Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
InstantCMS is an open source, self hosted PHP content management and community platform that sets first party session cookies and keeps data on infrastructure controlled by the operator.
InstantCMS is an open source content management and community platform written in PHP and originally developed in Russia. It is self hosted, which means the operator installs it on their own server and controls the database, the files and the hosting location.
It provides user profiles, blogs, forums, comments and private messaging, so it processes the personal data that members enter when they register and interact on the site.
InstantCMS sets a first party session cookie to keep users signed in and to protect forms against cross site request forgery. Because it is self hosted, these cookies and the stored data remain under the operator control and are not shared with the software vendor.
User accounts, profile details, posts, comments and messages are stored in the operator own database. Any additional analytics or advertising is only present if the operator chooses to add it.
The operator is the data controller for everything processed in the community. The strictly necessary session cookie is exempt from consent under the ePrivacy Directive, but any analytics or marketing cookie added on top requires prior consent.
Member content can include special category data when people discuss health, beliefs or other sensitive topics, so the operator should set clear community rules and retention periods.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
No consent is needed for the session cookie that simply keeps a user logged in. Consent becomes necessary only when the operator enables optional analytics, social plugins or advertising that read or write non essential cookies.
Where consent is required, it must be obtained before the relevant scripts run and must be as easy to withdraw as to give.
Because InstantCMS is self hosted, there is no automatic transfer of data to the software vendor or to any third country. Transfers only arise if the operator chooses hosting outside the European Economic Area or connects external services, in which case Standard Contractual Clauses or an adequacy decision are needed.
Host InstantCMS within the EEA where possible, secure the database, and define retention and deletion rules for member content. Publish a privacy notice that explains the session cookie, document the lawful basis for community processing, and provide easy ways for users to access, correct or delete their data.
If you add analytics or advertising, place those behind a consent banner and keep them out of the strictly necessary category.
Websites using InstantCMS must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is generally not required for a standard InstantCMS deployment, since the core processing relies on first party session cookies and the operator controls the data. A DPIA may become relevant if the operator adds large scale profiling, third party analytics, or processes special category data through community features.
Sample consent text
This site runs on InstantCMS and uses a strictly necessary session cookie to keep you signed in. We only set analytics or marketing cookies with your consent, which you can give, refuse or withdraw at any time.
Third-party domains contacted
instantcms.ioinstantcms.ruCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ICMS[K] | Strictly necessary | Session | Maintains the authenticated session so a member stays signed in. |
| ICMS[user_id] | Strictly necessary | 30 days | Remembers the user identifier for the remember me login feature. |
| ICMS[csrf_token] | Strictly necessary | Session | Provides a token that protects forms against cross site request forgery. |
| ICMS[prefs] | Functional | 1 year | Stores interface preferences such as language and display settings. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
InstantCMS sets a first party session cookie that keeps a member signed in and protects forms against cross site request forgery. It does not set third party tracking cookies by default, so any analytics or advertising cookies come only from extensions the operator chooses to install.
The strictly necessary session cookie does not require consent because it is needed to provide the service the user requested. Consent is required only if the operator adds optional analytics, social widgets or advertising that rely on non essential cookies.
The session cookie and core community functions rely on legitimate interest under Art. 6(1)(f) GDPR, or on contract where a member account is involved. Optional analytics and marketing require consent under Art. 6(1)(a) GDPR.
InstantCMS is self hosted, so by default no data is sent to the vendor or to the United States. Transfers only happen if the operator hosts the server outside the EEA or connects external services, which then need Standard Contractual Clauses or an adequacy decision.
A standard InstantCMS site usually does not require a DPIA, as it relies on a necessary session cookie and operator controlled data. A DPIA becomes relevant for large communities, sensitive topics or added profiling and third party tracking.
Host within the EEA, secure the server and database, and set retention and deletion rules for member content. Publish a clear privacy and cookie notice, document the lawful basis for each purpose, and place any optional analytics behind a consent banner.
Alternatives include other self hosted community platforms such as forum software and general purpose CMS systems with social modules. When comparing them, favour solutions that keep data first party and let you host within the EEA.
Describe the strictly necessary session cookie, its purpose and its duration, and state that it does not require consent. If you enable analytics or advertising, list those cookies separately and explain how visitors can grant or withdraw consent.