Joomla
Joomla is a free open source content management system used by SMEs, associations and public sector sites across Europe. It sets first party PHP session cookies and any cookies added by core plugins (such as Google reCAPTCHA) or third party extensions installed through the Joomla Extensions Directory.
What does Joomla do?
What is Joomla
Joomla is a mature open source content management system written in PHP and maintained by Open Source Matters. It powers small business sites, member associations, magazines and public sector portals across Europe. Joomla is self hosted, so the operator controls the server location, database, file uploads and the cookies dropped in the visitor browser.
Cookies and tracking technologies
A clean Joomla 4 or 5 install sets a session cookie whose name is the MD5 hash of the site (for example a 32 character hexadecimal string), the joomla_user_state cookie that tracks whether a user is logged in, and a joomla_remember_me_* cookie when the remember me option is used. Optional core plugins (Google reCAPTCHA captcha plugin, Privacy component logging) and third party extensions add their own cookies.
GDPR and ePrivacy implications
Joomla core cookies qualify for the strictly necessary exemption of Article 5(3) of the ePrivacy Directive. The Joomla Privacy component ships with built in tools to manage data subject access, rectification and erasure requests, helping operators honour Articles 15 to 22 GDPR. The platform also keeps a privacy consent log when the privacy consent plugin is enabled, which is useful evidence under accountability.
Consent requirements
Core Joomla does not require a cookie banner. Once you enable the Google reCAPTCHA core captcha plugin, the Akeeba Backup cloud uploader, Google Analytics extensions or social embeds, prior, freely given, specific, informed and unambiguous consent is required before those scripts load. A consent management platform must block the tags until acceptance, in line with CNIL, DSK, AEPD and Garante guidelines.
Data transfers outside the EEA
Self hosted Joomla does not transfer visitor data outside the EEA by itself. The update server contacts update.joomla.org for version checks and the extension installer reaches the Joomla Extensions Directory. Choose an EU hosting provider and audit every extension that loads remote scripts (Akeeba Backup cloud, JCH Optimize CDN, third party fonts and CDNs), since these may invoke US data transfers that require SCCs and a transfer impact assessment.
Practical compliance steps
Host inside the EEA, document Joomla core cookies as strictly necessary, enable the Joomla Privacy component to handle data subject requests and consent logs, and switch the captcha plugin to a privacy friendly alternative such as Friendly Captcha or hCaptcha. Use a consent management platform to gate Google Analytics, embedded videos and social widgets. Apply security patches promptly and harden the administrator login with IP allowlists or two factor authentication.
Joomla and the GDPR
- Legal basis
- Legitimate interest for strictly necessary session and security cookies (Article 6(1)(f) GDPR and Article 5(3) ePrivacy exemption). Consent required for analytics or marketing extensions and for the Google reCAPTCHA plugin shipped in core.
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive, national cookie laws (TTDSG in Germany, LCEN in France, LSSI in Spain)
Impact assessment (DPIA)
A DPIA is not required for a clean Joomla install with only strictly necessary session cookies. It becomes recommended once extensions enable behavioural analytics, profiling, embedded social widgets or transfers to third countries through CDNs or cloud backups.
Sample text for your banner
Our website runs on Joomla and uses strictly necessary cookies to keep your session active and protect forms against abuse. Optional analytics, video and social media extensions are activated only with your consent.
What Joomla sets and contacts
- Tracking method
- First party cookies and server side PHP sessions
- Server location
- Self hosted (any region chosen by the site operator)
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| {md5_hash} | first_party | Session | Joomla session cookie. The cookie name is the MD5 hash of the site (32 character hexadecimal). Maintains the visitor session and CSRF token. Set Secure HttpOnly on HTTPS sites. |
| joomla_user_state | first_party | Session | Tracks whether the visitor is logged in or browsing as a guest. Required for the membership and access control features of Joomla. |
| joomla_remember_me_{hash} | first_party | 60 days | Set when the visitor ticks the Remember Me checkbox at login. Allows automatic re authentication without re entering credentials. |
| jpanesliders_privacy-status-{n} | first_party | 1 year | Stores the open or closed state of the Joomla Privacy Component sliders in the admin interface. Set only for authenticated administrators. |
Third-party domains contacted (3)
update.joomla.orgextensions.joomla.orgwww.joomla.org
Frequently asked questions about Joomla
Can't find your question? Write to us, we answer fast.
Which cookies does Joomla set by default?
Joomla sets a session cookie whose name is the MD5 hash of the site, the joomla_user_state cookie (logged in or guest), and a joomla_remember_me_* cookie when the remember me feature is used. Core captcha and privacy consent plugins, plus third party extensions, may add their own cookies once enabled.
Does Joomla require user consent for cookies?
No for a vanilla install: the session and user state cookies are strictly necessary and covered by Article 5(3) ePrivacy. Consent becomes required as soon as you enable the Google reCAPTCHA captcha plugin, analytics extensions, embedded videos or social widgets.
What legal basis applies to Joomla cookies?
Strictly necessary session and security cookies rely on legitimate interest under Article 6(1)(f) GDPR. User accounts and form submissions usually rely on consent or contract. The Joomla Privacy Consent plugin keeps a log of explicit consents, which supports accountability.
Does Joomla transfer data to the United States?
Not by itself. Joomla is self hosted, so you pick the server location. The update server contacts update.joomla.org and the extension installer reaches the Joomla Extensions Directory, which can be operated through EU mirrors. Third country transfers depend on the extensions installed.
Is a DPIA required for Joomla?
A DPIA is not required for a vanilla Joomla site limited to strictly necessary cookies. It is recommended once you install extensions that introduce profiling, behavioural analytics, large scale community features or special category data such as health records.
How do I implement Joomla compliantly?
Host inside the EEA, enable the Joomla Privacy component and Privacy Consent plugin, replace Google reCAPTCHA with a privacy friendly captcha, audit every extension that loads remote scripts, and use a consent management platform to gate analytics, embedded media and social widgets until consent is granted.
Are there privacy friendlier alternatives to Joomla?
For lightweight CMS workloads, alternatives include WordPress with hardened privacy plugins, Drupal, Statamic, Craft CMS or ProcessWire. The choice usually depends on developer skills and required extensions rather than a fundamentally different baseline privacy posture.
How do I update my cookie policy for Joomla?
Run a fresh cookie scan after enabling or updating any plugin or extension, list every cookie set by Joomla core and the extensions with name, purpose, duration and provider, and link to the privacy notices of any third party services such as Google reCAPTCHA or embedded videos integrated through Joomla.
Salesforce Experience Cloud
Salesforce Experience Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Salesforce Experience Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Salesforce Experience Cloud ensures optimal performance at scale.
Percussion
Percussion is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Percussion integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Percussion helps organizations maintain robust websites that meet user expectations and technical requirements.
Absorb
Absorb is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Absorb supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Absorb ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Hocalwire
Hocalwire is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Hocalwire integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Hocalwire helps organizations maintain robust websites that meet user expectations and technical requirements.
Metro CreativeX
Metro CreativeX is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Metro CreativeX integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Metro CreativeX helps organizations maintain robust websites that meet user expectations and.
Onepage
Onepage is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Onepage supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Onepage enables informed decisions that improve experience and drive results.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.