FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Marketing

CiviCRM

MarketingOfficial website

Open source constituent relationship management software for nonprofits that is usually self hosted, so personal data stays on your own server.

Block CiviCRM until consentScan my site
Overview

What does CiviCRM do?

What CiviCRM is

CiviCRM is an open source constituent relationship management system built for nonprofits, associations and advocacy groups. It is most often self hosted alongside a content management system such as WordPress or Drupal, which means the software and its database run on infrastructure that the organisation controls. Because of this model the site operator is the data controller and keeps full ownership of the constituent records.

What data and cookies it sets

CiviCRM processes personal data about members, donors and contacts, including names, addresses, contribution history and any custom fields you configure. For logged in users it sets a functional session cookie that keeps the user authenticated while they work. It does not load advertising trackers or share data with external networks unless you deliberately add such integrations.

GDPR and ePrivacy implications

The session cookie is strictly necessary to provide the service, so it falls under the ePrivacy exemption and does not require prior consent. The processing of constituent personal data, by contrast, is governed by the GDPR and must rest on a valid lawful basis. As controller you remain responsible for transparency, data minimisation and the rights of the people whose data you hold.

Consent requirements

You generally do not need cookie consent for the essential session cookie that CiviCRM uses. You do, however, need a lawful basis for storing and using contact data, which is often legitimate interest for existing members or explicit consent for marketing communications. Keep clear records of how and when each contact opted in so you can demonstrate compliance.

Data transfers and hosting

Because CiviCRM is self hosted, there is no inherent transfer of data to third countries; the data simply lives where you run the server. If you choose hosting outside the European Economic Area or connect optional services such as email or payment providers, you must assess those transfers separately. Keeping the installation within the European Union avoids most international transfer concerns.

Practical compliance steps

Document your lawful basis for each type of constituent data and set sensible retention rules using the built in scheduled jobs. Restrict access with CiviCRM permission groups, keep the platform and its extensions updated and host the database on secure infrastructure. Provide a clear privacy notice and a straightforward route for people to exercise their access and erasure rights.

Compliance

CiviCRM and the GDPR

Legal basis
Legitimate interest or consent for processing constituent and donor data depending on context; the essential session cookie relies on the strictly necessary exemption
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive

Impact assessment (DPIA)

A full data protection impact assessment is rarely mandatory for a standard self hosted CiviCRM, but you should document the categories of constituent, member and donor data you store, the lawful basis for each, retention periods and access controls. Pay attention to special category data such as health or political affiliation if your organisation records it, and assess the security of your hosting environment.

Sample text for your banner

We store the contact details you provide in our CiviCRM database to manage your membership, donations and our relationship with you. We process this data on the basis of our legitimate interest or your consent and never sell it. You can ask us to access, correct or erase your data at any time.
Cookies and trackers

What CiviCRM sets and contacts

Tracking method
Server side session cookie set by the self hosted application; no third party tracking by default
Server location
Self hosted; data resides wherever the site operator hosts the installation

Cookies set (1)

NameTypeDurationPurpose
CIVICRM session cookieFunctionalSessionKeeps an authenticated user logged in while they work in the CiviCRM back office. Strictly necessary and exempt from consent.

Third-party domains contacted (1)

  • download.civicrm.org
Questions

Frequently asked questions about CiviCRM

Can't find your question? Write to us, we answer fast.

What cookies does CiviCRM set?

When self hosted, CiviCRM sets a single functional session cookie for logged in users so they stay authenticated while working. It does not set advertising or analytics cookies by default, and no tracking happens for anonymous visitors unless you add it.

Do I need consent for CiviCRM cookies?

No. The session cookie is strictly necessary for the service to function, so it falls under the ePrivacy exemption and does not require prior consent. You do still need a lawful basis for processing the personal data you store.

What is the legal basis for processing constituent data?

The most common bases are legitimate interest for managing existing members and donors, contract for fulfilling a membership, and explicit consent for marketing communications. Choose and document the appropriate basis for each processing activity.

Does CiviCRM transfer data to the United States?

Not by itself. As a self hosted application the data stays wherever you run the server. Transfers only occur if you host outside the European Economic Area or connect external services such as email or payment providers.

Do I need a DPIA for CiviCRM?

A full data protection impact assessment is rarely mandatory for a standard installation, but it becomes advisable if you process large volumes of data or special categories such as health or political opinions. Document your data flows and risks either way.

How do I make my CiviCRM installation compliant?

Document a lawful basis for each data type, set retention rules with scheduled jobs, restrict access using permission groups, keep the software updated and host on secure infrastructure. Publish a clear privacy notice and offer easy access and erasure routes.

What are some alternatives to CiviCRM?

Other constituent and donor management options include Salesforce Nonprofit Cloud, Blackbaud, and EU based tools. The key advantage of CiviCRM is that self hosting keeps personal data under your direct control.

How should I describe CiviCRM in my cookie policy?

List the functional session cookie as strictly necessary, explain that it keeps logged in users authenticated, and note that no advertising trackers are used. Describe separately, in your privacy notice, how you process constituent personal data.

Same category

More services: Marketing

See the whole category

Fello

Fello is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Fello provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Fello helps deliver the right message to the right audience at the right time.

Marketing

SiteJabber

SiteJabber is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. SiteJabber integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, SiteJabber helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Wolfeo

Wolfeo is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Wolfeo provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Wolfeo helps deliver the right message to the right audience at the right time.

Marketing

Satori

Satori is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Satori enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Satori empowers marketing teams to achieve measurable growth.

Marketing

Delighted

Delighted is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Delighted offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Delighted empowers organizations to optimize strategy and maximize return on investment.

Analytics

Loox

Loox is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Loox integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Loox helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site