> How TYPO3 CMS fits GDPR and ePrivacy: self-hosted, first party session cookies only, no default third country transfers and the impact of added extensions. > > Canonical: https://www.flowconsent.com/en/services/cms/typo3-cms CMS # TYPO3 CMS Unclassified · [Official website](https://typo3.org/) TYPO3 CMS is an open source enterprise content management system maintained by the TYPO3 community and the TYPO3 Association in Germany. It is self hosted on the publisher own server, so by default it makes no third party calls and performs no international transfers. It sets only first party session cookies when a session is genuinely needed, which makes it a privacy friendly, low risk foundation for European publishers. [Block TYPO3 CMS until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 3 - Servers Wherever the organisation self hosts TYPO3; no vendor cloud is involved by default Overview ## What does TYPO3 CMS do? ## **What TYPO3 CMS is** TYPO3 CMS is a mature, open source enterprise content management system maintained by the TYPO3 community and the TYPO3 Association, which is based in Germany within the European Union. It is designed to be self hosted on the publisher own server or hosting environment, so the organisation keeps full control over the data. By default it makes no third party calls and involves no vendor cloud. This architecture makes TYPO3 a privacy friendly foundation, where the main compliance work concerns whatever extensions you choose to add. ## **Data and cookies collected** TYPO3 sets a frontend session cookie named fe\_typo\_user only when a session is genuinely needed, for example when a visitor logs in, fills a basket or accesses protected content. Editors receive a backend session cookie named be\_typo\_user when they work in the administration area. These are first party cookies tied to the session and are not used to track visitors across sites. Standard server logs may record IP addresses, as on any web server, which the operator controls directly. ## **GDPR and ePrivacy implications** The TYPO3 session cookies are strictly necessary to provide the service the visitor has requested, so they are exempt from consent under article 5(3) of the ePrivacy Directive. The underlying processing relies on legitimate interest under article 6(1)(f) of the GDPR, or on contract under article 6(1)(b) where a logged in relationship exists. Because the platform is self hosted and first party, the GDPR footprint of the core is small. Risk grows mainly when extensions introduce analytics, marketing or external services. ## **Consent and configuration** Because the core cookies are strictly necessary, no consent banner is required for TYPO3 itself, and the frontend cookie is only set when a session is actually required. You should still inform visitors about these cookies in your privacy notice for transparency. If you add extensions that set non essential cookies, such as analytics or embedded media, those must be placed behind a consent mechanism. Keeping the core lean is the simplest way to stay consent free for the platform. ## **International transfers** As a self hosted CMS, TYPO3 performs no international transfers by default, since all processing happens on infrastructure that you control. Transfers only arise if you choose to host the site outside the European Union or to connect external integrations that send data abroad. To keep things simple, host within the EU and review any third party connector before enabling it. The update and extension services on the TYPO3 domains are used by administrators, not for visitor tracking. ## **Practical compliance steps** Document TYPO3 in your records of processing as a self hosted platform under your own control, and note the strictly necessary session cookies in your privacy notice. Review every extension and integration you add, since this is where new cookies, processing or transfers usually appear. Host the site within the EU to avoid unnecessary transfers, and keep the core and its extensions updated for security. With this discipline, TYPO3 remains one of the most privacy friendly choices available. Compliance ## TYPO3 CMS and the GDPR - Legal basis The session cookies are strictly necessary and exempt from consent under article 5(3) ePrivacy; the underlying processing relies on legitimate interest under article 6(1)(f) GDPR or on contract under article 6(1)(b) - Risk level low - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, TTDSG (Germany), LOPDGDD (Spain), LIL (France) ### Impact assessment (DPIA) The TYPO3 core is low risk and rarely needs a full data protection impact assessment, because it is self hosted, makes no third party calls by default and sets only strictly necessary session cookies. The real assessment focus is whatever extensions and integrations you add, such as analytics, forms or external services, which can introduce new processing, cookies or transfers. Review each added component and host the site within the EU to keep the footprint minimal. ### Sample text for your banner > This site runs on TYPO3 and uses strictly necessary session cookies to keep you logged in and to maintain your session. These cookies are exempt from consent under the ePrivacy rules. Any optional features that set additional cookies will ask for your consent separately. Cookies and trackers ## What TYPO3 CMS sets and contacts - Tracking method self hosted first party session cookies only - Server location Wherever the organisation self hosts TYPO3; no vendor cloud is involved by default - Cookieless mode available Yes ### Cookies set (3) | Name | Type | Duration | Purpose | | --------------- | ------------------ | ----------------------- | ------------------------------------------------------------------------------------------------------------- | | fe\_typo\_user | strictly necessary | session | Frontend session cookie set only when a session is needed, for example login, basket or protected content | | be\_typo\_user | strictly necessary | session | Backend session cookie for editors working in the TYPO3 administration area | | staticfilecache | functional | varies by configuration | Optional functional cookie set only if a static file cache extension is installed, used to serve cached pages | ### Third-party domains contacted (3) - `typo3.org` - `get.typo3.org` - `extensions.typo3.org` Questions ## Frequently asked questions about TYPO3 CMS Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does TYPO3 CMS set? TYPO3 sets a frontend session cookie called fe\_typo\_user, but only when a session is genuinely needed, such as login, a basket or protected content. Editors get a backend session cookie called be\_typo\_user when they work in the administration area. Some extensions, like a static file cache or a cookie consent tool, may add functional cookies if you install them. ### Is consent required to use TYPO3? No, not for the core. The TYPO3 session cookies are strictly necessary and therefore exempt from consent under article 5(3) ePrivacy. Consent only becomes relevant if you add extensions that set non essential cookies, such as analytics or embedded media, which must then be gated. ### What is the legal basis for TYPO3? The strictly necessary session cookies are exempt from consent under ePrivacy, and the underlying processing relies on legitimate interest under article 6(1)(f) GDPR or on contract under article 6(1)(b) for logged in users. Because the platform is self hosted and first party, the basis is straightforward. Added extensions may require their own legal basis. ### Does TYPO3 transfer data to third countries? No, not by default. As a self hosted CMS, TYPO3 keeps processing on infrastructure you control and makes no third party calls out of the box. Transfers only arise if you host the site outside the EU or connect external integrations. Hosting within the EU keeps the platform free of international transfers. ### Do I need a DPIA for TYPO3? The core rarely requires a full data protection impact assessment, given the low risk, self hosting and the absence of tracking cookies. The assessment focus should be the extensions and integrations you add. Review each new component for processing, cookies or transfers and document the outcome. ### How do I implement TYPO3 in a compliant way? Host the site within the EU, keep the core lean and document the strictly necessary session cookies in your privacy notice. Review every extension before enabling it, and place any non essential cookies behind a consent mechanism. Keep the core and extensions updated to maintain security and compliance over time. ### What are the alternatives to TYPO3? Other self hosted open source content management systems offer a similar privacy friendly model, where you control the data and add features through extensions. Hosted platforms are easier to start with but usually involve a vendor processing your data, sometimes outside the EU. TYPO3 is attractive because its association is EU based and the core is self hosted and first party. ### How do I update my cookie policy for TYPO3? List the strictly necessary session cookies fe\_typo\_user and be\_typo\_user as functional and explain that they are exempt from consent. If you install extensions that add functional or non essential cookies, document each one and its purpose. Keep the policy aligned with any consent banner you use for added components. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [Placester](https://www.flowconsent.com/en/services/cms/placester) [Placester is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Placester provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Placester helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/cms/placester) [Marketing](https://www.flowconsent.com/en/services/cms/placester) · ### [Softr](https://www.flowconsent.com/en/services/cms/softr) [Softr is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Softr offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Softr empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/softr) [Analytics](https://www.flowconsent.com/en/services/cms/softr) · ### [Webhealer](https://www.flowconsent.com/en/services/cms/webhealer) [Webhealer is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Webhealer supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Webhealer ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/webhealer) [CMS](https://www.flowconsent.com/en/services/cms/webhealer) · ### [Simvoly](https://www.flowconsent.com/en/services/cms/simvoly) [Simvoly is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Simvoly offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Simvoly empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/simvoly) [Analytics](https://www.flowconsent.com/en/services/cms/simvoly) · ### [Webydo](https://www.flowconsent.com/en/services/cms/webydo) [Webydo is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Webydo supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Webydo enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/cms/webydo) [CMS](https://www.flowconsent.com/en/services/cms/webydo) · ### [Cryout Creations Fluida](https://www.flowconsent.com/en/services/cms/cryout-creations-fluida) [Cryout Creations Fluida is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Cryout Creations Fluida supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Cryout Creations Fluida remains a leading web.](https://www.flowconsent.com/en/services/cms/cryout-creations-fluida) [CMS](https://www.flowconsent.com/en/services/cms/cryout-creations-fluida) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)