CMS

Squarespace

Squarespace is a US-based SaaS website builder used widely in Europe for portfolios, brochure sites and small e-commerce stores. Pages are served from Squarespace infrastructure in the United States, which means EU visitor data is transferred under Standard Contractual Clauses. The platform sets a few first-party cookies for session management and analytics; non-essential analytics and marketing scripts require prior consent.

Block Squarespace until consent Scan my site

Overview

What does Squarespace do?

What is Squarespace?

Squarespace is a fully managed SaaS website builder founded in 2003 and headquartered in New York. It targets creators, freelancers and small businesses who want a polished site without managing their own server. Squarespace also offers an integrated commerce module, scheduling, email marketing and a domain registrar. Hosting and processing happen on Squarespace infrastructure in the United States.

Cookies and data collected

On a default Squarespace site, the platform sets a session cookie (SS_MID), an analytics cookie (ss_cvisit, ss_cvr) and additional cookies when visitors interact with forms, the cart or members areas. Squarespace Analytics tracks page views, referrers, devices and conversions. Optional integrations such as Google Analytics, Meta Pixel, TikTok Pixel or chat widgets add further trackers depending on what the merchant configures.

GDPR and ePrivacy implications

The session cookie is strictly necessary and exempt from consent under Art. 5(3) ePrivacy. Squarespace Analytics, Cookies & Visitor Data and any third party tracker require freely given consent (Art. 6(1)(a) GDPR). Squarespace ships a built-in cookie banner module, but it must be configured in opt-in mode for EU visitors and combined with proper categorisation. Customer accounts and Commerce orders rely on contract performance (Art. 6(1)(b)).

Data transfers and hosting

Squarespace processes data in the United States. EU visitor and customer data is transferred to the US under Standard Contractual Clauses, included in the Squarespace Data Processing Addendum. Schrems II requires the merchant to perform a Transfer Impact Assessment and to inform data subjects of the US transfer in the privacy policy.

Practical compliance steps

Sign the Squarespace DPA from your account settings. Enable the built-in Cookies & Visitor Data banner in opt-in mode for EU visitors. Disable Squarespace Analytics or block it until consent is given. Mention Squarespace as a US processor in your privacy notice with the SCC reference. Review installed code injections and third party widgets quarterly.

Compliance

Squarespace and the GDPR

Squarespace is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis: Consent (Art. 6(1)(a) GDPR) for the Squarespace Analytics cookies and any optional marketing or social integration. Contract performance (Art. 6(1)(b)) for the merchant relationship and for processing customer orders on Squarespace Commerce stores. Strictly necessary cookies rely on Art. 5(3) ePrivacy.
Risk level: medium
Applicable regulations: GDPR, ePrivacy Directive 2002/58/EC, CCPA, UK GDPR

Impact assessment (DPIA)

A DPIA is recommended for Squarespace Commerce stores that process large customer volumes, sensitive data or extensive marketing automation, given the US transfer combined with US based processing of customer and order data.

Sample text for your banner

This website is built on Squarespace (Squarespace, Inc., United States). Analytics and marketing scripts are loaded only after your consent. Customer and order data is transferred to the US under Standard Contractual Clauses.

Cookies and trackers

What Squarespace sets and contacts

Tracking method: fully managed SaaS website builder; first party cookies for visitor session, optional Squarespace Analytics and third party integrations triggered by template configuration
Server location: United States (Squarespace, Inc., New York)
Data transferred outside the EU: Squarespace, Inc. is a US company and operates its infrastructure primarily in the United States. Visitor data, customer information and store transactions are transferred to the US. Squarespace publishes Standard Contractual Clauses through its Data Processing Addendum and provides transfer mechanisms to merchants.

Cookies set (5)

Name	Type	Duration	Purpose
SS_MID	first_party	2 years	Strictly necessary cookie used by Squarespace to identify the visitor session and for security signals.
ss_cvisit	first_party	2 years	Squarespace Analytics cookie that tracks first-time and returning visitors.
ss_cvr	first_party	2 years	Squarespace Analytics cookie that records aggregated visit information for site reports.
crumb	first_party	Session	CSRF token used by Squarespace forms and Commerce checkout flows.
test	first_party	Session	Verifies whether the visitor browser accepts cookies for Squarespace functionality.

Third-party domains contacted (4)

www.squarespace.com
images.squarespace-cdn.com
static1.squarespace.com
assets.squarespace.com

Questions

Frequently asked questions about Squarespace

Can't find your question? Write to us, we answer fast.

Write to us

What cookies does Squarespace set?

Squarespace sets a session and identification cookie (SS_MID), Squarespace Analytics cookies (ss_cvisit, ss_cvr) that track first time and returning visitors, a CSRF cookie (crumb) for forms and Commerce checkout, and an internal test cookie that verifies cookie support. Additional cookies appear when you enable Member Areas, Commerce or third-party integrations such as Google Analytics or Meta Pixel.

Do I need consent to use Squarespace on my website?

Yes for the analytics cookies (ss_cvisit, ss_cvr) and any third party tracker. The session and CSRF cookies are strictly necessary and exempt under Art. 5(3) ePrivacy. Configure the built-in Cookies & Visitor Data banner in opt-in mode for EU visitors and block analytics until consent is given.

What is the legal basis for processing personal data through Squarespace?

Strictly necessary cookies rely on Art. 5(3) ePrivacy. Squarespace Analytics, marketing pixels and chat widgets rely on consent (Art. 6(1)(a) GDPR). Customer accounts and Commerce orders rely on contract performance (Art. 6(1)(b)). Tax retention for Commerce relies on legal obligation (Art. 6(1)(c)).

Does Squarespace transfer data to third countries?

Yes. Squarespace, Inc. processes data in the United States. EU visitor and customer data is transferred to the US under the Standard Contractual Clauses included in the Squarespace Data Processing Addendum. Run a Transfer Impact Assessment and disclose the US transfer in your privacy notice.

Do I need a DPIA for Squarespace?

A standard portfolio or brochure site does not normally require a DPIA. A DPIA is recommended for Squarespace Commerce stores with high transaction volumes, processing of special category data, or extensive marketing automation, given the US transfer combined with US based customer data processing.

How do I implement Squarespace compliantly?

Sign the Squarespace DPA from your account settings. Enable the Cookies & Visitor Data banner in opt-in mode for EU visitors with proper categories. Disable Squarespace Analytics until consent is given or rely on the consent integration. Add Squarespace as a US processor in your privacy notice with the SCC reference. Audit code injections and third party widgets quarterly.

Are there privacy-friendly alternatives to Squarespace?

For EU-hosted website builders, consider Webflow with EU hosting, Strikingly EU, Jimdo (Germany) or open source options like WordPress on a European host. The privacy result depends on the hosting region and which third-party scripts you load.

How should I update my cookie policy for Squarespace?

List the cookies set by Squarespace (SS_MID, ss_cvisit, ss_cvr, crumb, test) with name, purpose, duration and category. Add cookies introduced by Member Areas, Commerce, payment processors, custom code injections and third party widgets. Document the consent mechanism and the US data transfer to Squarespace, Inc.

25 June 2026

Squarespace and Google Consent Mode v2: setup guide

Squarespace's built-in banner only covers part of Google Consent Mode v2. This guide explains what it handles, when you need a CMP, and how to set up and verify GA4 and Google Ads tags step by step.

Read the guide

23 May 2026

Squarespace and GDPR cookies: the compliance guide

Squarespace loads third-party cookies by default. This guide explains why the native banner is not enough and how to make your site fully GDPR compliant.

Read the guide

Orchard Core

Orchard Core is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Orchard Core integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Orchard Core helps organizations maintain robust websites that meet user expectations and technical requirements.

CMS

iMotor

i-motor is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. i-motor supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, i-motor ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

S-COREpion

S-COREpion is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. S-COREpion integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, S-COREpion helps organizations maintain robust websites that meet user expectations and technical requirements.

CMS

webEdition

webEdition is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. webEdition supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, webEdition ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

Hostinger Horizons

Hostinger Horizons is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Hostinger Horizons offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Hostinger Horizons empowers organizations to optimize strategy and maximize return on investment.

Analytics

Genesis theme

Genesis theme is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Genesis theme supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Genesis theme ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CMS

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my banner Scan my site