> Self hosted gnuboard sets only session cookies by default. GDPR risk depends on hosting and on Naver, Kakao or analytics plugins added by the operator. > > Canonical: https://www.flowconsent.com/en/services/cms/gnuboard CMS # gnuboard Unclassified · [Official website](https://github.com/gnuboard) Korean open source PHP based community CMS that powers bulletin boards, member areas and small online stores, popular in the Korean web ecosystem. [Block gnuboard until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 2 - Servers Operator chosen (gnuboard is self hosted, typically on a Linux PHP server controlled by the site owner; the project is maintained by SIR.kr in Korea) Overview ## What does gnuboard do? ## **What gnuboard is** gnuboard is a free open source community CMS built around bulletin boards, written in PHP. The project is maintained by SIR.kr in Korea and is widely used to run forums, member areas, school sites and small ecommerce in the Korean speaking web. The platform is self hosted: the operator is the data controller. ## **Cookies and data** A vanilla gnuboard install sets a PHP session cookie (PHPSESSID), a CSRF token and an optional auto login cookie (gb\_auto\_login) when the visitor ticks the remember me box. Anonymous visitors browse without persistent identifiers. Third party trackers are only loaded when the operator installs plugins or themes that include them. ## **GDPR and ePrivacy posture** Session and CSRF cookies are strictly necessary under recital 66 of ePrivacy. The auto login cookie requires explicit consent (the remember me checkbox). Third party logins (Kakao, Naver), embedded comment boards and analytics plugins require Article 5(3) consent and may also imply transfers to Korea or the United States. ## **Hosting and transfers** Self host gnuboard on a hosting provider of your choice. South Korea benefits from a GDPR adequacy decision since 2021 for the private sector, so hosting in Korea is acceptable. Document any third party processor (CDN, mail relay, login provider) in your RoPA. ## **Implementation steps** Document PHPSESSID, CSRF and gb\_auto\_login in your cookie register, gate non essential plugins behind a CMP, sign DPAs with login providers and analytics processors, keep PHP and gnuboard up to date, and provide a clear privacy notice in line with Article 13 GDPR. Compliance ## gnuboard and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary CMS session, security and CSRF cookies. Consent (Art. 6(1)(a)) for the auto login cookie, third party logins (Kakao, Naver) and any analytics or advertising plugins added by the operator. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, UK GDPR, South Korean PIPA when the operator is established in Korea ### Impact assessment (DPIA) A DPIA is generally not required for a vanilla gnuboard install. It becomes relevant when the operator activates third party logins (Kakao, Naver), member email marketing at scale or analytics plugins that profile visitors. ### Sample text for your banner > This site runs on gnuboard. With your consent, optional plugins (Kakao login, Naver Analytics, comment widgets) may set cookies and process your data on third party servers. Cookies and trackers ## What gnuboard sets and contacts - Tracking method PHP based open source bulletin board and CMS that runs server side. Sets first party PHP session cookies for authenticated users, plus a long lived auto login cookie. Visitor pages are server rendered without behavioural tracking by default. - Server location Operator chosen (gnuboard is self hosted, typically on a Linux PHP server controlled by the site owner; the project is maintained by SIR.kr in Korea) - Cookieless mode available Yes ### Cookies set (3) | Name | Type | Duration | Purpose | | --------------- | ------------ | -------- | -------------------------------------------------------------------------------------------- | | PHPSESSID | first\_party | Session | Strictly necessary PHP session cookie used to keep authenticated users logged in. | | gb\_csrf\_token | first\_party | Session | CSRF token used by gnuboard forms to protect against cross site request forgery attacks. | | gb\_auto\_login | first\_party | 30 days | Long lived auto login cookie set when the visitor explicitly chooses remember me at sign in. | ### Third-party domains contacted (2) - `sir.kr` - `gnuboard.com` Questions ## Frequently asked questions about gnuboard Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does gnuboard set? PHPSESSID (session), a CSRF token and an optional auto login cookie (gb\_auto\_login) when the visitor checks remember me. No tracking or advertising cookies are set by the core CMS. ### Is consent required for gnuboard? Strictly necessary cookies (session, CSRF) are exempt. The auto login cookie requires explicit consent through the remember me checkbox. Optional plugins (Kakao login, Naver Analytics) require Article 5(3) consent. ### What is the legal basis for processing on a gnuboard site? Legitimate interest (Art. 6(1)(f) GDPR) for strictly necessary cookies and access logs. Consent (Art. 6(1)(a)) for auto login, third party logins and analytics plugins. ### Does gnuboard transfer data to a third country? gnuboard itself does not transfer data. Hosting in South Korea is covered by GDPR adequacy since 2021. Plugins (Kakao login, Naver Analytics) may imply transfers and require their own SCCs or rely on adequacy. ### Do I need a DPIA for gnuboard? Generally no for a vanilla install. Yes when third party logins, behavioural analytics or large scale member email marketing are activated. ### How do I implement gnuboard compliantly? Keep PHP and gnuboard up to date, document the strictly necessary cookies, gate optional plugins behind a CMP, sign DPAs with login and analytics processors and provide a clear privacy notice. ### What are the alternatives to gnuboard? Other community focused CMS include Discourse, phpBB, Vanilla Forums, Flarum, NodeBB and WordPress with bbPress. ### How do I update my cookie policy when running gnuboard? List PHPSESSID and CSRF as strictly necessary, gb\_auto\_login as functional with consent, then every plugin cookie with name, purpose, retention and processor. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [Webready](https://www.flowconsent.com/en/services/cms/webready) [Webready is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Webready offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Webready empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/webready) [CMS](https://www.flowconsent.com/en/services/cms/webready) · ### [Pagevamp](https://www.flowconsent.com/en/services/cms/pagevamp) [Pagevamp is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Pagevamp offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Pagevamp empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/pagevamp) [Analytics](https://www.flowconsent.com/en/services/cms/pagevamp) · ### [Breakdance](https://www.flowconsent.com/en/services/cms/breakdance) [Breakdance is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Breakdance offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Breakdance empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/breakdance) [CMS](https://www.flowconsent.com/en/services/cms/breakdance) · ### [Joomla](https://www.flowconsent.com/en/services/cms/joomla) [Joomla is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Joomla supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Joomla remains a leading web development choice.](https://www.flowconsent.com/en/services/cms/joomla) [CMS](https://www.flowconsent.com/en/services/cms/joomla) · ### [Simple Machines Forum](https://www.flowconsent.com/en/services/cms/simple-machines-forum) [Simple Machines Forum is a community forum platform that enables organizations to build engaging online discussion spaces for their users, customers, or members. It provides threaded discussions, user profiles, moderation tools, and notification systems. Simple Machines Forum supports categories, tags, and search functionality to organize conversations. With gamification features, reputation systems, and SEO-optimized content, Simple Machines Forum helps build vibrant communities that drive engagement and loyalty.](https://www.flowconsent.com/en/services/cms/simple-machines-forum) [CMS](https://www.flowconsent.com/en/services/cms/simple-machines-forum) · ### [The Church Co](https://www.flowconsent.com/en/services/cms/the-church-co) [The Church Co is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. The Church Co offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, The Church Co empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/the-church-co) [Analytics](https://www.flowconsent.com/en/services/cms/the-church-co) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)