CMS

Sanity

Sanity is a Norwegian headless CMS built around a real time content lake. Editors work in Sanity Studio and content is delivered through REST and GROQ APIs over HTTPS. The public delivery API does not set cookies on visitors, so it is GDPR friendly by default when the EU dataset region is selected.

Block Sanity until consent Scan my site

Overview

What does Sanity do?

What Sanity is and how it serves content

Sanity is a headless content platform founded in Oslo, Norway in 2015 by Sanity.io AS. It is built around a real time content lake. Editors author structured content in Sanity Studio, a React based editing UI usually hosted by the customer or on sanity.studio. The published content is queried by the frontend via REST or the GROQ query language and delivered through the Sanity CDN. Like other modern headless platforms, the public delivery is stateless and cookie free.

Cookies and identifiers set on visitors

On the public website Sanity sets no cookies. The content delivery responses only contain JSON and standard cache headers. Cookies appear in three editor only contexts. The Sanity Studio uses a session cookie to authenticate editors. The sanity.io account portal sets an authentication cookie for the dashboard. Sanity Insights, when enabled in the Studio for project owners, may use Plausible Analytics for usage statistics, scoped to the Studio domain.

GDPR and ePrivacy implications

Because the public Sanity API does not place identifiers on the visitor terminal, Article 5(3) of the ePrivacy Directive does not require prior consent. Article 6(1)(f) GDPR (legitimate interest) covers the limited request metadata processed at the CDN edge. Sanity.io AS acts as a processor under Article 28 GDPR when storing the customer content. The DPA is available in the Sanity dashboard and the corporate entity in Oslo provides additional comfort regarding GDPR enforcement.

Data transfers and Schrems II

Sanity offers a EU dataset region (Frankfurt) and a US dataset region (Iowa). For European projects, create the dataset with the EU region. The dataset region cannot be changed after creation without an export and import. The corporate sanity.io login portal and some support tools may route requests through the United States. Plausible Analytics used by Sanity Insights is operated from the EU (Germany) which avoids US transfers for that telemetry.

Practical compliance steps

Create the production dataset in the EU region. Sign the Sanity DPA. Document the processor in your RoPA with dataset name, region, retention and the asset CDN. Host the Sanity Studio on your own domain behind authentication (SSO via Google, GitHub, SAML). Restrict the API tokens by dataset and permission scope. Use the read only published view client for the public site instead of admin tokens. If you embed third party scripts in your frontend, gate them with a consent management platform, the Sanity delivery itself is out of scope.

Compliance

Sanity and the GDPR

Legal basis: Article 6(1)(f) GDPR (legitimate interest) for content delivery and abuse prevention. Strictly necessary cookies are used in Sanity Studio for editor authentication. No consent required for the public API.
Risk level: low
Applicable regulations: GDPR, ePrivacy Directive, Norwegian Personal Data Act, DSGVO, RGPD, LSSI, Schrems II only when the US dataset region or US asset CDN endpoints are selected

Impact assessment (DPIA)

A DPIA is not required for the public delivery API in most cases as no personal data is processed on visitors beyond standard request logs. A DPIA should be considered when Sanity is paired with Sanity Insights, personalization features, user generated content, or when special category data is stored in the content lake. Document the EU region selection, the DPA signed with Sanity.io AS and the access controls on Sanity Studio.

Sample text for your banner

This website uses Sanity to deliver editorial content. The Sanity API does not set cookies and does not track visitors. No consent is required. Authentication cookies only apply to editors signed into Sanity Studio.

Cookies and trackers

What Sanity sets and contacts

Tracking method: Headless CMS with a real time content lake exposed via REST and GROQ APIs over HTTPS, plus the Studio (editor UI) that authenticates editors with an OAuth2 session cookie. The public API does not set cookies on website visitors. Optional Sanity Vision and Sanity Insights are admin tools and do not run on the public website.
Server location: Sanity.io AS (Oslo, Norway). The content lake runs on Google Cloud Platform with regions in the EU (eu central 1 Frankfurt) and the US (us central 1 Iowa). Asset CDN by Google Cloud CDN with global PoPs. Sanity Studio is typically hosted by the customer or on sanity.studio.
Cookieless mode available: Yes

Cookies set (3)

Name	Type	Duration	Purpose
sanitySession	first-party (Sanity Studio only)	Session	Session cookie used inside Sanity Studio to authenticate a logged in editor. Strictly necessary, never set on the public website.
sanity-management-token	first-party (account portal only)	Up to 30 days	Authentication token for the sanity.io account portal. Strictly necessary for the customer dashboard, not present on public websites.
sb_anon	first-party (Studio analytics)	30 days	Anonymous identifier optionally set by Plausible Analytics inside Sanity Insights when the project owner enables Studio usage tracking. Scoped to the Studio domain.

Third-party domains contacted (6)

sanity.io
api.sanity.io
apicdn.sanity.io
cdn.sanity.io
sanity.studio
sanity.work

Questions

Frequently asked questions about Sanity

Can't find your question? Write to us, we answer fast.

Write to us

Does Sanity set cookies on website visitors?

No. The public Sanity REST and GROQ APIs deliver JSON without any cookies. Cookies only appear in Sanity Studio (editor session), in the sanity.io account portal, and optionally in Plausible Analytics inside Sanity Insights, all of which are editor side and never visible to the website visitor.

Do I need consent for Sanity under GDPR and ePrivacy?

No consent is required for the public Sanity delivery because no identifier is stored on the visitor terminal. Consent only becomes relevant if your frontend embeds third party trackers whose content was fed by Sanity.

What is the legal basis for processing visitor data with Sanity?

Article 6(1)(f) GDPR (legitimate interest) covers the request metadata processed for content delivery and security. The customer is the controller of the content stored in Sanity. Sanity.io AS is a processor under Article 28 GDPR with a DPA available in the dashboard.

Does Sanity transfer data to the United States?

Not when the EU dataset region is selected, the content lake stays in Frankfurt and the asset CDN serves from Google Cloud EU regions. The US dataset region (Iowa) is optional. The sanity.io login portal may route through US infrastructure for the editor flow.

Is a DPIA required for Sanity?

A DPIA is not generally required for a public editorial deployment. It should be considered when Sanity stores sensitive content, when Sanity Insights is enabled, when personalization or A/B testing is layered on top, or when the US dataset region is used.

How do I implement Sanity compliantly?

Create the dataset in the EU region, sign the DPA, host Sanity Studio on your own domain with SSO, restrict API tokens by permission scope, document the processor in your RoPA, use a read only client for the public site and govern any third party scripts in the frontend through a consent management platform.

What are the alternatives to Sanity?

Other headless CMS options used in Europe include Storyblok (Austria), Strapi (France), Contentful (Germany), Hygraph (Germany), Directus (Germany, open source), Payload CMS (open source) and Wagtail (Python, open source).

How do I update the cookie policy for Sanity?

No Sanity specific cookie disclosure is needed for the public site when no cookies are set. List Sanity as the content processor in your privacy policy with the dataset region, purpose, retention and DPA reference. Editor only cookies inside Sanity Studio do not need to appear in the public cookie banner.

Alinea

Alinea is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Alinea integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Alinea helps organizations maintain robust websites that meet user expectations and technical requirements.

CMS

Brizy

Brizy is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Brizy supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Brizy enables informed decisions that improve experience and drive results.

CMS

RDoc

RDoc is a backend web framework providing a structured environment for building robust server-side applications and APIs. It offers routing, database management, authentication, and middleware support. RDoc follows established design patterns and conventions promoting clean, maintainable code. With ORM integration, template engines, and security features, RDoc accelerates backend development and enables teams to deliver scalable web applications efficiently.

CMS

Appy Pie Builder

Appy Pie Builder is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Appy Pie Builder supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Appy Pie Builder enables informed decisions that improve experience and drive results.

Analytics

ExtendThemes Highlight

ExtendThemes Highlight is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ExtendThemes Highlight supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ExtendThemes Highlight ensures your website delivers a smooth, uninterrupted experience to every visitor and.

CMS

Twenty Twenty

Twenty Twenty is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Twenty Twenty supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Twenty Twenty remains a leading web development choice.

CMS

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my banner Scan my site