Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Open source Rust web framework with fine grained reactivity and server side rendering, self hosted and free of built in third party tracking.
Leptos is an open source, full stack web framework for Rust that uses fine grained reactivity to build user interfaces. It can run in the browser, on the server with server side rendering, or both, and it lets developers call server functions directly from the client. It is a tool for building applications rather than a hosted service, so the developer controls every aspect of how it is deployed.
By itself Leptos sets no third party tracking cookies and sends no data to any vendor, because it is just a framework. An application built with Leptos may still use functional cookies, for example a session cookie or an authentication token that the developer adds to keep a user signed in. Any analytics, advertising or profiling is something the developer chooses to integrate, not a default behavior of the framework. This is an important nuance, the framework is cookieless, but a real deployment usually still needs at least a session cookie.
GDPR and ePrivacy apply to the application you deploy, not to the framework as source code. If your app only uses strictly necessary cookies such as session or security tokens, those are generally exempt from consent. The moment you add analytics, advertising or other non essential tracking, the usual consent and transparency duties apply to that processing.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
For a plain Leptos app that only keeps sessions and security working, consent is typically not required because those cookies are strictly necessary. Consent becomes required only if you choose to add non essential cookies or trackers. Decide early which category each cookie falls into so your banner, if you need one, reflects reality.
The framework transfers no data anywhere on its own. Whether any data leaves the EEA depends entirely on where you host the application and which external services you call from it. If you deploy to a non EEA region or call a third party API outside the EEA, you must handle those transfers with an appropriate mechanism, but this is a property of your deployment rather than of Leptos.
Document the cookies your application actually sets and classify each as necessary or optional. Keep analytics and marketing off by default and gate them behind consent if you add them. Choose your hosting region deliberately and review any third party services you integrate, so your privacy notice describes the real behavior of your deployment.
Websites using Leptos must obtain user consent under GDPR regulations.
DPIA considerations
The Leptos framework itself does not process personal data or perform tracking, so it does not trigger a DPIA on its own. A DPIA depends entirely on the application you build with it and the data it handles. Assess any authentication, session or functional cookies you add, any third party services you integrate, and where you host the resulting application.
Sample consent text
This site is built with the Leptos framework and uses only cookies needed to keep you signed in and to remember your preferences. We do not use tracking cookies unless we tell you and ask first. Continue?
Third-party domains contacted
leptos.devgithub.comcrates.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| session | Functional | Session | Representative session cookie that a Leptos app may set to keep a logged in user signed in across requests |
| csrf_token | Functional | Session | Security token that an app may set to protect forms and server functions against cross site request forgery |
| lang | Functional | 1 year | Remembers the language or locale preference chosen by the user in the application |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
Leptos as a framework sets no cookies by itself and includes no tracking. An application you build with it may set functional cookies such as a session cookie, a security token or a language preference if you add them. There are no default third party or marketing cookies, so the cookie footprint is entirely determined by your code.
For the framework itself and for an app that uses only strictly necessary cookies, consent is generally not required. Consent becomes necessary only if you add non essential cookies or trackers such as analytics or advertising. In short the default is consent free, and you opt into consent obligations by what you choose to add.
Functional and authentication cookies usually rely on contract performance or legitimate interest because they are needed to deliver the service the user requested. If you later add analytics or marketing, those parts rely on consent under the GDPR and ePrivacy. Map each cookie to a basis so your documentation is accurate.
The framework transfers no data anywhere on its own. Any transfer outside the EEA depends only on where you host the application and which external services you call. Because you control hosting, you can keep all processing within the EEA if you choose to.
The framework does not trigger a DPIA because it processes no personal data by itself. Whether a DPIA is needed depends on the application you build and the data it handles. Assess the cookies you add, any sensitive processing and any third party integrations rather than the framework.
Keep the cookie set minimal, classify each cookie as necessary or optional, and gate anything non essential behind consent. Choose an appropriate hosting region, document any third party services you call, and write a privacy notice that matches what your app actually does. Because the framework adds nothing by default, compliance is mostly about your own choices.
Alternatives include other Rust web frameworks such as Yew or Dioxus and JavaScript frameworks like React, Svelte or SolidJS. They share the same property that the framework itself is not a tracker, so the privacy posture depends on what you build. Choose based on language, performance and team familiarity.
Because you control the code, review your cookie policy whenever you add or remove a cookie, a feature or a third party integration. List the functional cookies your app sets with their durations and purposes. Keep the policy aligned with the current build rather than with framework defaults, since there are none.