> GetSimple CMS and privacy: a flat file CMS that sets no front end tracking cookies, only an admin login cookie, so no banner is needed by default. > > Canonical: https://www.flowconsent.com/en/services/cms/getsimple-cms CMS # GetSimple CMS Unclassified · [Official website](https://get-simple.info) GetSimple CMS is a lightweight, self hosted, flat file content management system that stores content in XML files rather than a database. By default the public website sets no tracking or analytics cookies, so a consent banner is generally not required. The only cookie is a strictly necessary administrator authentication cookie used in the backend, which is exempt from consent under the ePrivacy Directive. Because it is self hosted, there is no transfer of visitor data to third parties by default. [Block GetSimple CMS until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 2 - Third-party domains 1 - Servers Self hosted (wherever the site owner hosts it; typically within the EU for EU operators) Overview ## What does GetSimple CMS do? ## What GetSimple CMS is GetSimple CMS is a lightweight, self hosted content management system written in PHP that stores all content in flat XML files instead of a database. It is designed for small websites that need simple page management without the overhead of a database driven platform. Because the site owner installs and runs it on their own server, they remain the sole controller of the content and of any visitor data the server processes. ## What data and cookies it collects By default the public website served by GetSimple sets no analytics or marketing cookies and runs no third party tracking. The only cookies are backend administrator cookies, historically including a cookie that stores the administrator username in a GS\_ADMIN\_USERNAME style value and a hashed authentication cookie that keeps the administrator logged in. These cookies are set only for logged in administrators in the control panel and never for ordinary public visitors. ## GDPR and ePrivacy implications The administrator authentication cookie is strictly necessary to provide a service the user has explicitly requested, namely logging in to the admin area, so it falls under the Article 5(3) ePrivacy exemption and does not require consent. Since the public site sets no other cookies and performs no tracking, there is normally no personal data processing of visitors beyond standard server logs, which can usually be handled on the basis of legitimate interest with appropriate retention limits. ## When a consent banner becomes necessary A consent banner is generally not required for a plain GetSimple site. It becomes necessary only if the site owner adds third party embeds such as web fonts, maps, analytics, or video, because those services set their own cookies and carry their own consent and transfer duties. In that case the consent obligations come from the embedded third parties, not from GetSimple itself, and each added service should be assessed separately. ## Practical compliance steps The main privacy duties for a GetSimple site are operational security rather than consent management. Protect the admin area with strong credentials and HTTPS, restrict access to the data directory that holds the XML files and backups, keep the installation and any plugins updated, and document server log retention in a short privacy notice. If you later add third party content, gate it behind a consent mechanism and disclose any resulting transfers. Compliance ## GetSimple CMS and the GDPR - Legal basis Strictly necessary; no consent required for the public website (Art. 5(3) ePrivacy exemption for the administrator session cookie) - Risk level low - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) GetSimple CMS is low risk from a data protection perspective. The public website sets no tracking cookies, performs no profiling, and transfers no visitor data to third countries by default, so a DPIA is not normally required. Any assessment should focus on the security of the administrator area and the XML data directory, the retention of server logs, and the separate review of any third party embeds the site owner later adds, since those would introduce their own cookies and transfers. ### Sample text for your banner > This website runs on GetSimple CMS and does not use tracking or analytics cookies. The only cookie is a strictly necessary login cookie used by administrators to access the management area, which does not require your consent. We do not share your browsing data with third parties. If we later add embedded content from other providers, we will ask for your consent before it loads. Cookies and trackers ## What GetSimple CMS sets and contacts - Tracking method Server rendered flat file CMS; no front end tracking by default - Server location Self hosted (wherever the site owner hosts it; typically within the EU for EU operators) - Cookieless mode available Yes ### Cookies set (2) | Name | Type | Duration | Purpose | | --------------------- | --------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | GS\_ADMIN\_USERNAME | necessary | Session | Strictly necessary backend cookie that stores the administrator username to support authentication in the GetSimple control panel. Set only for logged in administrators, never for public visitors. | | GetSimple auth cookie | necessary | Session | Strictly necessary hashed authentication cookie that keeps the administrator logged in to the backend. Exempt from consent under the ePrivacy Directive as it is required for the requested login service. | ### Third-party domains contacted (1) - `get-simple.info` Questions ## Frequently asked questions about GetSimple CMS Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does GetSimple CMS set? By default GetSimple sets no cookies for public visitors. It sets only backend administrator cookies, historically a cookie storing the administrator username in a GS\_ADMIN\_USERNAME style value and a hashed authentication cookie that keeps the administrator logged in. These are session cookies used only inside the control panel. ### Do I need consent to run a GetSimple website? Generally no. The public site sets no tracking cookies, and the only cookie is a strictly necessary administrator login cookie that is exempt from consent under Article 5(3) of the ePrivacy Directive. Consent becomes relevant only if you add third party embeds such as fonts, maps, analytics, or video. ### What is the legal basis for GetSimple CMS? The administrator authentication cookie is strictly necessary to provide the login service the administrator has requested, so it relies on the ePrivacy exemption rather than consent. Any limited processing of visitor data, such as server logs, can normally rely on legitimate interest under Article 6(1)(f) of the GDPR with appropriate retention limits. ### Does GetSimple CMS transfer data to the United States? No, not by default. GetSimple is self hosted, so visitor data stays on your own server and is not sent to third parties or third countries. The only external connection is an optional update check and the extend plugin repository on get-simple.info, which is initiated from the admin backend, not by public visitors. ### Do I need a DPIA for GetSimple CMS? No, a DPIA is not normally required for a plain GetSimple site because it sets no tracking cookies, performs no profiling, and makes no international transfers. A short risk note is enough, and you should only revisit the assessment if you add third party embeds that introduce their own cookies and transfers. ### How do I run GetSimple CMS in a compliant and secure way? Focus on operational security rather than consent banners. Use strong administrator credentials and HTTPS, restrict access to the data directory that holds the XML files and backups, keep the core and any plugins updated, and publish a short privacy notice covering server log retention. Add a consent mechanism only if you later embed third party content. ### Are there alternatives to GetSimple CMS? Other lightweight or flat file systems include WordPress for a database driven option with a large ecosystem, and Kirby or Grav for flat file content management similar in spirit to GetSimple. The right choice depends on whether you prefer a simple flat file setup or a richer plugin ecosystem, and on your maintenance capacity. ### Do I need to update my cookie policy for GetSimple CMS? For a default installation you can simply state that the site uses only a strictly necessary administrator login cookie and no tracking. You only need to expand the cookie policy if you add third party embeds, in which case list each added service, its cookies, durations, and any data transfers it introduces. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [Popmenu](https://www.flowconsent.com/en/services/cms/popmenu) [Popmenu is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Popmenu integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Popmenu helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/popmenu) [CMS](https://www.flowconsent.com/en/services/cms/popmenu) · ### [PublishRR](https://www.flowconsent.com/en/services/cms/publishrr) [Publishrr is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Publishrr supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Publishrr ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/publishrr) [CMS](https://www.flowconsent.com/en/services/cms/publishrr) · ### [pinoox](https://www.flowconsent.com/en/services/cms/pinoox) [pinoox is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. pinoox supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, pinoox ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/pinoox) [CMS](https://www.flowconsent.com/en/services/cms/pinoox) · ### [E-monsite](https://www.flowconsent.com/en/services/cms/e-monsite) [E-monsite is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. E-monsite integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, E-monsite helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/e-monsite) [CMS](https://www.flowconsent.com/en/services/cms/e-monsite) · ### [SiteOrigin Page Builder](https://www.flowconsent.com/en/services/cms/siteorigin-page-builder) [SiteOrigin Page Builder is a versatile page builder that enables web designers and marketers to create high-converting landing pages and web pages with an intuitive visual editor. It features drag-and-drop functionality, responsive design controls, and a library of customizable templates. SiteOrigin Page Builder integrates with popular CMS platforms, marketing tools, and analytics services, allowing users to build and optimize pages that drive engagement and conversions without writing code.](https://www.flowconsent.com/en/services/cms/siteorigin-page-builder) [CMS](https://www.flowconsent.com/en/services/cms/siteorigin-page-builder) · ### [Unbounce](https://www.flowconsent.com/en/services/cms/unbounce) [Unbounce is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Unbounce integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Unbounce helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/unbounce) [CMS](https://www.flowconsent.com/en/services/cms/unbounce) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)