator hosts the instance in Russia, the Russian Federal Law 152 FZ applies and requires the data of Russian citizens to be stored on servers located in Russia. If the operator hosts the instance outside the EEA, transfers from EU visitors require an appropriate safeguard under Chapter V GDPR (Data Privacy Framework for the US, standard contractual clauses elsewhere) and a transfer impact assessment.

## **Practical compliance steps**

Document Danneo CMS and the chosen host in your records of processing, secure the admin back office with TLS and strong authentication, configure log rotation and a reasonable retention period for IP and access logs, audit installed modules to confirm whether they introduce non essential cookies and, if so, gate them behind a CMP. Publish a clear privacy notice that lists the modules in use and explains how to exercise data subject rights.

Compliance

## Danneo CMS and the GDPR

- Legal basis

  Legitimate interest (Article 6(1)(f) GDPR) and the strictly necessary exemption of Article 5(3) ePrivacy Directive for the session cookie. Consent (Article 6(1)(a) GDPR) is needed only if the operator adds non essential modules (analytics, advertising, social widgets).

- Risk level

  low

- Applicable regulations

  GDPR, ePrivacy Directive (Cookie Law), national implementations such as the French Data Protection Act, the German TDDDG and the Russian Federal Law 152 FZ when operating in Russia.

### Impact assessment (DPIA)

A DPIA is generally not required for a Danneo CMS website that serves a brochure or a small editorial site, but becomes relevant when the CMS hosts user accounts at scale, processes sensitive content (health, political views, religion) or runs commerce or community modules that handle a high volume of personal data. Document the categories of data stored in the database, the retention of access logs and the security measures protecting the admin interface.

### Sample text for your banner

> We use Danneo CMS to operate this website. It sets a session cookie that is strictly necessary to navigate the site and an authentication cookie if you log in to a member area. These cookies do not require consent. Any additional analytics or advertising modules will be loaded only after you accept them in the cookie banner.

Cookies and trackers

## What Danneo CMS sets and contacts

- Tracking method

  Server side PHP session and authentication cookies

- Server location

  Self hosted (server location depends on the operator)

### Cookies set (3)

| Name         | Type                     | Duration | Purpose                                                                                                 |
| ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------------------------------- |
| PHPSESSID    | first party session      | Session  | PHP session cookie that identifies the visitor session in Danneo CMS. Strictly necessary.               |
| danneo\_auth | first party (admin only) | 7 days   | Authentication cookie set when an admin or member logs in to the Danneo CMS back office or member area. |
| danneo\_csrf | first party security     | Session  | CSRF token cookie protecting form submissions against cross site request forgery in Danneo CMS.         |

### Third-party domains contacted (2)

- `danneo.com`
- `danneo.ru`

Questions

## Frequently asked questions about Danneo CMS

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### Which cookies does Danneo CMS set?

Out of the box Danneo CMS sets a PHP session cookie (PHPSESSID) for navigation, an authentication cookie when a user logs in to the admin or member area, and a CSRF token cookie that protects form submissions. All three are first party and strictly necessary. Additional cookies appear only when the operator installs an analytics or social module.

### Is user consent required to load Danneo CMS?

For a vanilla installation no consent is needed because only strictly necessary cookies are set. Consent under Article 5(3) ePrivacy Directive becomes mandatory as soon as the operator adds analytics, advertising or social widgets, since these introduce non essential cookies and processing.

### What is the legal basis for processing?

Legitimate interest (Article 6(1)(f) GDPR) and the strictly necessary exemption of Article 5(3) ePrivacy Directive for the session and CSRF cookies. Performance of a contract (Article 6(1)(b)) for member accounts. Consent (Article 6(1)(a)) for any non essential module added by the operator.

### Does Danneo CMS transfer data to the United States?

Not by default. Danneo CMS is self hosted, so where data goes depends entirely on the operator. If you host the instance in Russia, Russian law 152 FZ applies and storage must remain on Russian servers for Russian citizens. If you host outside the EEA for EU visitors, you need a Chapter V GDPR safeguard (Data Privacy Framework for the US, SCCs elsewhere).

### Do I need a DPIA for Danneo CMS?

For a brochure or small editorial site a DPIA is not mandatory. It becomes recommended when the CMS runs user accounts at scale, handles sensitive content, hosts a forum exposing user generated content, processes payments or interacts with minors.

### How do I implement Danneo CMS compliantly?

Host on a controlled server in or close to your audience, restrict admin access by IP or VPN, enforce TLS and strong passwords, document the modules in your records of processing, keep PHP and the CMS patched, define a log retention period and gate any analytics or social module behind a consent banner.

### What alternatives exist if Danneo CMS does not fit?

Other self hosted PHP CMS such as WordPress, Drupal, Joomla, MODX or Bitrix in the Russian market. Static site generators like Hugo or Eleventy paired with EU hosting are a privacy friendly alternative when dynamic features are limited.

### How should I update my cookie policy for Danneo CMS?

Describe the strictly necessary cookies (PHPSESSID, authentication, CSRF), state that no third party cookies are loaded by default, mention any active analytics or social module and link to its policy, indicate the hosting region and applicable transfer mechanism. Review the policy every twelve months and after each module change.

Same category

## More services: CMS

[See the whole category](https://www.flowconsent.com/en/services/cms)

### [GoDaddy Escapade](https://www.flowconsent.com/en/services/cms/godaddy-escapade)

[GoDaddy Escapade is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. GoDaddy Escapade supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, GoDaddy Escapade remains a leading web development choice.](https://www.flowconsent.com/en/services/cms/godaddy-escapade)

[CMS](https://www.flowconsent.com/en/services/cms/godaddy-escapade)

·

### [NukeViet CMS](https://www.flowconsent.com/en/services/cms/nukeviet-cms)

[Nukeviet CMS is a powerful content management system (CMS) designed to help businesses and developers build, manage, and publish digital content with ease. It offers a flexible architecture that supports custom content types, templates, and workflows, making it ideal for websites of any scale. With Nukeviet CMS, teams can streamline content creation, improve collaboration, and deliver engaging web experiences. Its extensible plugin ecosystem and API-first approach ensure seamless integration with.](https://www.flowconsent.com/en/services/cms/nukeviet-cms)

[CMS](https://www.flowconsent.com/en/services/cms/nukeviet-cms)

·

### [Chayns](https://www.flowconsent.com/en/services/cms/chayns)

[Chayns is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Chayns supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Chayns ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/chayns)

[CMS](https://www.flowconsent.com/en/services/cms/chayns)

·

### [Essent SiteBuilder Pro](https://www.flowconsent.com/en/services/cms/essent-sitebuilder-pro)

[Essent SiteBuilder Pro is an intuitive website builder that empowers users to create professional, responsive websites without any coding knowledge. Its drag-and-drop interface, pre-designed templates, and customizable components make it easy to launch stunning websites quickly. Essent SiteBuilder Pro includes built-in SEO tools, mobile optimization, and hosting, ensuring your site ranks well in search engines and performs flawlessly across all devices. Ideal for small businesses, freelancers, and entrepreneurs.](https://www.flowconsent.com/en/services/cms/essent-sitebuilder-pro)

[CMS](https://www.flowconsent.com/en/services/cms/essent-sitebuilder-pro)

·

### [Recent Posts Widget With Thumbnails](https://www.flowconsent.com/en/services/cms/recent-posts-widget-with-thumbnails)

[Recent Posts Widget With Thumbnails is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Recent Posts Widget With Thumbnails supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Recent Posts Widget With.](https://www.flowconsent.com/en/services/cms/recent-posts-widget-with-thumbnails)

[CMS](https://www.flowconsent.com/en/services/cms/recent-posts-widget-with-thumbnails)

·

### [Jottful](https://www.flowconsent.com/en/services/cms/jottful)

[Jottful is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Jottful offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Jottful empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/jottful)

[Analytics](https://www.flowconsent.com/en/services/cms/jottful)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)