FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Frameworks

CakePHP

UnclassifiedOfficial website

CakePHP is a popular open-source PHP web framework following the MVC pattern. Like all server-side frameworks, it is a developer tool rather than a data processor. GDPR obligations arise from the application built with CakePHP and the infrastructure where it runs, not from the framework code itself. Developers are responsible for session handling, cookie consent implementation, and data protection within their CakePHP applications.

Block CakePHP until consentScan my site
Overview

What does CakePHP do?

What is CakePHP?

CakePHP is one of the most established open-source PHP web frameworks, following the Model-View-Controller pattern with convention over configuration principles. It provides built-in tools for authentication, validation, ORM, caching, and security. CakePHP is widely used for building content management systems, e-commerce platforms, and enterprise web applications. As an open-source framework, it runs entirely on the developer's chosen infrastructure and is not itself a data processor or tracking service.

How does GDPR apply to CakePHP?

GDPR obligations arise from the application built with CakePHP, not the framework itself. The deploying organisation is the data controller. Key GDPR considerations for CakePHP applications include session management, database security, access controls, logging practices, and the integration of third-party services that do trigger GDPR compliance requirements.

Session cookies and consent

CakePHP's built-in session handling uses server-side sessions with a session cookie. Authentication session cookies are strictly necessary and do not require ePrivacy consent. However, any analytics, advertising, or personalisation cookies added to a CakePHP application by the developer require prior consent. Configure CakePHP session settings to use secure cookies with appropriate SameSite attributes.

Developer GDPR responsibilities

CakePHP developers should implement: data minimisation in ORM models, access controls and role-based permissions, data subject rights routes (access, erasure, rectification), audit logging, encryption of sensitive database fields, secure password hashing using CakePHP's built-in Auth component, and CSRF protection on all forms processing personal data.

Deployment and data location

CakePHP applications can be deployed on any infrastructure. For GDPR compliance, deploy on EU-based servers and sign a DPA with the hosting provider. The framework itself does not impose any data location constraints.

Practical compliance steps

Deploy on EU-hosted infrastructure with a signed DPA. Implement cookie consent management. Configure secure session cookies. Build data subject rights handlers. Apply database-level encryption for sensitive fields. Conduct DPIAs for application features processing personal data at scale.

Compliance

CakePHP and the GDPR

Legal basis
CakePHP is a framework, not a data processor. GDPR obligations arise from the application built with CakePHP and its deployment infrastructure.
Risk level
low
Applicable regulations
GDPR compliance is the responsibility of the application developer, not the CakePHP framework

Impact assessment (DPIA)

A DPIA is not required for CakePHP itself. DPIAs may be required for specific CakePHP applications that process personal data at large scale, perform automated decisions, or handle special category data.

Sample text for your banner

This website is built using CakePHP, an open-source PHP framework. Cookies and data collection on this site are described in our privacy policy and cookie notice.
Cookies and trackers

What CakePHP sets and contacts

Tracking method
Server-side PHP web framework, no client-side tracking by default
Server location
Self-hosted (deployer's infrastructure)
Cookieless mode available
Yes

Cookies set (1)

NameTypeDurationPurpose
CAKEPHPsessionSessionStrictly necessary server-side session cookie used for user authentication in CakePHP applications

Third-party domains contacted (2)

  • cakephp.org
  • packagist.org
Questions

Frequently asked questions about CakePHP

Can't find your question? Write to us, we answer fast.

Is CakePHP itself subject to GDPR?

No. CakePHP is an open-source PHP framework, not a data processor or third-party service. GDPR applies to the application built with CakePHP and the organisation deploying it. The framework code itself does not collect or transfer personal data.

Do CakePHP session cookies require consent?

CakePHP authentication session cookies are strictly necessary and do not require ePrivacy consent. Analytics or personalisation cookies added by developers do require consent. Configure CakePHP session cookies with Secure, HttpOnly, and SameSite=Lax attributes.

What is the legal basis for data in CakePHP applications?

Depends on the application design: contract performance for user services, legitimate interest for security logging, consent for analytics and marketing features. CakePHP does not dictate the legal basis.

Does CakePHP transfer data outside the EU?

CakePHP itself does not transfer data. Transfer obligations depend on where the application is deployed and which third-party services are integrated.

Do I need a DPIA for my CakePHP application?

Not for CakePHP itself. DPIAs may be needed for specific application features involving large-scale personal data, automated decisions, or special category data processing.

How should I implement GDPR in my CakePHP application?

Use CakePHP's built-in CSRF protection and security component. Implement cookie consent. Build data subject rights handlers. Apply field-level encryption for sensitive data. Use EU-based hosting with a signed DPA. Implement data minimisation in ORM models.

Where should I host a CakePHP application for GDPR compliance?

EU-based hosting such as OVHcloud, Hetzner, or dedicated EU regions of major cloud providers ensures EU data residency. Sign a DPA with your hosting provider. Avoid non-EU database replicas for personal data.

Does CakePHP need to be in my privacy policy?

No. The framework does not process data. Only the data processing within your application needs to be described, along with any third-party services integrated into the CakePHP application.

Same category

More services: Frameworks

See the whole category

Clarity Design System

Clarity is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Clarity integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Clarity helps organizations maintain robust websites that meet user expectations and technical requirements.

Analytics

Quill

Quill is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Quill integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Quill helps organizations maintain robust websites that meet user expectations and technical requirements.

Frameworks

Moment.js

Moment.js is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Moment.js is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Moment.js offers reliable solutions that scale with organizational needs and evolving web standards.

Frameworks

AngularDart

AngularDart is a JavaScript framework designed for building fast, interactive, and scalable web applications. It provides component-based architecture, reactive data binding, and efficient DOM rendering. AngularDart supports server-side rendering, static site generation, and progressive web apps. With a rich ecosystem of plugins and developer tools, AngularDart accelerates frontend development and delivers exceptional user experiences with optimized performance and SEO-friendly output.

Frameworks

Blitz.js

Blitz.js is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Blitz.js supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Blitz.js ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Frameworks

Breeze

Breeze is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Breeze enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Breeze empowers marketing teams to achieve measurable growth.

Frameworks

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site