FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Analytics

Cloudflare Zaraz

UnclassifiedOfficial website

Cloudflare Zaraz is a server side tag manager that runs third party tags on Cloudflare Workers, replacing browser tags with edge processed events and a built in consent layer.

Block Cloudflare Zaraz until consentScan my site
Overview

What does Cloudflare Zaraz do?

What Cloudflare Zaraz is

Cloudflare Zaraz is a third party tag manager that runs on Cloudflare Workers at the network edge. Instead of loading dozens of tags directly in the visitor browser, the website sends a single request to Zaraz, which then dispatches server side calls to the configured destinations. Zaraz ships with a built in consent layer that can either replace a CMP for simple deployments or integrate with a more advanced one.

Cookies and data collected

Zaraz writes a first party cookie that records the consent decision per category. The events themselves include URL, referrer, screen size and any custom payload defined by the operator. The destinations behind Zaraz can still set their own cookies if the integration uses pixel mode, but Zaraz can also relay events purely server side, which significantly reduces third party cookies on the visitor browser.

GDPR and ePrivacy obligations

Even when tags are executed at the edge, the consent rules of article 5(3) of the ePrivacy Directive still apply because the destinations process personal data of the visitor. Zaraz must therefore be configured so that non essential destinations do not run before the visitor has accepted the corresponding category. The website operator remains the controller for the destinations, and Cloudflare is the processor for the edge execution.

Consent and configuration

Map every destination to a consent category, configure default reject for non essential categories, and use the Zaraz consent API to gate event dispatch on the consent state. Where Zaraz acts purely as a server side relay, hash personal identifiers before transmission and consider running the tag on first party domains instead of the default cdn-cgi path.

Data transfers and storage

Cloudflare runs a global edge network. EU traffic can be pinned to European data centres through the Cloudflare Data Localisation Suite, but logs and configuration data may still be processed in the United States. The Cloudflare DPA, the EU-US Data Privacy Framework and Standard Contractual Clauses are the legal instruments that frame those transfers.

Practical compliance steps

Sign the Cloudflare DPA, enable the Data Localisation Suite for EU only routing, configure default reject in the Zaraz consent layer, document each destination and its legal basis, and review server side payloads quarterly to ensure no field has been added without privacy review.

Compliance

Cloudflare Zaraz and the GDPR

Cloudflare Zaraz is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR) for the third party tags executed by Zaraz; legitimate interest (Art. 6(1)(f)) for strictly necessary tags such as security or anti fraud
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, EU-US Data Privacy Framework, IAB TCF v2.2

Impact assessment (DPIA)

A DPIA is appropriate when Zaraz orchestrates a large set of advertising tags, when EU data is routed through US edge points of presence without the Data Localisation Suite, or when consent is fully delegated to the Zaraz consent layer for many destinations.

Sample text for your banner

We use Cloudflare Zaraz to load third party tags such as analytics and advertising from our servers rather than directly from your browser. By accepting, you allow Zaraz to set a consent cookie and to forward your interactions to the destinations you have enabled.
Cookies and trackers

What Cloudflare Zaraz sets and contacts

Tracking method
Server side tag manager that runs third party tags on Cloudflare Workers at the edge instead of in the browser; consent state is read from a first party cookie and propagated to each tag
Server location
Cloudflare global edge network with the closest point of presence to the visitor; logs and configuration stored regionally including European data centres
Cookieless mode available
Yes
Data transferred outside the EU
Cloudflare is a US company. EU traffic can be pinned to EU points of presence via the Cloudflare Data Localisation Suite, but logs and configuration may still touch the United States. Transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.

Cookies set (2)

NameTypeDurationPurpose
cf_zarazStrictly necessary1 yearStores the visitor consent decisions managed by the Cloudflare Zaraz consent layer.
__cf_zidFunctionalSessionInternal Zaraz session identifier used to deduplicate edge events.

Third-party domains contacted (3)

  • cloudflare.com
  • cdn-cgi
  • zaraz.cloudflare.com
Questions

Frequently asked questions about Cloudflare Zaraz

Can't find your question? Write to us, we answer fast.

What cookies does Cloudflare Zaraz set?

Zaraz writes a cf_zaraz consent cookie that records the visitor consent decisions per category. Tags executed behind Zaraz can still set their own cookies if pixel mode is used; in pure server side mode the visitor browser sees no third party cookies.

Do I need consent to use Cloudflare Zaraz?

Yes for any non essential destination orchestrated by Zaraz. The consent rules of article 5(3) of the ePrivacy Directive apply to the destinations themselves, even when they are executed at the edge instead of in the browser.

What is the legal basis for processing data through Zaraz?

Consent for advertising and analytics destinations, legitimate interest for strictly necessary tags such as security or anti fraud, and contractual necessity for destinations directly required to fulfil a customer request.

Does Cloudflare Zaraz transfer data to the United States?

Cloudflare is a US company with global edge points of presence. EU traffic can be pinned to European data centres with the Data Localisation Suite, but logs and configuration may still be processed in the US. Transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework.

Do I need a DPIA for Cloudflare Zaraz?

A DPIA is appropriate when many advertising destinations are orchestrated by Zaraz, when EU data is routed without the Data Localisation Suite, or when the consent layer is the only gating mechanism for downstream destinations.

How do I implement Cloudflare Zaraz compliance correctly?

Sign the Cloudflare DPA, enable the Data Localisation Suite, default reject in the consent layer, map every destination to a category, document the destination list and review server side payloads each quarter.

What are the alternatives to Cloudflare Zaraz?

Other server side or hybrid tag managers include Google Tag Manager Server Side, Tealium iQ, Commanders Act TagCommander, Stape, Snowplow, RudderStack and self hosted Workers based proxies.

How should I update my cookie policy when I deploy Cloudflare Zaraz?

List the cf_zaraz consent cookie alongside any cookies set by the destinations behind it, name Cloudflare as a processor, document the destination list and any US transfer, and explain how visitors can revoke their consent through your CMP or the Zaraz consent layer.

Same category

More services: Analytics

See the whole category

Jetpack

Jetpack is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Jetpack offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Jetpack empowers organizations to optimize strategy and maximize return on investment.

Analytics

Blutui

Blutui is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Blutui supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Blutui enables informed decisions that improve experience and drive results.

Analytics

INFOnline

INFOnline is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. INFOnline supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, INFOnline enables informed decisions that improve experience and drive results.

Analytics

LeadsSight

LeadsSight is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. LeadsSight offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, LeadsSight empowers organizations to optimize strategy and maximize return on investment.

Analytics

Monitus

Monitus is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Monitus supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Monitus enables informed decisions that improve experience and drive results.

Analytics

Sub2Tech

Sub2Tech is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Sub2Tech offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Sub2Tech empowers organizations to optimize strategy and maximize return on investment.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site