> How PencilBlue, the self hosted Node.js CMS, handles cookies, GDPR and ePrivacy. Its login session cookie is strictly necessary, so no consent banner is > > Canonical: https://www.flowconsent.com/en/services/cms/pencilblue CMS # PencilBlue Unclassified · [Official website](https://github.com/pencilblue/pencilblue) PencilBlue is an open source, self hosted Node.js content management system that stores content in MongoDB and uses a first party session cookie to keep administrators and logged in users signed in. [Block PencilBlue until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 1 - Third-party domains 1 - Servers Self hosted (on the operator own server) Overview ## What does PencilBlue do? PencilBlue is an open source content management system and blogging platform built on Node.js. Because it is self hosted on the operator own server and stores all content in a MongoDB database, the operator stays in full control of the data, the infrastructure and the privacy posture of the site. ## **What PencilBlue is** PencilBlue is a full stack publishing platform for Node.js, offering pages, articles, media, a plugin framework and server cluster management. It runs on infrastructure that the operator owns or rents, which means there is no vendor account and no managed cloud service sitting between the operator and the website visitors. ## **Data and cookies** By default PencilBlue sets a first party session cookie so that authenticated administrators and logged in users stay signed in across requests. This cookie is technical and functional in nature. Out of the box PencilBlue does not load third party advertising networks, analytics scripts or social trackers, so the only personal data processed is what the operator chooses to collect through forms, accounts or content. ## **GDPR and ePrivacy implications** Under the ePrivacy Directive, a cookie that is strictly necessary to deliver a service the user has explicitly requested, such as keeping a login session active, is exempt from prior consent under Article 5(3). The PencilBlue session cookie falls into this category. However, any analytics, embeds or advertising plugins that the operator chooses to install would fall outside this exemption and would need their own legal basis and, where applicable, prior consent. ## **Consent requirements** For a default PencilBlue installation no consent banner is required, because the session cookie is strictly necessary and the operator does not rely on consent for it. The appropriate legal basis for running the CMS and keeping users signed in is the legitimate interest of the operator under Article 6(1)(f) GDPR. If the operator later adds non essential cookies or third party services, a consent mechanism must be put in place before those technologies are activated. ## **Data transfers** Because PencilBlue is self hosted, by default no personal data is transferred to third parties or outside the operator own infrastructure. There is no transfer to a third country unless the operator deliberately hosts the server abroad or connects external services. This makes PencilBlue a low risk component from an international data transfer perspective. ## **Practical compliance steps** The operator should document the session cookie in the privacy and cookie policy, keep the server and PencilBlue version patched, and restrict administrator access. Before installing any plugin that loads external resources or sets additional cookies, the operator should assess its privacy impact and add a consent layer if needed. Keeping the deployment first party and self contained is the simplest way to stay compliant. Compliance ## PencilBlue and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) and the strictly necessary cookie exemption for the login session - Risk level low - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) PencilBlue is a first party, self hosted CMS, so the operator controls all data and infrastructure. A full DPIA is usually not required for a standard blog or website, but the operator should document the login session cookie and review any plugins or embeds added later. If the site processes special category data or large scale profiling, a DPIA may become necessary. ### Sample text for your banner > This site uses a strictly necessary session cookie to keep you signed in, and we do not set advertising or analytics cookies without your consent. Cookies and trackers ## What PencilBlue sets and contacts - Tracking method First party session cookie for authenticated users, self hosted CMS - Server location Self hosted (on the operator own server) ### Cookies set (1) | Name | Type | Duration | Purpose | | ------- | ------------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | session | Strictly necessary | Session | First party session cookie that keeps authenticated administrators and logged in users signed in across requests. It is functional and required to operate the PencilBlue admin and user login. | ### Third-party domains contacted (1) - `pencilblue.org` Questions ## Frequently asked questions about PencilBlue Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does PencilBlue set? By default PencilBlue sets a first party session cookie that keeps authenticated administrators and logged in users signed in across requests. It is a strictly necessary, functional cookie and out of the box PencilBlue does not load third party advertising or analytics cookies. ### Is consent required for PencilBlue? No consent banner is required for the PencilBlue login session cookie, because it is strictly necessary and exempt under Article 5(3) of the ePrivacy Directive. Consent only becomes necessary if the operator adds non essential cookies, analytics or third party embeds. ### What is the legal basis for using PencilBlue? Running the self hosted CMS and keeping users signed in relies on the legitimate interest of the operator under Article 6(1)(f) GDPR, combined with the strictly necessary cookie exemption for the session cookie. Any additional processing the operator adds would need its own legal basis. ### Does PencilBlue transfer data to third countries? No. Because PencilBlue is self hosted, by default no personal data is transferred to third parties or outside the operator own infrastructure. A transfer would only occur if the operator deliberately hosts the server abroad or connects external services. ### Is a DPIA needed for PencilBlue? For a standard self hosted blog or website a full DPIA is usually not required, since PencilBlue is a low risk, first party component. A DPIA may become necessary if the operator processes special category data, performs large scale profiling or adds high risk plugins. ### How do I implement PencilBlue compliantly? Document the session cookie in your privacy and cookie policy, keep the server and PencilBlue version patched, and restrict administrator access. Before installing any plugin that loads external resources or sets extra cookies, assess its privacy impact and add a consent layer where needed. ### What are some alternatives to PencilBlue? Other content platforms include Ghost, Strapi and WordPress. Each has its own hosting model and privacy profile, so the operator should compare cookies, third party calls and data transfers before choosing, especially when considering managed cloud versions. ### Do I need to update my cookie policy for PencilBlue? Yes, you should mention the strictly necessary session cookie in your cookie policy for transparency, even though it does not require consent. If you later add analytics or third party services, update the policy and consent mechanism accordingly. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [Sqwiz](https://www.flowconsent.com/en/services/cms/sqwiz) [Sqwiz is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Sqwiz offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Sqwiz empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/sqwiz) [Analytics](https://www.flowconsent.com/en/services/cms/sqwiz) · ### [Cryout Creations Fluida](https://www.flowconsent.com/en/services/cms/cryout-creations-fluida) [Cryout Creations Fluida is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Cryout Creations Fluida supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Cryout Creations Fluida remains a leading web.](https://www.flowconsent.com/en/services/cms/cryout-creations-fluida) [CMS](https://www.flowconsent.com/en/services/cms/cryout-creations-fluida) · ### [RBS Change](https://www.flowconsent.com/en/services/cms/rbs-change) [RBS Change is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. RBS Change supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, RBS Change ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/rbs-change) [CMS](https://www.flowconsent.com/en/services/cms/rbs-change) · ### [ikiwiki](https://www.flowconsent.com/en/services/cms/ikiwiki) [ikiwiki is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ikiwiki supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ikiwiki ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/ikiwiki) [CMS](https://www.flowconsent.com/en/services/cms/ikiwiki) · ### [Motive](https://www.flowconsent.com/en/services/cms/motive) [Motive is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Motive supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Motive enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/cms/motive) [CMS](https://www.flowconsent.com/en/services/cms/motive) · ### [Edwiser Bridge](https://www.flowconsent.com/en/services/cms/edwiser-bridge) [Edwiser Bridge is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Edwiser Bridge supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Edwiser Bridge ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/edwiser-bridge) [CMS](https://www.flowconsent.com/en/services/cms/edwiser-bridge) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)