> Is CakePHP GDPR compliant? How GDPR applies to apps built with CakePHP, session cookie handling, developer duties and building privacy friendly PHP apps.
>
> Canonical: https://www.flowconsent.com/en/services/framework/cakephp

Frameworks

# CakePHP

Unclassified · [Official website](https://cakephp.org)

CakePHP is a popular open-source PHP web framework following the MVC pattern. Like all server-side frameworks, it is a developer tool rather than a data processor. GDPR obligations arise from the application built with CakePHP and the infrastructure where it runs, not from the framework code itself. Developers are responsible for session handling, cookie consent implementation, and data protection within their CakePHP applications.

[Block CakePHP until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=framework) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [Frameworks](https://www.flowconsent.com/en/services/framework)

- Consent

  Unclassified

- Prior consent

  Not required

- Documented cookies

  1

- Third-party domains

  2

- Servers

  Self-hosted (deployer's infrastructure)

Overview

## What does CakePHP do?

## **What is CakePHP?**

CakePHP is one of the most established open-source PHP web frameworks, following the Model-View-Controller pattern with convention over configuration principles. It provides built-in tools for authentication, validation, ORM, caching, and security. CakePHP is widely used for building content management systems, e-commerce platforms, and enterprise web applications. As an open-source framework, it runs entirely on the developer's chosen infrastructure and is not itself a data processor or tracking service.

## **How does GDPR apply to CakePHP?**

GDPR obligations arise from the application built with CakePHP, not the framework itself. The deploying organisation is the data controller. Key GDPR considerations for CakePHP applications include session management, database security, access controls, logging practices, and the integration of third-party services that do trigger GDPR compliance requirements.

## **Session cookies and consent**

CakePHP's built-in session handling uses server-side sessions with a session cookie. Authentication session cookies are strictly necessary and do not require ePrivacy consent. However, any analytics, advertising, or personalisation cookies added to a CakePHP application by the developer require prior consent. Configure CakePHP session settings to use secure cookies with appropriate SameSite attributes.

## **Developer GDPR responsibilities**

CakePHP developers should implement: data minimisation in ORM models, access controls and role-based permissions, data subject rights routes (access, erasure, rectification), audit logging, encryption of sensitive database fields, secure password hashing using CakePHP's built-in Auth component, and CSRF protection on all forms processing personal data.

## **Deployment and data location**

CakePHP applications can be deployed on any infrastructure. For GDPR compliance, deploy on EU-based servers and sign a DPA with the hosting provider. The framework itself does not impose any data location constraints.

**Practical compliance steps**

Deploy on EU-hosted infrastructure with a signed DPA. Implement cookie consent management. Configure secure session cookies. Build data subject rights handlers. Apply database-level encryption for sensitive fields. Conduct DPIAs for application features processing personal data at scale.

Compliance

## CakePHP and the GDPR

- Legal basis

  CakePHP is a framework, not a data processor. GDPR obligations arise from the application built with CakePHP and its deployment infrastructure.

- Risk level

  low

- Applicable regulations

  GDPR compliance is the responsibility of the application developer, not the CakePHP framework

### Impact assessment (DPIA)

A DPIA is not required for CakePHP itself. DPIAs may be required for specific CakePHP applications that process personal data at large scale, perform automated decisions, or handle special category data.

### Sample text for your banner

> This website is built using CakePHP, an open-source PHP framework. Cookies and data collection on this site are described in our privacy policy and cookie notice.

Cookies and trackers

## What CakePHP sets and contacts

- Tracking method

  Server-side PHP web framework, no client-side tracking by default

- Server location

  Self-hosted (deployer's infrastructure)

- Cookieless mode available

  Yes

### Cookies set (1)

| Name    | Type    | Duration | Purpose                                                                                            |
| ------- | ------- | -------- | -------------------------------------------------------------------------------------------------- |
| CAKEPHP | session | Session  | Strictly necessary server-side session cookie used for user authentication in CakePHP applications |

### Third-party domains contacted (2)

- `cakephp.org`
- `packagist.org`

Questions

## Frequently asked questions about CakePHP

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### Is CakePHP itself subject to GDPR?

No. CakePHP is an open-source PHP framework, not a data processor or third-party service. GDPR applies to the application built with CakePHP and the organisation deploying it. The framework code itself does not collect or transfer personal data.

### Do CakePHP session cookies require consent?

CakePHP authentication session cookies are strictly necessary and do not require ePrivacy consent. Analytics or personalisation cookies added by developers do require consent. Configure CakePHP session cookies with Secure, HttpOnly, and SameSite=Lax attributes.

### What is the legal basis for data in CakePHP applications?

Depends on the application design: contract performance for user services, legitimate interest for security logging, consent for analytics and marketing features. CakePHP does not dictate the legal basis.

### Does CakePHP transfer data outside the EU?

CakePHP itself does not transfer data. Transfer obligations depend on where the application is deployed and which third-party services are integrated.

### Do I need a DPIA for my CakePHP application?

Not for CakePHP itself. DPIAs may be needed for specific application features involving large-scale personal data, automated decisions, or special category data processing.

### How should I implement GDPR in my CakePHP application?

Use CakePHP's built-in CSRF protection and security component. Implement cookie consent. Build data subject rights handlers. Apply field-level encryption for sensitive data. Use EU-based hosting with a signed DPA. Implement data minimisation in ORM models.

### Where should I host a CakePHP application for GDPR compliance?

EU-based hosting such as OVHcloud, Hetzner, or dedicated EU regions of major cloud providers ensures EU data residency. Sign a DPA with your hosting provider. Avoid non-EU database replicas for personal data.

### Does CakePHP need to be in my privacy policy?

No. The framework does not process data. Only the data processing within your application needs to be described, along with any third-party services integrated into the CakePHP application.

Same category

## More services: Frameworks

[See the whole category](https://www.flowconsent.com/en/services/framework)

### [Clarity Design System](https://www.flowconsent.com/en/services/framework/clarity)

[Clarity is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Clarity integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Clarity helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/framework/clarity)

[Analytics](https://www.flowconsent.com/en/services/framework/clarity)

·

### [Quill](https://www.flowconsent.com/en/services/framework/quill)

[Quill is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Quill integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Quill helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/framework/quill)

[Frameworks](https://www.flowconsent.com/en/services/framework/quill)

·

### [Moment.js](https://www.flowconsent.com/en/services/framework/moment-js)

[Moment.js is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Moment.js is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Moment.js offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/framework/moment-js)

[Frameworks](https://www.flowconsent.com/en/services/framework/moment-js)

·

### [AngularDart](https://www.flowconsent.com/en/services/framework/angulardart)

[AngularDart is a JavaScript framework designed for building fast, interactive, and scalable web applications. It provides component-based architecture, reactive data binding, and efficient DOM rendering. AngularDart supports server-side rendering, static site generation, and progressive web apps. With a rich ecosystem of plugins and developer tools, AngularDart accelerates frontend development and delivers exceptional user experiences with optimized performance and SEO-friendly output.](https://www.flowconsent.com/en/services/framework/angulardart)

[Frameworks](https://www.flowconsent.com/en/services/framework/angulardart)

·

### [Blitz.js](https://www.flowconsent.com/en/services/framework/blitz-js)

[Blitz.js is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Blitz.js supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Blitz.js ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/framework/blitz-js)

[Frameworks](https://www.flowconsent.com/en/services/framework/blitz-js)

·

### [Breeze](https://www.flowconsent.com/en/services/framework/breeze)

[Breeze is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Breeze enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Breeze empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/framework/breeze)

[Frameworks](https://www.flowconsent.com/en/services/framework/breeze)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)