> Running a Duda website under GDPR: necessary session cookies, consent for native analytics and widgets, EU delivery, Data Privacy Framework and DPIA. > > Canonical: https://www.flowconsent.com/en/services/cms/duda CMS # Duda Unclassified · [Official website](https://www.duda.co) Duda is a website builder targeted at agencies and SaaS resellers. Provides a drag and drop editor, dynamic content, multi site management, an integrated CRM and a marketplace of widgets. Strictly necessary cookies; consent required for native analytics, visitor tracking and installed widgets. [Block Duda until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Required - Documented cookies 6 - Third-party domains 6 - Servers Duda is operated by Duda Inc., a US company headquartered in Palo Alto, California. The Duda platform runs on Amazon Web Services with primary regions in the United States (us-east-1) and Europe (eu-west-1 Ireland). EU customer sites are served from CloudFront edge nodes worldwide, with content fetched from the US or EU storage region depending on the contract. The site builder and the editor run from the US infrastructure. Overview ## What does Duda do? ## **What Duda is** Duda is a website builder designed for agencies, SaaS resellers and large publishers managing many sites. The product line covers the editor, the staging environment, the white label client preview, dynamic content for multilingual or location based pages, an integrated CRM that captures form leads, a widget builder, an email marketing module and a marketplace of third party widgets. Duda is the engine behind several SaaS website plans bundled with marketing automation tools. ## **Cookies set by Duda** Strictly necessary: DUDA\_SESSION (session, editor and viewer session), dudamobile\_token (1 year, mobile site detection), \_dd\_session (session, edit mode token), DUDA\_AB\_TEST (90 days, internal A/B test split). With Duda Visitor Tracking activated: duda\_visitor (1 year, anonymous visitor identifier), duda\_pageview (session, page view counter for native analytics). Third party widgets installed from the App Store add their own cookies (Google Analytics, Meta Pixel, Hotjar, Calendly, etc.). ## **GDPR, ePrivacy and form submissions** The strictly necessary cookies are exempt under ePrivacy art. 5(3) and rely on legitimate interest (GDPR art. 6(1)(f)). The Duda native analytics, the visitor tracking and the form submission flow that feeds the Duda CRM require consent under GDPR art. 6(1)(a). Email marketing campaigns sent through the Duda Email Marketing module need a separate consent under the ePrivacy direct marketing rules and the local opt out rules. The Duda widgets marketplace surfaces a privacy section but does not automatically gate widgets behind a CMP. ## **EU edge and US storage** Duda delivers sites through CloudFront, with EU edge nodes that serve European visitors closer to their location. The site content, the CRM database, the analytics records and the customer billing are stored in the United States by default; EU storage is available on the higher plans contractually. The corporate platform, the customer support and the engineering team operate from the US, Israel and India. Duda is certified under the EU US Data Privacy Framework, with 2021 SCCs as fallback. ## **Compliance checklist for European agencies** Sign the Duda Data Processing Addendum, request the EU storage region on the higher plans, gate every visitor tracking, native analytics and widget behind a CMP via the Duda cookie banner widget or your own CMP, document the form submission flow with a clear consent text for the email marketing list, set the strictest retention for the Duda CRM and document the chain in your record of processing under GDPR art. 30. Compliance ## Duda and the GDPR Duda is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Strictly necessary cookies (DUDA\_SESSION, dudamobile\_token, \_dd\_session): legitimate interest of the publisher and ePrivacy art. 5(3) exemption. For Duda native analytics, the visitor tracking module, the form submissions sent to Duda servers and any installed widget that loads tracking pixels: consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3). The Duda CRM that stores visitor contact data relies on contract or legitimate interest depending on the flow. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, CNIL guidance on website builders, EU US Data Privacy Framework, Israeli Protection of Privacy Law, AEPD ecommerce guidelines ### Impact assessment (DPIA) A DPIA is recommended when the Duda native analytics, the visitor tracking module or the Duda CRM are activated, because they build a profile of website visitors and link it to email and phone identifiers when forms are submitted. The DPIA should document the EU edge delivery option, the US storage default, the retention of visitor profiles and CRM records, the integration with third party widgets and the legal basis for marketing emails sent via the Duda Email Marketing module. ### Sample text for your banner > Our website is built with Duda. Strictly necessary cookies (DUDA\_SESSION, dudamobile\_token, \_dd\_session) keep the editor and the site working. With your consent we activate the Duda native analytics, the visitor tracking, the Duda CRM and any widget that loads tracking pixels. Site delivery is on CloudFront with an EU edge option, and the management layer runs in the United States under the EU US Data Privacy Framework. You can accept, refuse or withdraw at any time. Cookies and trackers ## What Duda sets and contacts - Tracking method hosted\_website\_builder\_with\_first\_party\_cookies\_and\_optional\_analytics\_marketing - Server location Duda is operated by Duda Inc., a US company headquartered in Palo Alto, California. The Duda platform runs on Amazon Web Services with primary regions in the United States (us-east-1) and Europe (eu-west-1 Ireland). EU customer sites are served from CloudFront edge nodes worldwide, with content fetched from the US or EU storage region depending on the contract. The site builder and the editor run from the US infrastructure. - Data transferred outside the EU Duda Inc. is a US company. The Duda platform, the corporate analytics, the customer support and the engineering team operate from the United States with additional teams in Israel and India. Duda is certified under the EU US Data Privacy Framework. The 2021 Standard Contractual Clauses cover the transfers as a fallback. Customer sites can be configured to use a CloudFront EU edge but the management layer stays in the US. ### Cookies set (6) | Name | Type | Duration | Purpose | | ----------------- | --------------------------------------------- | -------- | ------------------------------------------------------------------------------------------ | | DUDA\_SESSION | First party (Duda) | Session | Editor and viewer session token used by the Duda platform | | dudamobile\_token | First party (Duda) | 1 year | Stores whether the visitor should be served the mobile or desktop version of the Duda site | | \_dd\_session | First party (Duda) | Session | Identifies the edit mode session in the Duda editor | | DUDA\_AB\_TEST | First party (Duda) | 90 days | Used by the Duda A/B testing module to keep the visitor in the same variant | | duda\_visitor | First party (Duda Visitor Tracking, optional) | 1 year | Anonymous visitor identifier used by the Visitor Tracking module when activated | | duda\_pageview | First party (Duda Visitor Tracking, optional) | Session | Page view counter used by the native analytics module | ### Third-party domains contacted (6) - `duda.co` - `multiscreensite.com` - `cdn-website.com` - `static.cdn-website.com` - `lirp.cdn-website.com` - `dudamobile.com` Questions ## Frequently asked questions about Duda Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Duda set? Strictly necessary: DUDA\_SESSION (session), dudamobile\_token (1 year, mobile detection), \_dd\_session (session, edit mode), DUDA\_AB\_TEST (90 days, A/B testing). With Visitor Tracking: duda\_visitor (1 year, anonymous identifier), duda\_pageview (session). Installed widgets add their own cookies (GA, Meta Pixel, Hotjar, Calendly). ### Is consent required for Duda? Strictly necessary cookies do not need consent. Consent is required for the Duda native analytics, the Visitor Tracking module, the email marketing list and every widget that loads tracking pixels. The Duda cookie banner widget can be used to gate them. ### What is the legal basis for Duda? Legitimate interest (GDPR art. 6(1)(f)) and the ePrivacy art. 5(3) exemption for the session cookies. Contract (art. 6(1)(b)) for form submissions you fulfil. Consent (art. 6(1)(a)) for analytics, visitor tracking, marketing automation and CRM follow up beyond the form. ### Are data transferred to the United States? Yes by default. Site content, CRM and analytics data are stored in US AWS regions. EU storage is available on higher plans. Duda is certified under the EU US Data Privacy Framework with SCCs 2021 as fallback. ### Do I need a DPIA for Duda? Recommended when Duda Visitor Tracking, native analytics or the CRM with email marketing is activated, because they build a profile of website visitors. The DPIA should describe storage region, retention, third party widgets and the email marketing legal basis. ### How do I implement Duda compliantly? Sign the DPA, request EU storage on higher plans, gate Visitor Tracking, native analytics and widgets behind a CMP, configure the Duda Cookie Banner Widget for the banner, document the email marketing consent in the form fields, set CRM retention to the minimum and document the chain in your record of processing. ### What are the alternatives to Duda? EU first website builders: Strikingly (EU plan), Webflow (US with EU edge), Squarespace (US), Wix (Israel with EU storage), Jimdo (Germany), 1&1 IONOS MyWebsite (Germany), Hostinger Website Builder (Lithuania), WordPress.com (US with global infrastructure), Sitebuilder.com. Jimdo and 1&1 IONOS are the most EU centric agency friendly builders. ### How do I update my cookie policy after adding Duda? List Duda as a sub processor, declare the strictly necessary cookies and the consent based cookies separately, mention the US storage default and the EU storage option, reference the Data Privacy Framework certification, link to the Duda Privacy Policy and provide a DSAR contact. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [vBulletin](https://www.flowconsent.com/en/services/cms/vbulletin) [vBulletin is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. vBulletin supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, vBulletin ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/vbulletin) [CMS](https://www.flowconsent.com/en/services/cms/vbulletin) · ### [PHPBoost](https://www.flowconsent.com/en/services/cms/phpboost) [PHPBoost is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. PHPBoost integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, PHPBoost helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/phpboost) [CMS](https://www.flowconsent.com/en/services/cms/phpboost) · ### [Xiuno BBS](https://www.flowconsent.com/en/services/cms/xiuno-bbs) [Xiuno BBS is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Xiuno BBS supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Xiuno BBS ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/xiuno-bbs) [CMS](https://www.flowconsent.com/en/services/cms/xiuno-bbs) · ### [Lychee](https://www.flowconsent.com/en/services/cms/lychee) [Lychee is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Lychee integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Lychee helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/lychee) [CMS](https://www.flowconsent.com/en/services/cms/lychee) · ### [Revize](https://www.flowconsent.com/en/services/cms/revize) [Revize is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Revize offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Revize empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/revize) [Analytics](https://www.flowconsent.com/en/services/cms/revize) · ### [Melis Platform](https://www.flowconsent.com/en/services/cms/melis-platform) [Melis Platform is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Melis Platform supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Melis Platform ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/melis-platform) [CMS](https://www.flowconsent.com/en/services/cms/melis-platform) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)