Sitecore
Sitecore is an enterprise digital experience platform headquartered in Canada. The classic Sitecore XP can set visitor analytics cookies on the public site through xDB, while Sitecore XM Cloud is headless and only sets cookies through xConnect or Sitecore CDP/Personalize when those add ons are enabled. Consent management is required when those tracking features are active.
What does Sitecore do?
What Sitecore is and how it serves content
Sitecore is an enterprise digital experience platform from Sitecore Holdings (Toronto, Canada). The product family includes Sitecore XP (classic content management with the xDB analytics database), Sitecore XM and XM Cloud (modern composable headless), Sitecore CDP, Sitecore Personalize, Sitecore Content Hub and Sitecore Send. Pages are rendered server side on .NET or fetched via the Experience Edge GraphQL API in the headless XM Cloud model. Sitecore is positioned for large brands needing deep personalization.
Cookies and identifiers set on visitors
Sitecore XP with xDB enabled sets SC_ANALYTICS_GLOBAL_COOKIE (persistent visitor identifier, default 10 years) and SC_ANALYTICS_SESSION_COOKIE (session) on the public site. The Sitecore CDP product sets a _sc_browser_id or similar identifier to merge visitor behavior across pages. Sitecore Personalize uses _bx_uuid for experimentation. The XM Cloud Experience Edge delivery itself is cookieless if no analytics or personalization is layered on top. The ASP.NET backoffice authentication cookies are strictly necessary for editors.
GDPR and ePrivacy implications
The xDB, CDP and Personalize features create persistent visitor identifiers tied to behavioral profiles, so Article 5(3) of the ePrivacy Directive requires prior opt in consent under EDPB guidelines. Article 6(1)(a) GDPR (consent) is the legal basis. The customer is controller and Sitecore is processor under Article 28 GDPR. A signed DPA is part of the Sitecore Master Subscription Agreement. The xDB retention period and the right to erasure must be configurable, Sitecore exposes APIs for both.
Data transfers and Schrems II
Sitecore Cloud services run on Microsoft Azure and EU customers should explicitly request a West Europe or North Europe deployment in the order form. Sitecore CDP and Personalize default to US infrastructure unless an EU pinning is negotiated. Sitecore corporate identity, support tooling and product analytics include US and Canada based providers covered by Standard Contractual Clauses and the EU US Data Privacy Framework. Document these transfers in your record of processing activities and your privacy notice.
Practical compliance steps
Wire Sitecore into your consent management platform with Google Consent Mode v2 or IAB TCF signals. Block xDB, CDP and Personalize tags until consent is granted. Configure xDB retention to the minimum needed for the analytics use case. Request the EU region for Sitecore CDP and Personalize. Sign the DPA. Document a procedure to honour data subject access and erasure requests via the Sitecore xConnect and CDP APIs. Restrict backoffice access to a corporate VPN with SSO and 2FA.
Sitecore and the GDPR
Sitecore is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy is required for xDB analytics cookies, Sitecore CDP visitor identifiers and Personalize experimentation tags because they go beyond strictly necessary processing. Strictly necessary cookies (ASP.NET session, antiforgery) for the editor backoffice can rely on legitimate interest.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, DSGVO, RGPD, LSSI, Canadian PIPEDA, Schrems II, EU US Data Privacy Framework, IAB TCF when integrated with consent management vendors
Impact assessment (DPIA)
A DPIA is generally recommended for Sitecore deployments that use xDB analytics, Sitecore CDP, Sitecore Personalize or Sitecore Send because they enable visitor profiling. Document the legal basis for each feature, the EU region selection, the retention period in xDB or CDP and the integration with a consent management platform that emits IAB TCF or Google Consent Mode signals.
Sample text for your banner
This website uses Sitecore as its digital experience platform. Sitecore stores analytics and personalization cookies (SC_ANALYTICS_GLOBAL_COOKIE, _sc_session) to recognize you and to deliver tailored content. You can accept or refuse these cookies via the consent banner. Refusing leaves only strictly necessary cookies.
What Sitecore sets and contacts
- Tracking method
- Enterprise digital experience platform combining content management, personalization and analytics. Sitecore Experience Platform (XP) and Sitecore Experience Manager (XM) set cookies on the public site by default (SC_ANALYTICS_GLOBAL_COOKIE, SC_ANALYTICS_SESSION_COOKIE) when xDB analytics is enabled. The modern Sitecore XM Cloud is headless and only sets cookies through xConnect or Sitecore CDP/Personalize when explicitly activated.
- Server location
- Sitecore Holdings (Toronto, Canada and San Francisco) operates Sitecore XM Cloud, Sitecore Content Hub, Sitecore Send, Sitecore CDP and Sitecore Personalize on Microsoft Azure. EU customers can request Azure West Europe (Netherlands) or North Europe (Ireland) deployments. On premise Sitecore is hosted by the customer on Windows Server with SQL Server, typically in EU data centers.
- Cookieless mode available
- Yes
- Data transferred outside the EU
- Sitecore Cloud services can be pinned to Azure West Europe or North Europe but the Sitecore corporate identity provider, support tooling and product analytics include US and Canada based infrastructure. Sitecore CDP and Personalize process visitor identifiers in the United States by default unless an EU region is explicitly negotiated. Standard Contractual Clauses are signed in the master agreement.
Cookies set (5)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| SC_ANALYTICS_GLOBAL_COOKIE | first-party (Sitecore xDB) | 10 years (default) | Persistent visitor identifier created by Sitecore xDB to merge sessions and build behavioral profiles. Requires consent under ePrivacy. |
| SC_ANALYTICS_SESSION_COOKIE | first-party (Sitecore xDB) | Session | Session identifier for the current visit in Sitecore xDB. Used together with the global cookie to capture page views and goals. |
| _sc_browser_id | first-party (Sitecore CDP) | 1 year | Browser identifier used by Sitecore CDP to merge cross device behavior. Requires consent. |
| _bx_uuid | first-party (Sitecore Personalize) | 1 year | UUID assigned by Sitecore Personalize for experimentation and audience evaluation. Requires consent. |
| .ASPXAUTH | first-party (backoffice only) | Session | ASP.NET authentication cookie for logged in editors of Sitecore XP. Strictly necessary, never set on the public site. |
Third-party domains contacted (6)
sitecore.comsitecorecloud.ioexperienceedge.sitecorecloud.ioboxever.comcdp.sitecorecloud.iocdn.boxever.com
Frequently asked questions about Sitecore
Can't find your question? Write to us, we answer fast.
Does Sitecore set cookies on website visitors?
Yes when xDB analytics, Sitecore CDP or Sitecore Personalize are activated. SC_ANALYTICS_GLOBAL_COOKIE (persistent, default 10 years) and SC_ANALYTICS_SESSION_COOKIE (session) come from xDB. Sitecore CDP and Personalize add their own identifier cookies. Without these add ons, the headless XM Cloud delivery is cookieless.
Do I need consent for Sitecore under GDPR and ePrivacy?
Yes for xDB analytics, Sitecore CDP and Personalize because they create persistent visitor profiles. Article 5(3) ePrivacy and EDPB guidelines require prior opt in consent. The strictly necessary backoffice cookies for editors do not require consent.
What is the legal basis for processing visitor data with Sitecore?
Article 6(1)(a) GDPR (consent) for xDB, CDP, Personalize and Send. Article 6(1)(f) (legitimate interest) for the backoffice operation and security logs. The customer is the controller, Sitecore is the processor with a DPA in the Master Subscription Agreement.
Does Sitecore transfer data to the United States?
Sitecore is headquartered in Canada with US infrastructure. EU customers must explicitly request West Europe or North Europe Azure deployments for XM Cloud and Content Hub. Sitecore CDP and Personalize default to US infrastructure unless an EU pinning is negotiated. SCCs and the EU US Data Privacy Framework cover residual transfers.
Is a DPIA required for Sitecore?
A DPIA is recommended whenever xDB, Sitecore CDP, Personalize or Send are used because they perform visitor profiling. Document the legal basis, retention period, EU pinning of CDP and Personalize and the consent management integration.
How do I implement Sitecore compliantly?
Wire Sitecore into your consent management platform, block xDB/CDP/Personalize tags until consent, configure xDB retention conservatively, request EU pinning for CDP/Personalize, sign the DPA, document a DSAR procedure via xConnect and CDP APIs, secure the backoffice with VPN, SSO and 2FA.
What are the alternatives to Sitecore?
Other enterprise digital experience platforms include Adobe Experience Manager, Optimizely Content Cloud, Acquia (Drupal), Contentstack, Storyblok and Salesforce Experience Cloud. For lighter needs consider Strapi, Sanity, Prismic, Kontent.ai or Umbraco.
How do I update the cookie policy for Sitecore?
List SC_ANALYTICS_GLOBAL_COOKIE, SC_ANALYTICS_SESSION_COOKIE, Sitecore CDP and Personalize identifiers in your cookie disclosure with retention, purpose and EU pinning information. Mention the EU US data transfer in your privacy notice. Update the disclosure whenever an additional Sitecore add on is activated.
Semplice
Semplice is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Semplice integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Semplice helps organizations maintain robust websites that meet user expectations and technical requirements.
SNO Flex
SNO Flex is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SNO Flex supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SNO Flex ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
HubSpot CMS Hub
HubSpot CMS Hub is a powerful content management system (CMS) designed to help businesses and developers build, manage, and publish digital content with ease. It offers a flexible architecture that supports custom content types, templates, and workflows, making it ideal for websites of any scale. With HubSpot CMS Hub, teams can streamline content creation, improve collaboration, and deliver engaging web experiences. Its extensible plugin ecosystem and API-first approach ensure seamless integration with.
Stoplight
Stoplight is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Stoplight supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Stoplight ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Kontent.ai
Kontent.ai is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Kontent.ai integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Kontent.ai makes advanced AI accessible to all teams.
Opigno LMS
Opigno LMS is a learning management system (LMS) that enables organizations to create, deliver, and track online courses and training programs. It supports multimedia content, interactive quizzes, certification management, and progress tracking. Opigno LMS provides customizable learning paths, mobile-friendly delivery, and social learning features. With SCORM compliance and detailed analytics, Opigno LMS helps deliver effective learning experiences at scale.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.