> How Azure CDN handles personal data, when consent is needed for CDN cookies, EU point of presence selection, US transfers and a compliance checklist.
>
> Canonical: https://www.flowconsent.com/en/services/cdn/azure-cdn

CDN

# Azure CDN

Unclassified · [Official website](https://azure.microsoft.com/en-us/services/cdn/)

Azure CDN is the Microsoft Azure content delivery network that caches and serves static assets and dynamic responses from edge nodes worldwide.

[Block Azure CDN until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cdn) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [CDN](https://www.flowconsent.com/en/services/cdn)

- Consent

  Unclassified

- Prior consent

  Not required

- Documented cookies

  0

- Third-party domains

  4

- Servers

  Microsoft Azure edge network worldwide; subset of EU points of presence (Amsterdam, Paris, Frankfurt, Madrid, Stockholm, etc.)

Overview

## What does Azure CDN do?

## **What is Azure CDN**

Azure CDN is the Microsoft Azure content delivery network. It pulls assets from your origin (Azure Storage, App Service or any HTTP origin) and serves them from a network of edge points of presence worldwide, including multiple cities in the EU. Microsoft also offers Azure Front Door, a higher level edge service that combines CDN, WAF, load balancing and routing.

## **What data Azure CDN processes**

A typical CDN request handles the visitor IP address, the HTTP user agent, the requested URL, referer, country (derived from IP geolocation) and any cookies the origin already set on your domain. Azure CDN does not on its own deposit tracking cookies, but it logs requests in diagnostic logs and metrics. The Rules Engine can transform headers or set custom cookies; those become part of your processing.

## **GDPR and ePrivacy implications**

IP addresses and request metadata processed by Azure CDN are personal data under the GDPR. The activity is strictly necessary for delivering the website, so legitimate interest typically applies and no consent is required. The ePrivacy Directive only enters the picture if you deliberately configure the CDN to set cookies (eg session affinity, A/B test bucket), in which case the consent regime that applies to the cookie applies.

## **Consent and legal basis**

Legitimate interest covers the strictly necessary CDN delivery. Contract performance applies when Azure CDN powers a paid product. Any non essential cookie added via the Rules Engine needs its own basis, typically consent. Document the role of Azure CDN as a sub processor under the Microsoft Online Services DPA.

## **Data transfers and EU points of presence**

Microsoft Azure has many EU points of presence (Amsterdam, Paris, Frankfurt, Madrid, Stockholm and more). The visitor request is normally served from the nearest PoP. However Microsoft Corporation, headquartered in Redmond, USA, is the controller of the diagnostic data and may access logs from the US for support purposes. Transfers are covered by the EU US Data Privacy Framework and Microsoft Online Services Standard Contractual Clauses.

## **Practical compliance steps**

Configure your Azure CDN profile to use EU regions for diagnostic logs. Enable Private Link from origin to the CDN. Avoid Rules Engine cookies unless strictly needed; if used, list them in the cookie policy. Limit access log retention to what is necessary for security and billing, ideally less than 30 days. Sign the Microsoft Online Services DPA and document the CDN in your records of processing activities.

Compliance

## Azure CDN and the GDPR

- Legal basis

  Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary delivery of website assets, or contract performance (Art. 6(1)(b) GDPR) when used to power a paid product

- Risk level

  low

- Applicable regulations

  GDPR, ePrivacy Directive (only when CDN cookies are deliberately set), Microsoft Online Services DPA

### Impact assessment (DPIA)

A DPIA is typically not required for plain content delivery, but is recommended when Azure CDN routing rules or rules engine alter responses based on IP or fingerprint, or when access logs are fed into a profiling pipeline.

### Sample text for your banner

> We rely on Azure CDN to deliver static assets from a fast edge node near you. No tracking cookies are set; only an IP address and a user agent are processed for routing and security. This is part of the strictly necessary delivery of the website.

Cookies and trackers

## What Azure CDN sets and contacts

- Tracking method

  Server side HTTP edge cache delivering static assets and dynamic responses via Microsoft Azure edge nodes

- Server location

  Microsoft Azure edge network worldwide; subset of EU points of presence (Amsterdam, Paris, Frankfurt, Madrid, Stockholm, etc.)

- Cookieless mode available

  Yes

- Data transferred outside the EU

  Azure CDN is operated by Microsoft Corporation, headquartered in the United States. Even when traffic is served from EU points of presence, infrastructure operations and support involve Microsoft entities outside the EEA. Transfers rely on the EU US Data Privacy Framework and Microsoft Online Services Standard Contractual Clauses.

### Third-party domains contacted (4)

- `azureedge.net`
- `azurefd.net`
- `msecnd.net`
- `azurewebsites.net`

Questions

## Frequently asked questions about Azure CDN

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### Does Azure CDN set cookies?

By default, Azure CDN does not set tracking cookies. Any cookie returned to the user comes from your origin or from a Rules Engine action you configured (eg session affinity).

### Is consent required for Azure CDN?

No, when the CDN simply delivers your website assets and processes IP addresses for routing and security, legitimate interest applies. Consent only becomes necessary if you deliberately set cookies through the Rules Engine.

### Which GDPR legal basis applies?

Legitimate interest (Art. 6(1)(f) GDPR) for the strictly necessary delivery, or contract performance (Art. 6(1)(b) GDPR) when Azure CDN powers a paid product. Any Rules Engine cookie that goes beyond strict necessity needs its own basis, typically consent.

### Are there transfers to the United States?

Microsoft Corporation is US headquartered and may access diagnostic logs from the US for support. Transfers rely on the EU US Data Privacy Framework and the Microsoft Online Services DPA, including Standard Contractual Clauses.

### Do I need a DPIA for Azure CDN?

Usually not. A DPIA becomes relevant when Rules Engine rules transform content based on IP or fingerprint, or when access logs are pushed to a profiling pipeline.

### How do I implement Azure CDN compliantly?

Pick EU points of presence and an EU diagnostic log region, set short retention on logs, avoid Rules Engine cookies, sign the Microsoft Online Services DPA and add Azure CDN to your records of processing activities.

### Are there alternatives to Azure CDN?

EU based alternatives include OVHcloud CDN, Scaleway Edge Services, BunnyCDN (Slovenia), KeyCDN (Switzerland), Gcore (Luxembourg), Akamai EU and Cloudflare (with EU only routing).

### How do I update my cookie policy?

If you do not set Rules Engine cookies, you do not need to list Azure CDN in the cookie policy. Mention Microsoft as a sub processor in the privacy policy and disclose the EU US Data Privacy Framework basis for diagnostic data transfers.

Same category

## More services: CDN

[See the whole category](https://www.flowconsent.com/en/services/cdn)

### [Bunny](https://www.flowconsent.com/en/services/cdn/bunny)

[Bunny is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Bunny integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Bunny helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/bunny)

[CDN](https://www.flowconsent.com/en/services/cdn/bunny)

·

### [Oracle Web Cache](https://www.flowconsent.com/en/services/cdn/oracle-web-cache)

[Oracle Web Cache is a web performance optimization tool that helps websites load faster by implementing caching, lazy loading, and resource optimization techniques. It automatically compresses and minifies CSS, JavaScript, and images. Oracle Web Cache improves Core Web Vitals scores, enhances user experience, and boosts search engine rankings through intelligent optimization strategies. With easy implementation and real-time monitoring, Oracle Web Cache delivers measurable speed improvements.](https://www.flowconsent.com/en/services/cdn/oracle-web-cache)

[CDN](https://www.flowconsent.com/en/services/cdn/oracle-web-cache)

·

### [Cloudflare Rocket Loader](https://www.flowconsent.com/en/services/cdn/cloudflare-rocket-loader)

[Cloudflare Rocket Loader is a customer support and helpdesk platform that helps businesses manage, track, and resolve customer inquiries efficiently. It provides a unified ticketing system, knowledge base, and multi-channel support across email, chat, phone, and social media. Cloudflare Rocket Loader features automated ticket routing, SLA management, and self-service portals, enabling faster resolutions, higher satisfaction, and reduced operational costs for support teams.](https://www.flowconsent.com/en/services/cdn/cloudflare-rocket-loader)

[CDN](https://www.flowconsent.com/en/services/cdn/cloudflare-rocket-loader)

·

### [BerqWP](https://www.flowconsent.com/en/services/cdn/berqwp)

[BerqWP is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. BerqWP offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, BerqWP empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cdn/berqwp)

[CDN](https://www.flowconsent.com/en/services/cdn/berqwp)

·

### [Statically](https://www.flowconsent.com/en/services/cdn/statically)

[Statically is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Statically supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Statically ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cdn/statically)

[CDN](https://www.flowconsent.com/en/services/cdn/statically)

·

### [Section.io](https://www.flowconsent.com/en/services/cdn/section-io)

[Section.io is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Section.io integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Section.io helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/section-io)

[CDN](https://www.flowconsent.com/en/services/cdn/section-io)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)