Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Gannett CMS, known as Presto, is the proprietary content management system used by Gannett and the USA TODAY Network to power large US news websites.
Gannett CMS, internally called Presto, is the proprietary content management system built and operated by Gannett, the US publisher behind the USA TODAY Network. It powers a large portfolio of national and local news websites, handling article publishing, page layout and content delivery at scale. As a publishing platform it sits at the core of the website rather than acting as an external tracking tool, although the news pages it serves frequently carry additional measurement and advertising technology.
By itself the CMS sets first party cookies for session continuity and visitor preferences, for example to remember settings or support core site functions. In practice the news sites it powers usually layer analytics and advertising tags on top, which are separate technologies but are very commonly present on Gannett properties. This means a real world Gannett page often combines necessary first party cookies with optional analytics and advertising cookies that require careful handling under European rules.
Gannett is a United States organisation and its CMS and content delivery network are hosted in the US, served from domains such as gannett.com and gannett-cdn.com. For European visitors this means personal data such as IP addresses and session identifiers can be processed in the United States, which is a third country under the GDPR. Any such transfer needs a valid transfer mechanism and clear information to the user.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The strictly necessary session cookies that keep the CMS working can rely on legitimate interest and on the necessity exemption from consent, because they are essential to deliver the requested pages. The analytics and advertising cookies that news sites add are a different matter and require prior consent from European visitors under the ePrivacy rules, with the publisher acting on the basis of that consent. A clear separation between necessary and optional cookies is therefore the foundation of a compliant setup.
The overall risk is medium. The CMS layer on its own is low risk, but the high traffic news context and the common presence of advertising and analytics tags, combined with US hosting, raise the profile of the processing. Operators should document which tags load, gate the optional ones behind consent, and ensure a transfer mechanism is in place for the United States so that the publishing benefits do not come at the cost of weak data protection.
To run a Gannett powered site responsibly, map every cookie and tag that appears on the page, classify them as necessary or optional, and connect the optional ones to a consent management platform so they only fire after agreement. Provide a clear cookie policy that names the categories and the US transfer, keep records of consent, and review the tag inventory regularly because advertising and analytics partners change over time. This keeps the editorial value of the platform intact while respecting visitor choices.
Websites using Gannett CMS (Presto) must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is advisable where the CMS powers high traffic news properties that layer analytics and advertising tags, because the combined processing of IP addresses, session identifiers and behavioural data at scale, together with transfers to the United States, can present elevated risk. The CMS first party session cookies on their own are low risk and necessary, so the assessment should focus on the added tracking layers and the international transfer mechanism.
Sample consent text
This site runs on Gannett CMS and may load analytics and advertising cookies from our publishing partners. These cookies, and any related transfer of data to the United States, are used only with your consent. You can accept, reject or manage your preferences at any time.
Third-party domains contacted
gannett.comgannett-cdn.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| gannett_session | First party | Session | Maintains session continuity while a visitor browses the news site. |
| gannett_pref | First party | 1 year | Stores visitor preferences such as display and regional settings. |
| gannett_consent | First party | 6 months | Records the visitor cookie consent choices for analytics and advertising. |
| analytics_id | Third party (analytics) | 2 years | Set by analytics tags commonly layered on news pages to measure audience, loaded only after consent. |
| ad_id | Third party (advertising) | 13 months | Set by advertising tags commonly present on news pages for ad delivery and measurement, loaded only after consent. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
The CMS itself sets first party cookies for session continuity and visitor preferences, which support core site functions. On real Gannett news sites these are typically accompanied by separate analytics and advertising cookies added by the publisher. You should inventory the actual page to see the full list.
Consent is not required for the strictly necessary session and preference cookies that keep the CMS working. It is required for the analytics and advertising cookies that news sites commonly add, which must wait for the visitor to agree before they load in Europe.
The necessary CMS cookies rely on legitimate interest and the necessity exemption because they are essential to deliver the requested content. The optional analytics and advertising cookies rely on the visitor consent collected through your consent banner.
Yes. Gannett is a US publisher and its CMS and CDN are hosted in the United States, served from gannett.com and gannett-cdn.com. Data such as IP addresses can therefore be processed in the US, a third country under the GDPR that needs a valid transfer mechanism.
A DPIA is advisable for high traffic news sites that layer analytics and advertising on top of the CMS, because the combined processing and US transfers raise the risk. The CMS session cookies alone are low risk, so the focus is on the added tracking layers.
Map every cookie and tag on the page, classify them as necessary or optional, and route the optional ones through a consent management platform so they fire only after agreement. Document the US transfer and keep records of the consent you collect.
Publishers who want lighter tracking can pair any CMS with privacy friendly or self hosted analytics and EU based advertising solutions. Open source content platforms can also reduce reliance on US hosting, although Presto itself is proprietary to Gannett.
List the necessary CMS cookies and each optional analytics and advertising cookie with its purpose and duration, and name the US transfer clearly. Review the policy whenever advertising or analytics partners change so it always matches what loads on the page.