CMS

gnuboard

Korean open source PHP based community CMS that powers bulletin boards, member areas and small online stores, popular in the Korean web ecosystem.

Block gnuboard until consent Scan my site

Overview

What does gnuboard do?

What gnuboard is

gnuboard is a free open source community CMS built around bulletin boards, written in PHP. The project is maintained by SIR.kr in Korea and is widely used to run forums, member areas, school sites and small ecommerce in the Korean speaking web. The platform is self hosted: the operator is the data controller.

Cookies and data

A vanilla gnuboard install sets a PHP session cookie (PHPSESSID), a CSRF token and an optional auto login cookie (gb_auto_login) when the visitor ticks the remember me box. Anonymous visitors browse without persistent identifiers. Third party trackers are only loaded when the operator installs plugins or themes that include them.

GDPR and ePrivacy posture

Session and CSRF cookies are strictly necessary under recital 66 of ePrivacy. The auto login cookie requires explicit consent (the remember me checkbox). Third party logins (Kakao, Naver), embedded comment boards and analytics plugins require Article 5(3) consent and may also imply transfers to Korea or the United States.

Hosting and transfers

Self host gnuboard on a hosting provider of your choice. South Korea benefits from a GDPR adequacy decision since 2021 for the private sector, so hosting in Korea is acceptable. Document any third party processor (CDN, mail relay, login provider) in your RoPA.

Implementation steps

Document PHPSESSID, CSRF and gb_auto_login in your cookie register, gate non essential plugins behind a CMP, sign DPAs with login providers and analytics processors, keep PHP and gnuboard up to date, and provide a clear privacy notice in line with Article 13 GDPR.

Compliance

gnuboard and the GDPR

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary CMS session, security and CSRF cookies. Consent (Art. 6(1)(a)) for the auto login cookie, third party logins (Kakao, Naver) and any analytics or advertising plugins added by the operator.
Risk level: medium
Applicable regulations: GDPR, ePrivacy Directive, UK GDPR, South Korean PIPA when the operator is established in Korea

Impact assessment (DPIA)

A DPIA is generally not required for a vanilla gnuboard install. It becomes relevant when the operator activates third party logins (Kakao, Naver), member email marketing at scale or analytics plugins that profile visitors.

Sample text for your banner

This site runs on gnuboard. With your consent, optional plugins (Kakao login, Naver Analytics, comment widgets) may set cookies and process your data on third party servers.

Cookies and trackers

What gnuboard sets and contacts

Tracking method: PHP based open source bulletin board and CMS that runs server side. Sets first party PHP session cookies for authenticated users, plus a long lived auto login cookie. Visitor pages are server rendered without behavioural tracking by default.
Server location: Operator chosen (gnuboard is self hosted, typically on a Linux PHP server controlled by the site owner; the project is maintained by SIR.kr in Korea)
Cookieless mode available: Yes

Cookies set (3)

Name	Type	Duration	Purpose
PHPSESSID	first_party	Session	Strictly necessary PHP session cookie used to keep authenticated users logged in.
gb_csrf_token	first_party	Session	CSRF token used by gnuboard forms to protect against cross site request forgery attacks.
gb_auto_login	first_party	30 days	Long lived auto login cookie set when the visitor explicitly chooses remember me at sign in.

Third-party domains contacted (2)

sir.kr
gnuboard.com

Questions

Frequently asked questions about gnuboard

Can't find your question? Write to us, we answer fast.

Write to us

What cookies does gnuboard set?

PHPSESSID (session), a CSRF token and an optional auto login cookie (gb_auto_login) when the visitor checks remember me. No tracking or advertising cookies are set by the core CMS.

Is consent required for gnuboard?

Strictly necessary cookies (session, CSRF) are exempt. The auto login cookie requires explicit consent through the remember me checkbox. Optional plugins (Kakao login, Naver Analytics) require Article 5(3) consent.

What is the legal basis for processing on a gnuboard site?

Legitimate interest (Art. 6(1)(f) GDPR) for strictly necessary cookies and access logs. Consent (Art. 6(1)(a)) for auto login, third party logins and analytics plugins.

Does gnuboard transfer data to a third country?

gnuboard itself does not transfer data. Hosting in South Korea is covered by GDPR adequacy since 2021. Plugins (Kakao login, Naver Analytics) may imply transfers and require their own SCCs or rely on adequacy.

Do I need a DPIA for gnuboard?

Generally no for a vanilla install. Yes when third party logins, behavioural analytics or large scale member email marketing are activated.

How do I implement gnuboard compliantly?

Keep PHP and gnuboard up to date, document the strictly necessary cookies, gate optional plugins behind a CMP, sign DPAs with login and analytics processors and provide a clear privacy notice.

What are the alternatives to gnuboard?

Other community focused CMS include Discourse, phpBB, Vanilla Forums, Flarum, NodeBB and WordPress with bbPress.

How do I update my cookie policy when running gnuboard?

List PHPSESSID and CSRF as strictly necessary, gb_auto_login as functional with consent, then every plugin cookie with name, purpose, retention and processor.

Webready

Webready is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Webready offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Webready empowers organizations to optimize strategy and maximize return on investment.

CMS

Pagevamp

Pagevamp is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Pagevamp offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Pagevamp empowers organizations to optimize strategy and maximize return on investment.

Analytics

Breakdance

Breakdance is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Breakdance offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Breakdance empowers organizations to optimize strategy and maximize return on investment.

CMS

Joomla

Joomla is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Joomla supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Joomla remains a leading web development choice.

CMS

Simple Machines Forum

Simple Machines Forum is a community forum platform that enables organizations to build engaging online discussion spaces for their users, customers, or members. It provides threaded discussions, user profiles, moderation tools, and notification systems. Simple Machines Forum supports categories, tags, and search functionality to organize conversations. With gamification features, reputation systems, and SEO-optimized content, Simple Machines Forum helps build vibrant communities that drive engagement and loyalty.

CMS

The Church Co

The Church Co is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. The Church Co offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, The Church Co empowers organizations to optimize strategy and maximize return on investment.