Privacy policy clauses for PHP
PHP is a server-side scripting language that processes requests and generates web pages before sending them to your browser. Websites use PHP to build dynamic functionality, handle form submissions, manage user interactions, and maintain session state without storing sensitive data on your device.
Free scan · No signup · Results in 60 seconds
What data PHP collects
Your privacy policy must disclose each of the following data types when you use PHP.
When does PHP trigger privacy obligations?
When PHP Triggers Privacy Obligations
PHP's core privacy obligation activates the moment you use server-side sessions via `session_start()`. This automatically sets a `PHPSESSID` cookie on the user's browser — a first-party, strictly necessary cookie that identifies and persists the user's session state on your server.
### The Data Flow
When PHP sessions are enabled, every request transmits the PHPSESSID cookie back to your server, allowing you to retrieve and store session data (login tokens, user IDs, form state, preferences). This constitutes automated personal data processing under GDPR Article 4(1) (any identified or identifiable natural person) and CCPA Section 1798.100 (personal information collected by a business).
### Jurisdiction Thresholds
- –GDPR: Applies if your users include any EU residents, regardless of your business location.
- –CCPA: Applies if you operate a for-profit business serving California consumers and meet one of three thresholds (annual revenue >$25M, buy/sell data on 100k+ Californians, or derive 50%+ revenue from selling consumer data).
