> Umbraco and the GDPR: a Danish open source ASP.NET CMS, self hosted or on Umbraco Cloud, cookieless public pages and strictly necessary editor cookies. > > Canonical: https://www.flowconsent.com/en/services/cms/umbraco CMS # Umbraco Unclassified · [Official website](https://umbraco.com/) Umbraco is a Danish open source CMS based on ASP.NET, published by Umbraco HQ in Odense. It can be self hosted or used as the managed Umbraco Cloud / Heartcore. Public pages do not set cookies on visitors, only the /umbraco editor area uses strictly necessary authentication cookies. [Block Umbraco until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 6 - Servers Published by Umbraco HQ (Odense, Denmark) under an MIT licence. Umbraco CMS is self hosted by the customer (typically on Microsoft Azure West Europe, AWS Frankfurt, IIS on premise or specialized Umbraco hosts like umbHost or Umbraco Cloud). Umbraco Cloud and Umbraco Heartcore are operated on Azure with regions in West Europe (Netherlands) and East US. Overview ## What does Umbraco do? ## **What Umbraco is and how it serves content** Umbraco is a free and open source CMS based on ASP.NET, published by Umbraco HQ in Odense, Denmark since 2003 under an MIT licence. Customers can self host Umbraco CMS on IIS, Linux Kestrel, Microsoft Azure App Service or AWS, or use the managed services Umbraco Cloud (full deployment automation) and Umbraco Heartcore (headless). Public pages are rendered server side as HTML by default. The headless Heartcore mode adds a JSON Content Delivery API. ## **Cookies and identifiers set on visitors** On the public site Umbraco sets no cookies. The /umbraco backoffice issues an UMB\_AUTH cookie for editor authentication and the standard ASP.NET .AspNetCore.Antiforgery token for CSRF protection, both strictly necessary. The Umbraco Cloud editor portal adds session cookies for the cloud.umbraco.com account. When Umbraco Members is used to gate content behind a login, additional authentication cookies are issued, again strictly necessary for members. ## **GDPR and ePrivacy implications** Because the public Umbraco site does not place identifiers on the visitor terminal, Article 5(3) of the ePrivacy Directive does not require prior consent. Article 6(1)(f) GDPR (legitimate interest) covers the server logs. The customer is controller of all data managed in Umbraco. Umbraco HQ acts as processor only for Umbraco Cloud and Heartcore, with a DPA available in the dashboard. As a Danish entity, Umbraco HQ is fully subject to GDPR enforcement and the Danish Data Protection Act. ## **Data transfers and Schrems II** Self hosted Umbraco does not transfer anything by itself, the customer fully controls the location of the database, the media library and the application server. For Umbraco Cloud and Heartcore, select the West Europe region so data stays inside the EEA. Umbraco HQ telemetry is anonymous usage statistics aggregated at the Danish HQ level, with the option to opt out via configuration. Some support tools (HubSpot, Intercom) may include US providers but are scoped to Umbraco HQ communications. ## **Practical compliance steps** Host inside the EU or pick the West Europe Umbraco Cloud region. Protect /umbraco behind an IP allowlist or a VPN, enforce 2FA via Microsoft Entra ID or an OIDC provider. Document the deployment in your RoPA. If you use Umbraco Forms, configure retention and right to erasure flows for submissions. Disable or scope the Umbraco HQ telemetry as desired. Govern third party scripts (analytics, advertising, video) added to templates through a consent management platform. Compliance ## Umbraco and the GDPR - Legal basis Article 6(1)(f) GDPR (legitimate interest) for the server logs required to deliver pages. The /umbraco editor authentication uses strictly necessary cookies (UMB\_AUTH, .AspNetCore.Antiforgery) that fall outside the consent requirement. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, DSGVO, RGPD, LSSI, Danish Data Protection Act ### Impact assessment (DPIA) A DPIA is generally not required for a typical Umbraco deployment. It should be considered if Umbraco Forms is used to collect large volumes of personal data, if Umbraco Members hosts an authenticated member area with sensitive content, or if external services for profiling and advertising are heavily integrated. Document the hosting region, the access controls on /umbraco and the activated packages. ### Sample text for your banner > This website is powered by Umbraco. Public pages do not set cookies on you. The administrative area uses strictly necessary authentication cookies for logged in editors. No consent is required for the standard operation of Umbraco. Cookies and trackers ## What Umbraco sets and contacts - Tracking method ASP.NET based open source CMS. Pages can be rendered server side as HTML or served through the Content Delivery API in headless mode (Umbraco Heartcore). Both deployment options set ASP.NET authentication and antiforgery cookies for editors on /umbraco, but the public site has no cookies unless extensions are added. - Server location Published by Umbraco HQ (Odense, Denmark) under an MIT licence. Umbraco CMS is self hosted by the customer (typically on Microsoft Azure West Europe, AWS Frankfurt, IIS on premise or specialized Umbraco hosts like umbHost or Umbraco Cloud). Umbraco Cloud and Umbraco Heartcore are operated on Azure with regions in West Europe (Netherlands) and East US. - Cookieless mode available Yes ### Cookies set (3) | Name | Type | Duration | Purpose | | ----------------------- | -------------------------------------- | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | UMB\_AUTH | first-party (/umbraco backoffice only) | Session (configurable, default 20 minutes sliding) | ASP.NET Identity authentication cookie for logged in editors in the Umbraco backoffice. Strictly necessary, never set on the public website. | | .AspNetCore.Antiforgery | first-party (/umbraco backoffice) | Session | ASP.NET Core anti forgery token used to protect state changing requests in the backoffice. Strictly necessary. | | UMB\_UCONTEXT | first-party (/umbraco backoffice) | Session | Optional cookie used to preserve the editor variant context in the backoffice. Strictly necessary for the editor experience. | ### Third-party domains contacted (6) - `umbraco.com` - `our.umbraco.com` - `cloud.umbraco.com` - `app.umbraco.com` - `api.umbraco.io` - `media.umbraco.io` Questions ## Frequently asked questions about Umbraco Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Umbraco set cookies on website visitors? No. The public Umbraco site does not set any cookie on anonymous visitors. The /umbraco backoffice issues UMB\_AUTH (authentication) and .AspNetCore.Antiforgery (CSRF token) cookies for logged in editors only. Members areas (Umbraco Members) issue strictly necessary cookies after a member logs in. ### Do I need consent for Umbraco under GDPR and ePrivacy? No consent is required for the public Umbraco site. The strictly necessary editor and member cookies are exempt under Article 5(3) ePrivacy. Consent only applies if you add third party trackers (Google Analytics, Meta Pixel, video embeds) to your templates. ### What is the legal basis for processing visitor data with Umbraco? Article 6(1)(f) GDPR (legitimate interest) covers the server logs needed to deliver pages. The customer is the controller of all data managed in Umbraco. Umbraco HQ is processor only for Umbraco Cloud and Heartcore with a DPA available. ### Does Umbraco transfer data to the United States? Self hosted Umbraco does not transfer anything. For Umbraco Cloud and Heartcore, choose the West Europe region (Azure Netherlands) to keep data in the EEA. Umbraco HQ is based in Denmark, fully under GDPR. Internal support tools may include some US providers but they are scoped to communications with Umbraco HQ. ### Is a DPIA required for Umbraco? A DPIA is generally not required for a standard editorial deployment. It should be considered when Umbraco Forms collects sensitive data at scale, when Umbraco Members manages a large user base or when third party services that profile visitors are heavily integrated. ### How do I implement Umbraco compliantly? Host in the EU or use the Umbraco Cloud West Europe region, restrict /umbraco behind IP allowlist or VPN, enable 2FA via Microsoft Entra ID or OIDC, document the deployment in your RoPA, configure retention and erasure flows for Umbraco Forms submissions, and govern third party scripts in templates through a consent management platform. ### What are the alternatives to Umbraco? In the ASP.NET space alternatives include Sitecore, Optimizely Content Cloud (formerly Episerver), Kentico Xperience and Orchard Core. In other ecosystems consider WordPress, Drupal, TYPO3, Wagtail, Strapi or Storyblok. ### How do I update the cookie policy for Umbraco? The public site does not need Umbraco in the cookie banner. Document the strictly necessary editor and member cookies in your privacy policy if you publish a detailed list. Add a member specific notice for Umbraco Members when users sign up. Document third party scripts in templates separately. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [MaxSite CMS](https://www.flowconsent.com/en/services/cms/maxsite-cms) [MaxSite CMS provides a robust content management platform that enables organizations to create, organize, and distribute web content efficiently. Built with scalability and performance in mind, MaxSite CMS supports multi-site management, role-based access control, and advanced publishing workflows. Whether running a corporate website or a complex digital portal, MaxSite CMS delivers the flexibility and reliability needed to manage content at scale while maintaining optimal page load speeds and search.](https://www.flowconsent.com/en/services/cms/maxsite-cms) [CMS](https://www.flowconsent.com/en/services/cms/maxsite-cms) · ### [WebNode](https://www.flowconsent.com/en/services/cms/webnode) [WebNode is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. WebNode supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, WebNode ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/webnode) [CMS](https://www.flowconsent.com/en/services/cms/webnode) · ### [Acquia Site Studio](https://www.flowconsent.com/en/services/cms/acquia-site-studio) [Acquia Site Studio is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Acquia Site Studio provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Acquia Site Studio ensures optimal performance at scale.](https://www.flowconsent.com/en/services/cms/acquia-site-studio) [CMS](https://www.flowconsent.com/en/services/cms/acquia-site-studio) · ### [Superblog](https://www.flowconsent.com/en/services/cms/superblog) [Superblog is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Superblog integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Superblog makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/cms/superblog) [CMS](https://www.flowconsent.com/en/services/cms/superblog) · ### [Ibexa DXP](https://www.flowconsent.com/en/services/cms/ibexa-dxp) [Ibexa DXP is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Ibexa DXP supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Ibexa DXP ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/ibexa-dxp) [CMS](https://www.flowconsent.com/en/services/cms/ibexa-dxp) · ### [GoDaddy Website Builder](https://www.flowconsent.com/en/services/cms/godaddy-website-builder) [GoDaddy Website Builder is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. GoDaddy Website Builder integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, GoDaddy Website Builder helps organizations maintain robust websites that meet user.](https://www.flowconsent.com/en/services/cms/godaddy-website-builder) [CMS](https://www.flowconsent.com/en/services/cms/godaddy-website-builder) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)