TYPO3 AI
Arrange a Call Arrange a Call button with three profile images
de
TYPO3 Glossary

GDPR Compliance in TYPO3 – Glossary

TYPO3 and GDPR: Requirements and Technical Measures

GDPR implementation in TYPO3 (German: DSGVO-Umsetzung) means handling personal data on a TYPO3 website in line with the General Data Protection Regulation (Regulation (EU) 2016/679), for example in forms, cookies, tracking, user accounts and server log files. TYPO3 and its extensions provide the technical building blocks. Whether a specific website meets all requirements depends on the services used and on the operator's contracts and processes.

In short: Responsibility for legal bases, contracts and processes lies with the operator. Check five things above all: legal basis and information, consent for cookies and tracking, external resources such as fonts, service providers and third-country transfers, and data subject rights.

Principles and legal basis

The GDPR principles include lawfulness, transparency, purpose limitation, data minimisation and storage limitation (Art. 5 GDPR). Every processing operation needs a legal basis under Art. 6 GDPR. Consent is only one of several, alongside contract performance and legitimate interests, among others. Visitors must be able to understand which data is processed and why, which is the job of the privacy policy with the information required by Art. 13 GDPR. The imprint, by contrast, follows Section 5 DDG, in German (the German Digital Services Law, Digitale-Dienste-Gesetz; according to a Taylor Wessing article of May 2024, in German, in force since 14 May 2024 and replacing the Telemedia Act) and is not a GDPR requirement.

Cookies and consent

Under section 25(1) TDDDG, in German, storing information on a device or accessing information already stored there is only permitted with consent based on clear and comprehensive information. Under section 25(2) no. 2 TDDDG, consent is not needed where this is strictly necessary for a digital service the user has expressly requested. The law has been called TDDDG since May 2024 (formerly TTDSG). If personal data is processed afterwards, for example for audience measurement, a legal basis under Art. 6 GDPR is needed in addition.

Under the GDPR, valid consent requires in particular:

  • Freely given, informed and unambiguous: expressed by a clear affirmative act (Art. 4(11) GDPR). Pre-ticked boxes are not enough (CJEU, judgment of 1 October 2019, C-673/17, Planet49).
  • Provable: The controller must be able to demonstrate consent (Art. 7(1) GDPR).
  • Withdrawable: Withdrawing must be as easy as giving consent (Art. 7(3) GDPR).
  • In advance: Services that require consent may only load after the visitor agrees.

Extensions for cookie banners control which services load only after consent. Check technically that this actually happens. Even with shortened IP addresses you still need to check whether section 25 TDDDG and a legal basis under Art. 6 GDPR apply.

Hosting, fonts and third countries

Hosting and external resources

Hosting within the EU or EEA avoids a transfer to a third country within the meaning of Art. 44 et seq. GDPR. It does not replace a data processing agreement under Art. 28 GDPR. Also check there whether the host uses sub-processors. Fonts and scripts can be hosted locally so that visitor IP addresses do not reach external servers. Also keep your TYPO3 installation updated, see TYPO3 updates and security updates.

Google Fonts: what the Munich court ruled

In a judgment of 20 January 2022 (case 3 O 17493/20), the Regional Court Munich I awarded a website visitor 100 euros in damages and also upheld a claim to cease and desist, because his IP address was transmitted to Google without consent when Google Fonts were loaded dynamically. We rely here on the account of the judgment by dsgvo-schmerzensgelder.de, in German (retrieved 27 October 2026); we could not retrieve the full text from an official source. It is a decision of a single court in an individual case and is not binding nationwide. By order of 28 August 2025 (VI ZR 258/24) the Federal Court of Justice (BGH) referred questions on the interpretation of the GDPR to the CJEU, among them whether a dynamic IP address is personal data and whether damages can arise where the data subject deliberately causes the infringement for that sole purpose (BGH referral order, in German). We found no CJEU decision on this as of 27 October 2026.

Data transfers to the US

Transfers to third countries are governed by Art. 44 et seq. GDPR. An adequacy decision of the European Commission (Art. 45 GDPR) allows them without specific authorisation. For the US, such a decision on the EU-US Data Privacy Framework has existed since 10 July 2023 (Implementing Decision (EU) 2023/1795). It applies to recipients certified under the framework (list of the US Department of Commerce). The General Court dismissed the action against the decision (case T-553/23, Latombe v Commission) on 3 September 2025 (press release of the General Court). Philippe Latombe lodged an appeal with the Court of Justice on 31 October 2025 (C-703/25 P, Official Journal C/2025/6610). We found no decision on it as of 27 October 2026, and the situation may change.

Server log files, forms and data subject rights

Dynamic IP addresses can be personal data (CJEU, judgment of 19 October 2016, C-582/14, Breyer). This also applies to IP addresses in server log files. Store them only as long as the purpose requires (Art. 5(1)(e) GDPR). Limit forms to necessary fields, transmit them encrypted and delete data after set periods.

Access, rectification and erasure (Art. 15 to 17 GDPR) need clear processes. Requests must be answered without undue delay and in any event within one month. Where requests are complex or numerous, the period can be extended by a further two months, and you must inform the person within the first month (Art. 12(3) GDPR). Decide who handles requests.

Security and documentation

Controllers and processors implement technical and organisational measures appropriate to the risk (Art. 32 GDPR). The provision names, among others, encryption, the ability to restore data quickly after an incident and a process for regularly testing the measures. In TYPO3 this includes, for example, access rights (access control), regular backups and measures from the glossary entry on security. For hosting questions see hosting.

Data processing agreements under Art. 28 GDPR should exist with hosts, newsletter providers and analytics services. A record of processing activities (Art. 30 GDPR) is not always required for organisations with fewer than 250 employees, but it is, among other cases, where processing is not merely occasional. Document your measures and review them regularly, especially after updates or new functions.

Fines and damages

For infringements of the principles (Art. 5), legal bases (Art. 6), consent (Art. 7), data subject rights (Art. 12 to 22) or third-country transfers (Art. 44 to 49), the supervisory authority can impose fines of up to EUR 20 million or up to 4% of worldwide annual turnover, whichever is higher (Art. 83(5) GDPR). For breaches of obligations such as Art. 28, 30 and 32, the limit is up to EUR 10 million or 2% (Art. 83(4) GDPR). The amount in a given case depends on the circumstances (Art. 83(2) GDPR). In addition, data subjects can claim damages (Art. 82 GDPR).

Current developments

On 19 November 2025, the European Commission proposed the Digital Omnibus (COM(2025) 837 final), which would change, among other things, the GDPR and cookie rules. According to the overview at eudigitalpolicy.eu (last verified there on 21 October 2026), this part is a proposal and not applicable law. Until then, the GDPR and section 25 TDDDG apply unchanged. Case law on Google Fonts and the Data Privacy Framework is still evolving (see above).

We support you with the technical implementation in your TYPO3 system.

Status: 27 October 2026. General information, not legal advice. For binding statements, consult specialists in data protection law. Sources: GDPR (Regulation (EU) 2016/679), TDDDG, in German, Section 5 DDG, in German, General Court press release on T-553/23, BGH referral order VI ZR 258/24, in German. Secondary sources: dsgvo-schmerzensgelder.de (Regional Court Munich I), in German, eudigitalpolicy.eu (Digital Omnibus), Taylor Wessing (DDG), in German.

Frequently asked questions about TYPO3 and GDPR

Personal data in forms, cookies, tracking, user accounts and logs must be processed in line with the GDPR (Regulation (EU) 2016/679). This includes a legal basis (Art. 6), information for visitors (Art. 13), suitable technical measures (Art. 32) and contracts with service providers (Art. 28). TYPO3 provides building blocks; responsibility lies with the operator.

For cookies and similar technologies on the user's device, consent is required under section 25(1) TDDDG. The exception is what is strictly necessary for a digital service the user has expressly requested (section 25(2) no. 2 TDDDG). Consent must be active, informed, provable and withdrawable.

No legal rule names Google Fonts explicitly. When loaded dynamically, the visitor's IP address is transmitted to Google. On 20 January 2022 the Regional Court Munich I (3 O 17493/20) therefore awarded 100 euros in damages, without nationwide binding effect (according to the account of the judgment at dsgvo-schmerzensgelder.de, retrieved 27 October 2026). With local hosting this transmission does not occur.

Yes, if a service provider processes personal data on your behalf, for example hosts, newsletter tools or analytics services. The basis is Art. 28 GDPR. For providers outside the EU, also check the third-country transfer under Art. 44 et seq. GDPR.

This is possible under the EU-US Data Privacy Framework if the recipient is certified. The Commission's adequacy decision has applied since 10 July 2023. The General Court dismissed the action against it on 3 September 2025 (T-553/23). The appeal (C-703/25 P) was lodged on 31 October 2025; we found no decision on it as of 27 October 2026. Keep watching developments.

For infringements of principles, legal bases, consent, data subject rights or third-country transfers, fines of up to EUR 20 million or 4% of worldwide annual turnover are possible, whichever is higher (Art. 83(5) GDPR). For obligations such as processing agreements, records and security, the limit is up to EUR 10 million or 2% (Art. 83(4)).

Without undue delay and in any event within one month of receipt. Where requests are complex or numerous, the period can be extended by a further two months if you inform the person within the first month (Art. 12(3) GDPR).