> Prismic and the GDPR: French headless CMS, cookieless Content API, Preview cookie for editors and Schrems II questions when content is stored in the US. > > Canonical: https://www.flowconsent.com/en/services/cms/prismic CMS # Prismic Unclassified · [Official website](https://prismic.io) Prismic is a French headless CMS founded in Paris. Editors author content with Slice Machine and the published JSON is delivered through a Content API. The public delivery is cookieless and GDPR friendly, only editor authentication and the optional Preview feature set cookies. [Block Prismic until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 5 - Servers Prismic SAS (Paris, France). Hosting on Amazon Web Services with deployment in EU (Frankfurt) and US (us east 1 Virginia) regions, plus a global Cloudflare CDN for asset delivery. Editorial backend at prismic.io is operated from the United States by default with EU regions available. Overview ## What does Prismic do? ## **What Prismic is and how it serves content** Prismic is a headless CMS founded in Paris in 2013 by Prismic SAS. It uses a slice based composition model: developers define Slices (reusable components) in Slice Machine and editors arrange them in the page builder. The published content is served as JSON via the Content API. The frontend, often built with Next.js, Nuxt, SvelteKit or any framework, fetches the JSON server side or client side and renders the HTML. ## **Cookies and identifiers set on visitors** On the public website Prismic sets no cookies. The Content API and the asset CDN respond with JSON or media without writing identifiers on the visitor browser. Cookies appear in two editor contexts. The prismic.io application uses a session cookie to authenticate editors. The Preview feature, when an editor activates it from prismic.io, sets a short lived io.prismic.preview cookie on the customer site so that the editor sees the draft version of the page. That cookie disappears once preview is exited and is never set on a non editor session. ## **GDPR and ePrivacy implications** Because the Prismic public delivery does not store any identifier on the visitor terminal, Article 5(3) of the ePrivacy Directive does not require prior consent. Article 6(1)(f) GDPR (legitimate interest) covers the limited request logs at the CDN. Prismic SAS acts as processor under Article 28 GDPR with a DPA available in the dashboard. The Preview cookie used by editors is strictly necessary and falls under the ePrivacy carveout for technical cookies. ## **Data transfers and Schrems II** Content is stored on AWS, by default in regions chosen during space creation, with EU options available on higher plans. The prismic.io editor application and customer login portal are operated from the US, which involves a transfer covered by Standard Contractual Clauses and the EU US Data Privacy Framework. The asset CDN is global via Cloudflare. For strict EU only requirements, contact Prismic about regional pinning options for content storage. ## **Practical compliance steps** Sign the Prismic DPA and document the processor in your RoPA. Enable SSO and 2FA for editor accounts. Limit Preview access to authorized editors and audit the io.prismic.preview cookie occurrences. Restrict API tokens by repository and permission scope. Make sure your frontend gates any third party tracker (Google Analytics, Meta Pixel, video) behind a consent management platform. Disclose the EU US data transfer for editor flows in your privacy policy. Compliance ## Prismic and the GDPR - Legal basis Article 6(1)(f) GDPR (legitimate interest) for content delivery and abuse prevention. The preview cookie used by editors is strictly necessary. No consent required for the public delivery. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, DSGVO, RGPD, LSSI, Schrems II for editor flows routed through the US ### Impact assessment (DPIA) A DPIA is generally not needed for public Prismic content delivery. It should be considered if Prismic is combined with personalization, profiling or user generated content, or when content storage is configured in the US region for European visitors. Document the EU region selection (if available on your plan), the DPA with Prismic SAS and the access controls on the editor interface. ### Sample text for your banner > This website uses Prismic to deliver editorial content. The Prismic Content API does not set cookies on visitors. No consent is required. Authentication and preview cookies only apply to editors logged into prismic.io. Cookies and trackers ## What Prismic sets and contacts - Tracking method Headless CMS with content modeled in Slice Machine and delivered via a REST and GraphQL Content API over HTTPS. The frontend fetches JSON, no cookies are set on visitors. Editors use prismic.io which sets session cookies. Prismic also includes a Preview feature that, when activated, sets a temporary preview cookie for editors to see drafts on the live site. - Server location Prismic SAS (Paris, France). Hosting on Amazon Web Services with deployment in EU (Frankfurt) and US (us east 1 Virginia) regions, plus a global Cloudflare CDN for asset delivery. Editorial backend at prismic.io is operated from the United States by default with EU regions available. - Cookieless mode available Yes - Data transferred outside the EU Prismic content storage is multi region and editor login can route through US infrastructure. The asset CDN (cdn.prismic.io, images.prismic.io) is served globally by Cloudflare. The published content API serves data without setting any cookie on visitors. For European projects an enterprise plan offers EU region pinning. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------------------- | --------------------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | io.prismic.preview | first-party (editor preview only) | Up to 30 minutes | Temporary cookie set when a logged in editor activates Preview from prismic.io to render the draft version of the page. Removed when preview is exited. Strictly necessary. | | prismic-auth | first-party (prismic.io only) | Session | Authenticates an editor on the prismic.io application. Not set on customer websites. | | io.prismic.previewSession | first-party (preview UUID) | Session | Stores the preview session UUID used by the Prismic preview backend. Set only during an active Preview, never on anonymous visitors. | ### Third-party domains contacted (5) - `prismic.io` - `cdn.prismic.io` - `images.prismic.io` - `asset.prismic.io` - `static.cdn.prismic.io` Questions ## Frequently asked questions about Prismic Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Prismic set cookies on website visitors? No. The public Prismic Content API and asset CDN deliver JSON and media without setting cookies on visitors. The only cookies are io.prismic.preview (temporary, set for logged in editors when Preview is active) and session cookies on prismic.io for editor authentication. ### Do I need consent for Prismic under GDPR and ePrivacy? No consent is needed for the public Prismic delivery because no identifier is written on the visitor terminal. The editor only Preview cookie is strictly necessary. Consent only applies to third party scripts you embed in your frontend through Prismic content. ### What is the legal basis for processing visitor data with Prismic? Article 6(1)(f) GDPR (legitimate interest) covers the request logs needed for content delivery and abuse prevention. Prismic SAS is a processor under Article 28 GDPR with a DPA available in the dashboard. ### Does Prismic transfer data to the United States? The prismic.io editor application and customer portal are operated from the United States. Content storage runs on AWS in the region chosen during space creation. Transfers are covered by Standard Contractual Clauses and the EU US Data Privacy Framework. Disclose this transfer in your privacy policy. ### Is a DPIA required for Prismic? A DPIA is generally not required for a public editorial deployment because no visitor profiling happens. It is recommended when Prismic is combined with personalization, AI features, large volumes of user generated content or sensitive data. ### How do I implement Prismic compliantly? Sign the Prismic DPA, enable SSO and 2FA for editors, restrict API tokens by repository and scope, limit Preview access to authorized editors, document the processor in your RoPA and govern third party scripts in your frontend through a consent management platform. ### What are the alternatives to Prismic? EU headless CMS alternatives include Storyblok (Austria), Strapi (France), Contentful (Germany), Hygraph (Germany), Sanity (Norway), Directus (open source) and Payload CMS (open source). ### How do I update the cookie policy for Prismic? List Prismic as a content processor in your privacy policy with hosting region, purpose and DPA reference. Mention the editor only io.prismic.preview cookie if your privacy policy details strictly necessary cookies. The public site can omit Prismic from the cookie banner because no cookies are placed on regular visitors. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [Storyblok](https://www.flowconsent.com/en/services/cms/storyblok) [Storyblok is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Storyblok integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Storyblok helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/storyblok) [CMS](https://www.flowconsent.com/en/services/cms/storyblok) · ### [Thrillshare](https://www.flowconsent.com/en/services/cms/thrillshare) [Thrillshare is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Thrillshare supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Thrillshare ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/thrillshare) [CMS](https://www.flowconsent.com/en/services/cms/thrillshare) · ### [Greyd.Suite](https://www.flowconsent.com/en/services/cms/greyd-suite) [Greyd.Suite is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Greyd.Suite supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Greyd.Suite enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/cms/greyd-suite) [Analytics](https://www.flowconsent.com/en/services/cms/greyd-suite) · ### [GX WebManager](https://www.flowconsent.com/en/services/cms/gx-webmanager) [GX WebManager is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GX WebManager supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GX WebManager ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/gx-webmanager) [CMS](https://www.flowconsent.com/en/services/cms/gx-webmanager) · ### [Liana](https://www.flowconsent.com/en/services/cms/liana) [Liana offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Liana integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for sustainable growth.](https://www.flowconsent.com/en/services/cms/liana) [CMS](https://www.flowconsent.com/en/services/cms/liana) · ### [BigTree CMS](https://www.flowconsent.com/en/services/cms/bigtree-cms) [BigTree CMS provides a robust content management platform that enables organizations to create, organize, and distribute web content efficiently. Built with scalability and performance in mind, BigTree CMS supports multi-site management, role-based access control, and advanced publishing workflows. Whether running a corporate website or a complex digital portal, BigTree CMS delivers the flexibility and reliability needed to manage content at scale while maintaining optimal page load speeds and search.](https://www.flowconsent.com/en/services/cms/bigtree-cms) [CMS](https://www.flowconsent.com/en/services/cms/bigtree-cms) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)