Does Kentico require cookie consent?

Yes. Kentico Xperience is classified under analytics and marketing. Its CurrentContact persistent cookie (1-year lifespan), A/B test variant cookies, and behavioral profiling for marketing automation all require prior consent. Use Kentico's built-in CMSCookieLevel system to gate these features.

What cookies does Kentico set?

Kentico sets CMSCookieLevel (stores consent level), CurrentContact (persistent visitor GUID, 1 year), VisitorStatus (new vs. returning), CMSPreferredCulture (language preference), and ABTestXY cookies for A/B variant assignment. All tracking cookies are first-party since Kentico runs on your own domain.

How does ConsentStack handle Kentico?

ConsentStack categorizes Kentico under analytics and marketing, blocking behavioral tracking and A/B testing features until consent is granted. For Kentico sites, ConsentStack integrates with the CMSCookieLevel system to activate the correct tracking tier based on the visitor's consent choices.

What tracker domains does Kentico use?

ConsentStack has catalogued tracker domains for Kentico including kentico.com. These are the network destinations Kentico's scripts contact, which a consent platform blocks until a visitor agrees.

Kentico - CMS Analytics & Privacy Management

Back to Vendor Library

Overview

Kentico is a .NET-based digital experience platform that integrates content management, digital marketing, and e-commerce into a unified system. Originally launched as a traditional CMS, it has evolved into two products: Kentico Xperience (the full DXP) and Kentico Kontent (a headless CMS, now rebranded as Kontent.ai). When this entry refers to Kentico, it covers the Xperience platform, which is the variant that deploys marketing automation, A/B testing, and analytics scripts on websites.

What This Script Does

Kentico Xperience embeds several tracking and marketing automation components into websites built on its platform:

Session and Visitor Tracking

Kentico sets multiple cookies to manage visitor identification and session state:

CMSCookieLevel — stores the visitor's cookie consent level (an integer value representing which cookie categories are accepted)
CurrentContact — a persistent cookie containing the visitor's contact GUID, used to link browsing sessions to contact records in Kentico's contact management database (lifespan: typically 1 year)
VisitorStatus — indicates whether the visitor is new or returning
CMSPreferredCulture — stores the visitor's language preference for multilingual sites

Analytics and A/B Testing

Tracks page views, landing pages, referral sources, and campaign parameters for web analytics reporting
Records conversion events (form submissions, purchases, downloads) and attributes them to campaigns or A/B test variants
Manages A/B and multivariate test variant assignment, setting cookies like ABTestXY to ensure consistent variant delivery across pages and sessions
Logs on-site search keywords for content performance analysis

Marketing Automation

Fires trigger events for marketing automation workflows based on visitor behavior (e.g., visited pricing page, downloaded whitepaper)
Tracks email campaign clickthroughs when visitors arrive from Kentico-sent emails, linking the web session to the email contact record
Scores leads based on accumulated behavioral data and page visit patterns

Data is processed server-side within the Kentico Xperience application. Unlike third-party SaaS analytics tools, Kentico's tracking runs on the same domain as the website, making all cookies first-party.

Consent & Compliance

Kentico spans both analytics and marketing categories. Under GDPR and ePrivacy, the persistent contact identification cookie (CurrentContact), behavioral tracking, A/B testing cookies, and marketing automation triggers all require prior consent. Kentico Xperience includes a built-in cookie consent level system — the CMSCookieLevel cookie — which is designed to control which tracking features activate based on visitor consent.

The CMSCookieLevel values typically map to: Level 0 (essential only), Level 200 (editor/preferences), Level 1000 (analytics and marketing). Configuring these levels correctly is essential for compliance, and they should be integrated with your external consent management platform if one is used.

Under CCPA/CPRA, the visitor profiles and behavioral data Kentico collects constitute personal information. Since Kentico processes this data within your own infrastructure (as a self-hosted or PaaS CMS), it functions as your own first-party data collection — you are the data controller and processor. Privacy policy disclosures and consumer rights mechanisms must cover this data collection.

Should You Block This Without Consent?

Yes. Kentico's analytics tracking, A/B testing, and marketing automation features collect behavioral data for purposes beyond what is strictly necessary for delivering the website content. The CurrentContact cookie and associated behavioral profiling require consent. Use Kentico's built-in CMSCookieLevel system or an external consent manager to gate these features behind visitor consent.

Is Kentico GDPR compliant?

Kentico typically loads analytics and marketing trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Kentico can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Kentico, not on Kentico itself.

Visit website