IONOS
IONOS is the European arm of United Internet AG and one of the largest hosting and cloud providers in Germany. It offers domain registration, shared hosting, managed WordPress, the MyWebsite builder, IONOS Compute Engine (a sovereign IaaS offering), Server Cloud, dedicated servers, IONOS Cloud Storage and managed Microsoft 365. Because IONOS is headquartered in Germany and operates EU data centres, it is a strong default for European websites that need a hosting partner aligned with the GDPR, the German TTDSG / TDDDG and the BSI C5 cloud security catalogue.
What does IONOS do?
What IONOS does and how it appears on a website
IONOS SE, registered in Montabaur, Germany, is the consumer and small business hosting brand of United Internet AG. It offers domain registration, shared web hosting (Linux and Windows), managed WordPress, the MyWebsite drag and drop builder, dedicated and bare metal servers, IONOS Cloud Storage compatible with S3, IONOS Compute Engine (a sovereign IaaS), and bundled Microsoft 365 plans. IONOS Cloud, the IaaS arm, targets enterprises and public sector customers that need a sovereign EU cloud aligned with GAIA-X principles.
Cookies and data collected by IONOS
On a website hosted with IONOS, the infrastructure layer sets technical session cookies and may add load balancing cookies. The MyWebsite builder injects a small set of first party cookies for the editor (ionos_session, ionos_csrf). Analytics, marketing or social embed cookies are only added by the customer through MyWebsite blocks or by integrating third party services. Server logs capture IP, User-Agent, requested URL and Referer for security and abuse detection.
GDPR and ePrivacy implications
IONOS acts as processor for hosting, MyWebsite, e-mail and storage services, and as controller for its own customer communication. The IONOS Auftragsverarbeitungsvertrag (AVV / DPA) is signed automatically as part of the customer contract and is available in the customer panel in German, English, French and Spanish. The DPA references the European Commission Standard Contractual Clauses where applicable and the BSI C5 attestation.
International data transfers
For EU data centres, no third country transfer takes place. IONOS does operate a data centre in the United States for customers that need US presence; selecting that data centre obviously triggers the GDPR transfer rules. The IONOS Compute Engine carries an EU contractual ring fence: customer data is stored, processed and accessed only by IONOS personnel based in the EU.
Consent and legal basis
Contractual necessity (Article 6(1)(b) GDPR) covers hosting, domain and mailbox processing. Legitimate interest (Article 6(1)(f)) covers security. Consent (Article 6(1)(a)) only applies if the customer adds analytics or marketing scripts through MyWebsite templates or other integrations.
Practical compliance steps
Sign the IONOS DPA in the customer panel, choose an EU data centre, enable two factor authentication for the panel, review the BSI C5 and ISO 27001 attestations, document the sub-processor list, list IONOS in the privacy notice, and integrate any optional analytics or marketing snippet into the Consent Management Platform so it only fires after opt-in.
IONOS and the GDPR
- Legal basis
- Contractual necessity under Article 6(1)(b) GDPR for hosting and domain services. Legitimate interest under Article 6(1)(f) for security and abuse prevention. Consent under Article 6(1)(a) only for analytics or marketing scripts added through MyWebsite templates.
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive, German TTDSG / TDDDG, German BSI C5 cloud security, ISO 27001
Impact assessment (DPIA)
A DPIA is rarely required for IONOS infrastructure alone. Document a transfer impact assessment limited to the chosen data centre (EU vs US), the BSI C5 attestation, ISO 27001 certification, encryption at rest and in transit, IONOS Compute Engine sovereignty controls (compatible with EU GAIA-X principles) and the response plan for any third party access request.
Sample text for your banner
This website is hosted on IONOS infrastructure in the European Union. Hosting cookies for load balancing and security are strictly necessary and exempt from consent. Optional cookies set by templates of the IONOS MyWebsite builder for analytics or marketing only fire after you click Accept on the cookie banner.
What IONOS sets and contacts
- Tracking method
- European web hosting, cloud infrastructure, domain registration, MyWebsite builder and IONOS Compute Engine. Server logs and session cookies for the customer panel; templates may inject analytics cookies if enabled.
- Server location
- Headquartered in Montabaur, Germany. Data centres in Germany (Karlsruhe, Berlin, Munich), United Kingdom, France, Spain, United States. Customers can choose the data centre at provisioning.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ionos_session | HTTP cookie | Session | IONOS panel and MyWebsite session identifier. |
| ionos_csrf | HTTP cookie | Session | Anti CSRF token for the IONOS customer panel and MyWebsite editor. |
| ionos_locale | HTTP cookie | 1 year | Stores the preferred locale for the customer panel. |
Third-party domains contacted (5)
ionos.comionos.deionos.esionos.frhosting-data.io
Frequently asked questions about IONOS
Can't find your question? Write to us, we answer fast.
What cookies does IONOS set?
IONOS hosting and MyWebsite set technical session cookies (ionos_session, ionos_csrf) and a locale preference cookie. No analytics or marketing cookies are deployed by default.
Do I need consent to use IONOS?
Hosting cookies are strictly necessary and exempt from prior consent. Only the optional analytics or marketing snippets added by the customer through MyWebsite or other integrations need consent.
What is the legal basis?
Article 6(1)(b) GDPR (contract) for hosting, domain and mailbox services. Article 6(1)(f) for security and abuse prevention. Article 6(1)(a) only for optional analytics or marketing scripts.
Does IONOS transfer data to the US?
No, when an EU data centre is selected. IONOS does operate a US data centre for customers serving North American audiences; selecting that data centre triggers GDPR transfer rules. IONOS Compute Engine offers a sovereign EU contractual ring fence.
Do I need a DPIA?
Rarely. A short transfer impact assessment is enough, focused on the data centre choice and the BSI C5 / ISO 27001 attestations.
How do I implement IONOS compliantly?
Sign the IONOS DPA, choose an EU data centre, enable 2FA, review the BSI C5 and ISO 27001 attestations, list IONOS in the privacy notice and integrate optional analytics scripts into the CMP.
Are there alternatives to IONOS?
For sovereign EU hosting: OVHcloud, Scaleway, Hetzner, Infomaniak, Open Telekom Cloud. For Managed WordPress in the EU: Kinsta EU, WPEngine EU, Hostinger EU.
How do I update my cookie policy for IONOS?
List IONOS SE as a processor for hosting and as the registrar for the domain, describe the technical cookies, reference the BSI C5 and ISO 27001 attestations and link to the IONOS DPA and privacy notice.
MiniServ
MiniServ is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. MiniServ integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, MiniServ helps organizations maintain robust websites that meet user expectations and technical requirements.
Platform.sh
Platform.sh is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Platform.sh integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Platform.sh helps organizations maintain robust websites that meet user expectations and technical requirements.
Artifactory
Artifactory is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Artifactory offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Artifactory empowers organizations to optimize strategy and maximize return on investment.
Acquia Site Factory
Acquia Cloud Site Factory is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Acquia Cloud Site Factory provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Acquia Cloud Site Factory ensures optimal performance at scale.
Appwrite
Appwrite is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Appwrite offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Appwrite empowers organizations to optimize strategy and maximize return on investment.
Mittwald
Mittwald is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Mittwald offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Mittwald empowers organizations to optimize strategy and maximize return on investment.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.