> YaBB is a self-hosted Perl forum that sets only strictly necessary cookies. GDPR obligations, ePrivacy consent rules and hosting a YaBB forum in the EU. > > Canonical: https://www.flowconsent.com/en/services/cms/yabb CMS # YaBB Unclassified · [Official website](https://www.yabbforum.com) YaBB (Yet Another Bulletin Board) is an open source forum software written in Perl that stores its data in flat files rather than in a relational database. The default installation only writes a session cookie and an optional remember me cookie, which fall under the strictly necessary exemption of the ePrivacy Directive. The privacy posture mainly depends on the forum operator hosting choice and on the optional plugins activated. [Block YaBB until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 3 - Servers Defined entirely by the forum operator. YaBB is open source software installed on shared, dedicated or self managed hosting in any region of the world. Overview ## What does YaBB do? ## **What YaBB is and how it works** YaBB stands for Yet Another Bulletin Board. It is one of the longest running open source forum software projects, written in Perl and licensed under the YaBB license. Unlike phpBB, vBulletin or Discourse, it does not require a relational database and stores boards, threads and member information in flat files. The application runs on top of any web server with Perl CGI support and is operated entirely on the publisher infrastructure. There is no SaaS edition, so the publisher remains the data controller for every personal data processing activity. ## **Cookies and personal data collected** By default YaBB writes a session cookie called YaBBSessionID, an authentication cookie called YabbUserName when the visitor checks the remember me option, and a CSRF token cookie. The session cookie expires when the browser is closed. The remember me cookie holds a salted hash of the username with a configurable lifetime, typically a few weeks. The application stores the username, the email address, the avatar, the IP address of every post, the post content and the moderation log in flat files on the server. ## **GDPR and ePrivacy implications** The session, authentication and CSRF cookies are strictly necessary under Article 5(3) of the ePrivacy Directive and recital 66, since they are required to deliver the forum service explicitly requested by the user. They can be loaded without consent. Account registration, login and posting rely on contract performance under Article 6(1)(b) GDPR. Articles 13 and 14 GDPR still require a transparent privacy notice that lists the categories of data, the retention period and the moderation workflow, especially because the IP address of every post is stored. ## **International data transfers** YaBB does not transfer data on its own because it is fully self hosted. The publisher decides the hosting region. Hosting on EU infrastructure (OVH, Hetzner, Scaleway) keeps every processing activity within the European Economic Area. Hosting outside the EEA requires a Transfer Impact Assessment and Standard Contractual Clauses with the hosting provider. Avatars from third party services, embedded videos and outbound mailers may also create transfers that the publisher must document. ## **Compliance steps for a clean forum deployment** Configure the YaBB cookies with Secure and HttpOnly with SameSite=Lax, host the application in the EEA, document the IP retention period for posts (six months is a common benchmark), set up a clear privacy notice, provide an easy account deletion mechanism, list the moderation policy and block any optional plugin (advertising, embedded videos, social sharing) behind a Consent Management Platform such as FlowConsent. Compliance ## YaBB and the GDPR - Legal basis Strictly necessary cookies for session management, login, anti spam and CSRF protection rely on the Article 5(3) ePrivacy Directive exemption and on contract performance under Article 6(1)(b) GDPR. Optional analytics, advertising or social plugins added by the forum operator require consent. - Risk level low - Applicable regulations GDPR, ePrivacy Directive (2002/58/EC), national ePrivacy implementations (CNIL recommendation in France, TTDSG/TDDDG in Germany, LSSI and LOPDGDD in Spain), EDPB Guidelines on online forums, OWASP Application Security Verification Standard for the cookie configuration ### Impact assessment (DPIA) A standard YaBB forum used for community discussions is generally low risk. A DPIA becomes appropriate when the forum hosts members directories at large scale, processes special category data such as health discussions, or when the operator hosts the application outside the EEA. Document the categories of data, the moderation workflow, the retention rules and the legal basis of every processing activity. ### Sample text for your banner > This forum runs on YaBB, a self hosted Perl bulletin board. Only strictly necessary cookies are written to keep your session active, to authenticate you when you log in and to protect against cross site request forgery. Additional cookies (analytics, embedded media) are loaded only after you have accepted the corresponding category in the cookie preferences. Cookies and trackers ## What YaBB sets and contacts - Tracking method Self hosted Perl CGI bulletin board that writes session and authentication cookies in the visitor browser. The application stores forum content in flat files rather than in a database, which limits the scope of the personal data processing. - Server location Defined entirely by the forum operator. YaBB is open source software installed on shared, dedicated or self managed hosting in any region of the world. ### Cookies set (3) | Name | Type | Duration | Purpose | | ----------------- | ------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------ | | YaBBSessionID | first\_party | Session | Stores the active session identifier required to maintain forum state, login status and language preference across page loads. | | YabbUserName | first\_party | 2 weeks | Stores a salted hash of the user name used by the remember me feature so that returning visitors are recognised on their next visit. | | yabb\_csrf\_token | first\_party | Session | Stores the per session token used to validate form submissions and protect against Cross Site Request Forgery attacks. | ### Third-party domains contacted (3) - `yabbforum.com` - `yabb.info` - `sourceforge.net` Questions ## Frequently asked questions about YaBB Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does YaBB write? By default YaBB writes the YaBBSessionID session cookie, an optional YabbUserName cookie when the visitor activates remember me, and a CSRF token cookie. Session and CSRF cookies expire when the browser is closed. The remember me cookie has a configurable lifetime, typically a few weeks. ### Do I need consent for the YaBB default cookies? No. The session, authentication and CSRF cookies fall under the strictly necessary exemption of Article 5(3) of the ePrivacy Directive, since they are required to deliver the forum service explicitly requested by the user. Optional plugins (analytics, advertising, embedded media) require consent. ### What is the legal basis for processing forum data? Account registration, login, posting and moderation rely on contract performance under Article 6(1)(b) GDPR. The IP address attached to every post is processed under legitimate interest (Article 6(1)(f)) for security and abuse prevention, with a balanced retention period (six months is a common benchmark). ### Are data transferred to the United States or another third country? YaBB is fully self hosted, so the operator chooses the region. Hosting in the EEA keeps every processing activity within Europe. Hosting outside the EEA requires a Transfer Impact Assessment and Standard Contractual Clauses with the hosting provider. Avatars or external mailers may also create transfers. ### Do I need a Data Protection Impact Assessment for YaBB? For a small to medium community a DPIA is rarely mandatory. A DPIA becomes appropriate when the forum hosts large scale members directories, processes special category data such as health discussions, or when the operator hosts the application outside the EEA. Document the categories of data, the moderation workflow and the retention rules. ### How do I implement YaBB in a fully compliant way? Configure the cookies with Secure, HttpOnly and SameSite=Lax, host in the EEA, document the IP retention period, publish a clear privacy notice, provide an easy account deletion mechanism, document the moderation rules and block optional plugins behind a Consent Management Platform such as FlowConsent. ### What are the alternatives to YaBB? Common alternatives include phpBB, FluxBB, MyBB, Discourse (open source), NodeBB, vBulletin, XenForo and Vanilla Forums. Discourse and Flarum are particularly popular for modern communities. Each has different cookie behaviour and an additional database requirement, except for the few flat file engines. ### How should I update my cookie policy when I deploy YaBB? List the YaBBSessionID session cookie and the optional YabbUserName authentication cookie as strictly necessary, document the CSRF token cookie, the IP retention rule for posts, the hosting region and any optional plugin that writes additional cookies. Provide a clear consent management link if optional cookies are activated. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [LearnWorlds](https://www.flowconsent.com/en/services/cms/learnworlds) [LearnWorlds is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. LearnWorlds integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, LearnWorlds helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/learnworlds) [CMS](https://www.flowconsent.com/en/services/cms/learnworlds) · ### [MysteryThemes News Portal](https://www.flowconsent.com/en/services/cms/mysterythemes-news-portal) [MysteryThemes News Portal is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. MysteryThemes News Portal supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, MysteryThemes News Portal remains a leading.](https://www.flowconsent.com/en/services/cms/mysterythemes-news-portal) [CMS](https://www.flowconsent.com/en/services/cms/mysterythemes-news-portal) · ### [aThemes Astrid](https://www.flowconsent.com/en/services/cms/athemes-astrid) [aThemes Astrid is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. aThemes Astrid supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, aThemes Astrid ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/athemes-astrid) [CMS](https://www.flowconsent.com/en/services/cms/athemes-astrid) · ### [GraphCMS](https://www.flowconsent.com/en/services/cms/graphcms) [GraphCMS is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. GraphCMS integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, GraphCMS helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/graphcms) [CMS](https://www.flowconsent.com/en/services/cms/graphcms) · ### [SixCMS](https://www.flowconsent.com/en/services/cms/sixcms) [SixCMS is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. SixCMS integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, SixCMS helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/sixcms) [CMS](https://www.flowconsent.com/en/services/cms/sixcms) · ### [XenForo](https://www.flowconsent.com/en/services/cms/xenforo) [XenForo is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. XenForo integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, XenForo helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/xenforo) [CMS](https://www.flowconsent.com/en/services/cms/xenforo) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)