GDPR-Compliant CMS: Zero Third-Party Requests

· CMS AliothPress
Illustration of a self-hosted GDPR-compliant CMS in AliothPress, showing built-in fonts, video, images, forms, AI, and analytics modules operating within the CMS without third-party requests.

AliothPress is a self-hosted CMS that makes zero requests to third-party domains by default. No Google Fonts, no CDN scripts, no trackers, no embed iframes on page load. For a default configuration this means: no visitor IP addresses shared with anyone, no cookie consent banner required, no Data Processing Agreements beyond your own hosting provider.

Why zero third-party requests matters

Every external request a page makes sends the visitor's IP address to that third party. Under the GDPR, an IP address is personal data. The LG München I ruling on Google Fonts (Az. 3 O 17493/20, January 2022) made the consequence concrete: loading fonts from Google's servers without consent is a GDPR violation. The same logic applies to CDN scripts, tracking pixels, and embedded players.

Most platforms treat this as a compliance problem to patch: consent banners, plugins, blocking scripts. AliothPress treats it as an architecture decision: the requests simply never happen.

What is self-hosted, exactly

  • Web fonts: 12 font families served from your own domain as WOFF2, split by subset. A page downloads only the glyphs it uses, and never contacts a font CDN
  • Rich text editor (TinyMCE): self-hosted community build in the admin, no calls to tiny.cloud for icons, plugins, or telemetry
  • Syntax highlighting (Prism.js): served from your domain, no cdnjs
  • Images: processed server-side (resized, EXIF-stripped, converted to WebP/AVIF) and served from your domain, no image CDN
  • Icons and favicons: inline SVG or self-hosted files

Video embeds without the banner

YouTube and Vimeo embeds use a two-click facade. On page load the visitor sees a thumbnail cached on your own server: zero requests to youtube.com, i.ytimg.com, or vimeo.com. The player iframe loads only after the visitor clicks play, which constitutes active consent under GDPR Art. 6(1)(a) and § 25 TDDDG. This follows the published recommendations of German data protection authorities (DSK, BayLDA, LfDI Baden-Württemberg). The full mechanics are covered in the companion article on embedding YouTube without a cookie banner.

Forms without third-party CAPTCHA

No Google reCAPTCHA, no hCaptcha, no external anti-spam service. Spam protection is a honeypot field plus IP-based rate limiting. Both run entirely on your server. Double opt-in confirmation links are HMAC-signed tokens generated locally.

AI features without leaking visitor data

The built-in AI Assistant talks to its provider (Anthropic Claude, DeepSeek, or Google Gemini) strictly server-to-server, using your own API key stored encrypted. Visitor IP addresses and browser data are never forwarded. Nothing AI-related runs in the visitor's browser.

Analytics: off by default, consented when on

Google Analytics, Tag Manager, and custom analytics code are all disabled on a fresh site. If you enable them, the built-in consent banner switches on with one checkbox: trackers load inert as type="text/plain" and execute only after the visitor accepts. The consent layer itself stores the choice in localStorage and sets no cookies. Leave analytics off and the default site shows no banner and loads no tracker: there is nothing to consent to.

What this means in practice

  • EU, Germany, UK, Switzerland: the default configuration aligns with GDPR, TDDDG, UK GDPR, and revDSG requirements for third-party data sharing
  • No banner fatigue: visitors get content, not a consent wall
  • Faster pages: zero external requests is also why the engine scores 100 in PageSpeed Performance
  • A shorter privacy policy: fewer processors to declare

Privacy compliance is easiest when there is nothing to comply about: no third-party requests means no third-party data flows, no banner, and no DPAs. AliothPress builds sites that way by default. 

Frequently Asked Questions

Does a default AliothPress site need a cookie consent banner?
No. It sets no tracking cookies and contacts no third parties. The banner exists in the engine and activates only if you enable analytics.
Are the video embeds really banner-free?
Yes, via the two-click facade: local thumbnail first, player only after an explicit click. That click is the consent.
Is this legal advice?
No. It is a technical statement about how the software behaves. The privacy policy on your live site remains your responsibility as the operator. For commercial deployments, a one-time review by an IT law attorney is a reasonable investment.
Can I still use Google Analytics if I want to?
Yes. Enable it in Settings together with the built-in consent banner: it loads only after the visitor accepts.
CMS CMS features