FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
CMS

Neos CMS

UnclassifiedOfficial website

Neos is an open source enterprise content management system focused on editorial flexibility, structured content, and self hosted GDPR friendly publishing.

Block Neos CMS until consentScan my site
Overview

What does Neos CMS do?

What Neos CMS is

Neos is an open source content management system written in PHP and used widely across Europe to power corporate websites, magazines, intranets and multi site networks. The platform is self hosted, which means the operator chooses the hosting region, the database location and the server stack. For European publishers Neos is often deployed in Germany, the Netherlands or France, which keeps personal data inside the European Economic Area by default.

Cookies and data set by Neos

In a vanilla configuration Neos only sets a small number of strictly necessary cookies. A PHP session identifier maintains the editorial backend session and any logged in member area. A CSRF token cookie protects forms against cross site request forgery. The frontend itself does not load any third party tag, fingerprinting library or analytics script unless the operator explicitly installs a package that does so.

GDPR and ePrivacy implications

Strictly necessary session and security cookies do not require prior consent under article 5(3) of the ePrivacy Directive. They can be relied upon under legitimate interest, article 6(1)(f) GDPR. As soon as Neos is extended with analytics, A/B testing, embedded videos, social plugins or marketing automation, those modules become subject to consent and must be blocked until the visitor has accepted the relevant categories.

Consent and configuration

For a Neos site that only serves editorial content, a privacy notice describing session and CSRF cookies is sufficient. For a site that adds analytics or third party services, integrate a consent management platform that gates the relevant scripts and store the consent record server side or in a first party cookie. Editor accounts in the backend should be treated as employee data and protected with strong authentication and limited retention of activity logs.

Data transfers and hosting

Because Neos is self hosted, third country transfers only occur if the operator selects a non EU hosting provider, uses a CDN with US points of presence without proper safeguards, or integrates third party services such as US based analytics or fonts. To stay clearly inside the EEA, choose an EU hosting region, host fonts and assets locally, and document any sub processor in the records of processing activities.

Practical compliance steps

Document the Neos cookies in your cookie policy, list any installed packages that process personal data, configure your CMP to block non essential scripts before consent, restrict editor access on a least privilege basis, and review installed plugins regularly to confirm none of them silently load tracking pixels.

Compliance

Neos CMS and the GDPR

Legal basis
Legitimate interest (Art. 6(1)(f) GDPR) for strictly necessary session and CSRF cookies; consent (Art. 6(1)(a)) required if optional analytics or third party modules are added
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, BDSG (DE), TTDSG (DE), LGPD

Impact assessment (DPIA)

A DPIA is generally not required for a vanilla Neos installation that only uses session and CSRF cookies. A DPIA becomes relevant when operators add analytics, marketing, profiling or AI modules, when Neos hosts large volumes of personal data such as member areas, or when content is hosted outside the EU.

Sample text for your banner

This website is powered by the Neos CMS open source platform. Strictly necessary session and security cookies are set so the site can function. No tracking or analytics cookies are used unless you accept them in the cookie banner.
Cookies and trackers

What Neos CMS sets and contacts

Tracking method
Server-side rendered HTML pages with optional client-side JavaScript modules; sessions managed via PHP session cookies and CSRF tokens
Server location
Self-hosted (operator chosen): commonly Germany or other EU data centres for European deployments

Cookies set (3)

NameTypeDurationPurpose
Neos_Flow_SessionStrictly necessarySessionMaintains the editor or member session in the Neos backend and on protected frontend pages.
TYPO3_Flow_CSRF_TokenStrictly necessarySessionStores an anti CSRF token used to validate form submissions in the Neos editorial interface.
NEOS_PREVIEW_MODEStrictly necessarySessionRemembers the editor preview mode chosen for previewing unpublished content.

Third-party domains contacted (3)

  • neos.io
  • docs.neos.io
  • packagist.org
Questions

Frequently asked questions about Neos CMS

Can't find your question? Write to us, we answer fast.

What cookies does Neos CMS set by default?

A vanilla Neos installation only sets a PHP session cookie that keeps editors signed in to the backend and an anti CSRF token cookie that protects forms. No analytics or advertising cookies are dropped unless an operator installs a package that does so.

Do I need consent to run a Neos powered website?

No. The default session and security cookies are strictly necessary and can rely on legitimate interest under the GDPR. Consent only becomes required if you add analytics, A/B testing, marketing or third party embeds to your Neos installation.

What is the legal basis for processing data through Neos?

Legitimate interest, article 6(1)(f) GDPR, covers the strictly necessary cookies and the editorial workflow. Editor accounts are processed on the basis of the contract with the operator, while any added analytics or marketing module must rely on consent, article 6(1)(a).

Does Neos transfer data to the United States?

Not by itself. Neos is self hosted and stores data wherever the operator chooses. Transfers only occur if the operator selects a non EU host, a US based CDN, or third party services that send data outside the EEA.

Do I need a DPIA for Neos CMS?

A DPIA is usually not required for a content only installation. It becomes appropriate when Neos hosts large member areas, when added modules profile users, or when content is deployed via providers outside the EEA.

How do I implement Neos compliance correctly?

Use an EU host, host fonts and assets locally, document the session and CSRF cookies in your privacy notice, and integrate a CMP that blocks any non essential script before consent. Keep editor accounts on least privilege and rotate credentials regularly.

What are alternatives to Neos CMS?

Other self hostable CMSs that fit a similar privacy posture include TYPO3, Drupal, Statamic, Strapi and Directus. Each has its own cookie footprint, so review their default cookies before switching.

How should I update my cookie policy when I deploy Neos?

List the strictly necessary session and CSRF cookies with their purpose and lifetime, mention any installed Neos package that introduces additional cookies, name your hosting provider, and update the policy whenever you add an analytics, marketing or embed module.

Same category

More services: CMS

See the whole category

rSchoolToday

rSchoolToday is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. rSchoolToday integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, rSchoolToday helps organizations maintain robust websites that meet user expectations and technical requirements.

CMS

Taptop

Taptop is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Taptop offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Taptop empowers organizations to optimize strategy and maximize return on investment.

Analytics

Replo

Replo is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Replo supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Replo enables informed decisions that improve experience and drive results.

Analytics

Webriti Busiprof

Webriti Busiprof is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Webriti Busiprof supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Webriti Busiprof remains a leading web development choice.

CMS

Rally

Rally is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Rally supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Rally ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

CyberChimps Responsive

CyberChimps Responsive is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. CyberChimps Responsive supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, CyberChimps Responsive ensures your website delivers a smooth, uninterrupted experience to every visitor and.

CMS

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site