> How Neos CMS handles cookies, sessions and editor data under GDPR and ePrivacy. Practical compliance steps for EU operators of Neos powered websites. > > Canonical: https://www.flowconsent.com/en/services/cms/neos-cms CMS # Neos CMS Unclassified · [Official website](https://neos.io) Neos is an open source enterprise content management system focused on editorial flexibility, structured content, and self hosted GDPR friendly publishing. [Block Neos CMS until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 3 - Servers Self-hosted (operator chosen): commonly Germany or other EU data centres for European deployments Overview ## What does Neos CMS do? ## **What Neos CMS is** Neos is an open source content management system written in PHP and used widely across Europe to power corporate websites, magazines, intranets and multi site networks. The platform is self hosted, which means the operator chooses the hosting region, the database location and the server stack. For European publishers Neos is often deployed in Germany, the Netherlands or France, which keeps personal data inside the European Economic Area by default. ## **Cookies and data set by Neos** In a vanilla configuration Neos only sets a small number of strictly necessary cookies. A PHP session identifier maintains the editorial backend session and any logged in member area. A CSRF token cookie protects forms against cross site request forgery. The frontend itself does not load any third party tag, fingerprinting library or analytics script unless the operator explicitly installs a package that does so. ## **GDPR and ePrivacy implications** Strictly necessary session and security cookies do not require prior consent under article 5(3) of the ePrivacy Directive. They can be relied upon under legitimate interest, article 6(1)(f) GDPR. As soon as Neos is extended with analytics, A/B testing, embedded videos, social plugins or marketing automation, those modules become subject to consent and must be blocked until the visitor has accepted the relevant categories. ## **Consent and configuration** For a Neos site that only serves editorial content, a privacy notice describing session and CSRF cookies is sufficient. For a site that adds analytics or third party services, integrate a consent management platform that gates the relevant scripts and store the consent record server side or in a first party cookie. Editor accounts in the backend should be treated as employee data and protected with strong authentication and limited retention of activity logs. ## **Data transfers and hosting** Because Neos is self hosted, third country transfers only occur if the operator selects a non EU hosting provider, uses a CDN with US points of presence without proper safeguards, or integrates third party services such as US based analytics or fonts. To stay clearly inside the EEA, choose an EU hosting region, host fonts and assets locally, and document any sub processor in the records of processing activities. ## **Practical compliance steps** Document the Neos cookies in your cookie policy, list any installed packages that process personal data, configure your CMP to block non essential scripts before consent, restrict editor access on a least privilege basis, and review installed plugins regularly to confirm none of them silently load tracking pixels. Compliance ## Neos CMS and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for strictly necessary session and CSRF cookies; consent (Art. 6(1)(a)) required if optional analytics or third party modules are added - Risk level low - Applicable regulations GDPR, ePrivacy Directive, BDSG (DE), TTDSG (DE), LGPD ### Impact assessment (DPIA) A DPIA is generally not required for a vanilla Neos installation that only uses session and CSRF cookies. A DPIA becomes relevant when operators add analytics, marketing, profiling or AI modules, when Neos hosts large volumes of personal data such as member areas, or when content is hosted outside the EU. ### Sample text for your banner > This website is powered by the Neos CMS open source platform. Strictly necessary session and security cookies are set so the site can function. No tracking or analytics cookies are used unless you accept them in the cookie banner. Cookies and trackers ## What Neos CMS sets and contacts - Tracking method Server-side rendered HTML pages with optional client-side JavaScript modules; sessions managed via PHP session cookies and CSRF tokens - Server location Self-hosted (operator chosen): commonly Germany or other EU data centres for European deployments ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------------------ | ------------------ | -------- | -------------------------------------------------------------------------------------------- | | Neos\_Flow\_Session | Strictly necessary | Session | Maintains the editor or member session in the Neos backend and on protected frontend pages. | | TYPO3\_Flow\_CSRF\_Token | Strictly necessary | Session | Stores an anti CSRF token used to validate form submissions in the Neos editorial interface. | | NEOS\_PREVIEW\_MODE | Strictly necessary | Session | Remembers the editor preview mode chosen for previewing unpublished content. | ### Third-party domains contacted (3) - `neos.io` - `docs.neos.io` - `packagist.org` Questions ## Frequently asked questions about Neos CMS Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Neos CMS set by default? A vanilla Neos installation only sets a PHP session cookie that keeps editors signed in to the backend and an anti CSRF token cookie that protects forms. No analytics or advertising cookies are dropped unless an operator installs a package that does so. ### Do I need consent to run a Neos powered website? No. The default session and security cookies are strictly necessary and can rely on legitimate interest under the GDPR. Consent only becomes required if you add analytics, A/B testing, marketing or third party embeds to your Neos installation. ### What is the legal basis for processing data through Neos? Legitimate interest, article 6(1)(f) GDPR, covers the strictly necessary cookies and the editorial workflow. Editor accounts are processed on the basis of the contract with the operator, while any added analytics or marketing module must rely on consent, article 6(1)(a). ### Does Neos transfer data to the United States? Not by itself. Neos is self hosted and stores data wherever the operator chooses. Transfers only occur if the operator selects a non EU host, a US based CDN, or third party services that send data outside the EEA. ### Do I need a DPIA for Neos CMS? A DPIA is usually not required for a content only installation. It becomes appropriate when Neos hosts large member areas, when added modules profile users, or when content is deployed via providers outside the EEA. ### How do I implement Neos compliance correctly? Use an EU host, host fonts and assets locally, document the session and CSRF cookies in your privacy notice, and integrate a CMP that blocks any non essential script before consent. Keep editor accounts on least privilege and rotate credentials regularly. ### What are alternatives to Neos CMS? Other self hostable CMSs that fit a similar privacy posture include TYPO3, Drupal, Statamic, Strapi and Directus. Each has its own cookie footprint, so review their default cookies before switching. ### How should I update my cookie policy when I deploy Neos? List the strictly necessary session and CSRF cookies with their purpose and lifetime, mention any installed Neos package that introduces additional cookies, name your hosting provider, and update the policy whenever you add an analytics, marketing or embed module. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [rSchoolToday](https://www.flowconsent.com/en/services/cms/rschooltoday) [rSchoolToday is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. rSchoolToday integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, rSchoolToday helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/rschooltoday) [CMS](https://www.flowconsent.com/en/services/cms/rschooltoday) · ### [Taptop](https://www.flowconsent.com/en/services/cms/taptop) [Taptop is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Taptop offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Taptop empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/taptop) [Analytics](https://www.flowconsent.com/en/services/cms/taptop) · ### [Replo](https://www.flowconsent.com/en/services/cms/replo) [Replo is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Replo supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Replo enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/cms/replo) [Analytics](https://www.flowconsent.com/en/services/cms/replo) · ### [Webriti Busiprof](https://www.flowconsent.com/en/services/cms/webriti-busiprof) [Webriti Busiprof is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Webriti Busiprof supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Webriti Busiprof remains a leading web development choice.](https://www.flowconsent.com/en/services/cms/webriti-busiprof) [CMS](https://www.flowconsent.com/en/services/cms/webriti-busiprof) · ### [Rally](https://www.flowconsent.com/en/services/cms/rally) [Rally is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Rally supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Rally ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/rally) [CMS](https://www.flowconsent.com/en/services/cms/rally) · ### [CyberChimps Responsive](https://www.flowconsent.com/en/services/cms/cyberchimps-responsive) [CyberChimps Responsive is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. CyberChimps Responsive supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, CyberChimps Responsive ensures your website delivers a smooth, uninterrupted experience to every visitor and.](https://www.flowconsent.com/en/services/cms/cyberchimps-responsive) [CMS](https://www.flowconsent.com/en/services/cms/cyberchimps-responsive) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)