Fortinet FortiGate
Fortinet FortiGate is a leading enterprise next-generation firewall and SD-WAN platform combining stateful inspection, intrusion prevention, SSL inspection, web filtering, anti-bot and VPN. When deployed in front of websites via the FortiWeb WAF, it may set strictly necessary security challenge cookies. FortiGate appliances run on customer infrastructure, with FortiGuard cloud services hosted by Fortinet in the US, Canada and EU regions.
What does Fortinet FortiGate do?
What is Fortinet FortiGate
Fortinet FortiGate is the flagship next-generation firewall and SD-WAN platform from Fortinet, Inc., headquartered in Sunnyvale, California. It combines stateful firewall, intrusion prevention, SSL inspection, web filtering, application control, VPN, anti-malware and SD-WAN in a single appliance or virtual machine. The product line includes FortiWeb (WAF), FortiAnalyzer (logging), FortiManager and FortiGuard cloud threat intelligence.
Data and cookies collected
FortiGate processes packet headers, IP addresses, ports, URLs, user agents, file hashes and, when SSL inspection is enabled, the decrypted content of TLS sessions. FortiWeb WAF can set strictly necessary security challenge cookies (cookiesession1, FortiGate session cookies) when a visitor passes through a security check. FortiGuard receives metadata queries (URL hash, IP, file hash) to look up reputation in real time.
GDPR and ePrivacy implications
FortiGate processes personal data (IPs, traffic metadata) as part of security operations. The customer is the data controller, Fortinet acts as a processor for cloud services. Security challenge cookies set by FortiWeb fall under the strictly necessary exemption of Art. 5(3) ePrivacy and do not require consent. SSL inspection raises significant proportionality issues: it should be limited to what is needed, exclude sensitive categories (banking, health portals) and be disclosed to staff and visitors.
Consent requirements
No visitor consent is required for the firewall function itself or for the strictly necessary security cookies. Consent is also not required for FortiGuard cloud reputation queries because they are essential to the security service. Internal users whose traffic is SSL-inspected should be informed and ideally have a clear acceptable use policy in place.
Data transfers outside the EEA
The FortiGate appliance itself runs on customer infrastructure, so the firewall does not by itself transfer data outside the EEA. FortiGuard cloud services and FortiCloud management add transfers to Fortinet US data centres, governed by SCCs and the EU US Data Privacy Framework. Customers can select EU FortiGuard endpoints in some configurations to minimise transfers.
Practical compliance steps
Sign Fortinet's Data Processing Agreement for cloud services, configure FortiGuard to use EU endpoints where available, restrict SSL inspection by URL category to avoid sensitive sites, define retention rules in FortiAnalyzer for traffic logs, document FortiGate as part of your security processing in the Record of Processing Activities, run a Legitimate Interest Assessment and align with NIS2 obligations if you are an essential or important entity.
Fortinet FortiGate and the GDPR
- Legal basis
- Legitimate interest (Art. 6(1)(f) GDPR) for network security, DDoS protection, anti-bot and abuse prevention; Legal obligation (Art. 6(1)(c) GDPR) for security incident logging required under NIS2 or sectoral rules
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive (Cookie Law), NIS2, ISO 27001, EU US Data Privacy Framework
Impact assessment (DPIA)
FortiGate processes network traffic, IP addresses, URLs and user agents for security purposes. Key DPIA considerations: (1) the appliance itself runs on customer infrastructure, so visitor data does not leave the customer environment until FortiGuard cloud is queried; (2) FortiWeb security challenge cookies are strictly necessary under Art. 5(3) ePrivacy and do not require consent; (3) SSL inspection decrypts TLS traffic to inspect content, which raises significant data minimisation and policy concerns; (4) FortiGuard threat intelligence sends URL, IP and file hash queries to Fortinet cloud, including in the US; (5) FortiAnalyzer logs IP addresses and traffic metadata that may qualify as personal data; (6) NIS2 imposes specific obligations on essential and important entities that operate FortiGate appliances.
Sample text for your banner
Our website is protected by Fortinet FortiGate and FortiWeb security appliances. These tools inspect incoming traffic, may set strictly necessary security cookies (cookiesession1) and query Fortinet's FortiGuard threat intelligence to block malicious traffic. The processing is based on our legitimate interest in security under Art. 6(1)(f) GDPR.
What Fortinet FortiGate sets and contacts
- Tracking method
- Enterprise next-generation firewall and SD-WAN appliance with web filtering, IPS, anti-bot and SSL inspection; FortiWeb WAF can set security challenge cookies on protected websites; FortiGuard cloud services for threat intelligence
- Server location
- On-premises customer infrastructure for the appliances themselves; FortiGuard cloud services in multiple global data centres including the United States, Canada and EU regions; Fortinet, Inc. is headquartered in Sunnyvale, California
- Cookieless mode available
- Yes
- Data transferred outside the EU
- FortiGate appliances run on the customer's infrastructure, so visitor data stays where the device is deployed. FortiGuard threat intelligence services and FortiCloud management are hosted by Fortinet in the United States, Canada and EU regions. Transfers to US infrastructure rely on Standard Contractual Clauses and Fortinet's EU US Data Privacy Framework certification where applicable.
Cookies set (2)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| cookiesession1 | Functional | Session | Strictly necessary security cookie set by FortiWeb WAF in front of a protected website. Used to maintain the security session and validate that the visitor has passed an anti bot or rate limiting check. |
| FGT_PERSISTENT_SESSION | Functional | Session | Set by FortiGate when the appliance acts as a captive portal or load balancer to keep the visitor anchored to a specific backend server. |
Third-party domains contacted (4)
fortinet.comfortiguard.comforticloud.comsupport.fortinet.com
Frequently asked questions about Fortinet FortiGate
Can't find your question? Write to us, we answer fast.
What cookies does FortiGate / FortiWeb set on visitor browsers?
When FortiWeb WAF is in front of a website, it may set strictly necessary security cookies such as cookiesession1 to maintain a security session across requests and validate that a visitor has passed an anti bot check. These cookies do not store browsing behaviour and qualify as strictly necessary.
Do I need user consent for FortiGate or FortiWeb security cookies?
No. The cookies set for security challenges and session validation fall under the strictly necessary exemption of Art. 5(3) ePrivacy and Recital 66, because they are essential to the security service requested by the operator. Disclose them in the privacy notice without a consent banner.
What is the legal basis for processing data via FortiGate?
Legitimate interest (Art. 6(1)(f) GDPR) for security, anti bot and abuse prevention. Legal obligation (Art. 6(1)(c) GDPR) for security incident logging under NIS2 or sector specific rules. SSL inspection of staff traffic should be balanced and disclosed; consider Art. 88 GDPR for employee monitoring rules.
Where does FortiGate process and store data?
The FortiGate appliance processes traffic on the customer's own infrastructure, so the firewall itself does not transfer data outside the EEA. FortiGuard threat intelligence and FortiCloud management run on Fortinet infrastructure in the United States, Canada and EU regions, with SCCs and the EU US Data Privacy Framework for US transfers.
Is a DPIA required for FortiGate?
A DPIA is recommended when SSL inspection is enabled, when logs are retained at scale or when FortiGate is deployed by an essential or important entity under NIS2. The DPIA should cover SSL inspection scope, log retention in FortiAnalyzer, FortiGuard transfers and the risks to individual visitors and employees.
How do I deploy FortiGate compliantly?
Sign Fortinet's DPA for cloud services, restrict SSL inspection by URL category, exclude sensitive sites (banking, health, union or political), select EU FortiGuard endpoints where available, configure FortiAnalyzer retention, run a Legitimate Interest Assessment and align with NIS2 incident reporting obligations.
What are GDPR friendly alternatives to FortiGate?
EU based firewall and security alternatives include Stormshield (France), genua (Germany), Rohde and Schwarz Cybersecurity (Germany), WatchGuard (US with EU options) and open source options such as pfSense and OPNsense. For WAF specifically, consider Imperva, Cloudflare WAF or open source ModSecurity.
How should I update my privacy policy for FortiGate?
Disclose that you protect your site with FortiGate and FortiWeb, name the strictly necessary security cookie (cookiesession1) and its purpose, explain that traffic metadata is processed under legitimate interest for security, mention FortiGuard cloud queries and the SCCs and EU US Data Privacy Framework that cover US transfers and link Fortinet's privacy notice and DPA.
Palo Alto GlobalProtect
Palo Alto Networks - GlobalProtect is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Palo Alto Networks - GlobalProtect supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Palo Alto Networks - GlobalProtect ensures your website delivers a smooth, uninterrupted.
Apple Sign-in
Apple Sign-in is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Apple Sign-in offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Apple Sign-in empowers organizations to optimize strategy and maximize return on investment.
authorized.by
authorized.by is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. authorized.by supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, authorized.by enables informed decisions that improve experience and drive results.
Okta
Okta is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Okta offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Okta empowers organizations to optimize strategy and maximize return on investment.
HSTS
HSTS is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. HSTS integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, HSTS helps organizations maintain robust websites that meet user expectations and technical requirements.
Forter
Forter is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Forter supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Forter ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.