FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
CDN

Bunny.net

UnclassifiedOfficial website

Bunny.net is a Slovenian content delivery network with an EU first edge network of 119 points of presence, optional EU only delivery, edge storage and a privacy first video stream product. No cookies are set by default and the company has no US parent company.

Block Bunny.net until consentScan my site
Overview

What does Bunny.net do?

What Bunny.net is

Bunny.net is a content delivery network and edge platform operated by BunnyWay d.o.o., a Slovenian company. The product line includes the Bunny CDN with 119 points of presence, Bunny Edge Storage (object storage in 9 regions), Bunny Stream (video CDN with HLS and DRM), Bunny Shield (WAF and bot mitigation), Bunny Optimizer (image optimisation), Bunny DNS and Bunny Fonts (privacy first Google Fonts mirror with EU only delivery). Bunny is widely considered the most EU centric major CDN.

EU residency and no CLOUD Act exposure

Bunny.net offers EU only delivery and storage regions: traffic, cache and logs stay inside the European Economic Area. Bunny Edge Storage is available in Falkenstein (Germany), Stockholm (Sweden), London (UK), Los Angeles, New York, Singapore, Sao Paulo, Sydney and Johannesburg, with EU only and global pricing tiers. Because Bunny is a Slovenian company with no US parent company and no US legal presence at the corporate level, the US CLOUD Act does not apply: a US warrant cannot compel Bunny to disclose European customer data.

GDPR and ePrivacy implications

The Bunny CDN sets no cookies by default. Edge Rules and Bunny Shield can set strictly necessary security cookies (bunny_*) under the ePrivacy art. 5(3) exemption. The optional Bunny Analytics module exposes traffic counters at the edge without setting any visitor identifier on the device, so it usually qualifies for the CNIL audience measurement exemption when no cross site joining occurs. For Bunny Stream, cookies are limited to playback state and quality, set only when the player loads on the customer site.

How Bunny processes visitor data

For each request Bunny processes the visitor IP (truncated for analytics, retained full for security up to 24 hours), the user agent, the URL and the referer. The processing is governed by the standard Bunny Data Processing Addendum which references GDPR art. 28 and includes EU only sub processor commitments on demand. Logs are retained for the period the customer chooses, from 24 hours up to 1 year, and can be shipped to the customer S3 compatible bucket through Log Forwarding.

Recommended setup for European publishers

Choose the EU only delivery tier, pick Falkenstein or Stockholm as the primary Edge Storage region, sign the Bunny DPA, enable the privacy friendly Bunny Analytics if you do not already use a separate analytics tool, replace Google Fonts with Bunny Fonts (CDN compatible drop in), configure Edge Rules to truncate the IP in the logs, and document Bunny as a sub processor in your record of processing alongside the EU only commitment.

Compliance

Bunny.net and the GDPR

Legal basis
For the standard CDN delivery: legitimate interest of the publisher (GDPR art. 6(1)(f)) in delivering the website and contractual necessity (art. 6(1)(b)) when the visitor requested the page. No cookies are set by the Bunny CDN itself unless the customer configures Edge Rules or Bunny Shield protection cookies which are strictly necessary under ePrivacy art. 5(3). Consent is required only if the customer enables the optional Bunny Analytics with persistent visitor identification.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, CNIL exemption for security and routing cookies, EU regulation 2022/2065 (DSA), Slovenian ZVOP-2

Impact assessment (DPIA)

A DPIA is generally not required for the Bunny CDN, which is a technically necessary delivery intermediary fully inside the EU. A DPIA is recommended only when the customer activates Bunny Analytics with persistent visitor identification or when Bunny Shield is used as the main bot protection layer. The DPIA should then document the cookie set, the retention of the logs (configurable from 24 hours to 1 year) and the customer side configuration of Edge Rules.

Sample text for your banner

Our website is delivered through Bunny.net, a European content delivery network headquartered in Slovenia. Bunny.net does not set any cookie by default and does not transfer your data outside the European Economic Area unless we explicitly enable the global delivery tier. If we activate Bunny Analytics or Bunny Shield protection cookies, this notice is updated accordingly.
Cookies and trackers

What Bunny.net sets and contacts

Tracking method
content_delivery_network_with_eu_first_anycast_edge_network_and_security_layer
Server location
Bunny.net is operated by BunnyWay d.o.o., a Slovenian company headquartered in Ljubljana. The Bunny CDN runs on 119 points of presence across 6 continents with strong European coverage (Amsterdam, Frankfurt, London, Paris, Madrid, Milan, Stockholm, Warsaw, Bucharest, Prague, Vienna). Bunny offers EU only delivery regions where the traffic and the cache stay inside the European Economic Area. Bunny Storage and Bunny Stream EU regions are physically located in Falkenstein (Germany) and Stockholm (Sweden).
Cookieless mode available
Yes

Cookies set (4)

NameTypeDurationPurpose
none by defaultFirst party (Bunny CDN)N/AThe Bunny CDN sets no cookies by default. Only Edge Rules or Bunny Shield set strictly necessary security cookies when activated
bunny_shield_*First party (Bunny Shield, optional)Up to 1 dayBot detection and rate limiting state when Bunny Shield is activated
bvp_sessionFirst party (Bunny Stream player, optional)SessionTracks the current video playback session when the Bunny Stream player is embedded
bvp_resumeFirst party (Bunny Stream player, optional)7 daysStores the resume point for the visitor in the Bunny Stream player

Third-party domains contacted (6)

  • b-cdn.net
  • bunny.net
  • bunnycdn.com
  • fonts.bunny.net
  • iframe.mediadelivery.net
  • video.bunnycdn.com
Questions

Frequently asked questions about Bunny.net

Can't find your question? Write to us, we answer fast.

What cookies does Bunny.net set?

By default Bunny.net sets no cookies. Edge Rules and Bunny Shield may set strictly necessary security cookies (bunny_session, bunny_shield_*) under the ePrivacy art. 5(3) exemption. The Bunny Stream player sets bvp_session (playback state) and bvp_resume (resume point) only when the customer embeds the video player.

Is consent required for Bunny.net?

No for the standard CDN, since no cookies are set. Yes only if you enable Bunny Analytics with persistent visitor identification (rare) or Bunny Stream which sets playback cookies on consent. Edge security cookies are exempt.

What is the legal basis for Bunny.net?

Article 6(1)(b) GDPR (contract, the visitor requested the page) and art. 6(1)(f) (legitimate interest in delivery). For Bunny Stream playback cookies and Bunny Analytics with identification: article 6(1)(a) consent. Article 28 GDPR governs the processor relationship.

Are data transferred outside the EU?

No by default if the EU only delivery tier is selected. Bunny is a Slovenian company with no US parent company, so the US CLOUD Act does not apply. With the global delivery tier traffic may transit non EU points of presence but storage remains in the chosen region.

Do I need a DPIA for Bunny.net?

Rarely. Not for the standard CDN inside the EU. Recommended when Bunny Analytics with persistent identifier or Bunny Shield with advanced bot detection is activated. The DPIA should document log retention, the global vs EU only choice and any Edge Rule modifying personal data.

How do I implement Bunny.net compliantly?

Sign the Bunny DPA, choose the EU only delivery tier and Falkenstein or Stockholm storage, replace Google Fonts with Bunny Fonts, configure log retention to the minimum needed, document Bunny as a sub processor and surface the EU only commitment in the privacy notice.

What are the alternatives to Bunny.net?

For an EU first CDN: Gcore (Luxembourg), KeyCDN (Switzerland), CDN77 (Czech Republic). For more global with EU residency: Cloudflare (EU Regional Services), Fastly, CloudFront. Bunny remains the clearest EU only option at the corporate level alongside Gcore.

How do I update my cookie policy after adding Bunny.net?

State that the CDN is operated by BunnyWay d.o.o. (Slovenia), confirm the EU only delivery tier, declare any strictly necessary security cookies if activated, mention that no transfers outside the EU occur, link to the Bunny Trust Center and note the absence of US CLOUD Act exposure as a positive guarantee.

Same category

More services: CDN

See the whole category

Bootstrap CDN

Bootstrap CDN is a content delivery network (CDN) that accelerates website performance by distributing content across a global network of edge servers. It reduces latency, improves page load times, and handles traffic spikes by serving cached content from the nearest location. Bootstrap CDN supports static and dynamic content acceleration, DDoS protection, and SSL/TLS encryption. With real-time analytics and purge capabilities, Bootstrap CDN ensures fast, reliable delivery.

CDN

Widen

Widen is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Widen integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Widen helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Azure Front Door

Azure Front Door is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Azure Front Door provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Azure Front Door helps deliver the right message to the right audience at the right time.

Essential

GoCache

GoCache is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GoCache supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GoCache ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CDN

Font Awesome

Font Awesome is a web font service providing access to a curated library of high-quality typefaces optimized for digital use. It delivers fonts through a global CDN with smart caching and efficient loading to minimize performance impact. Font Awesome supports variable fonts, subsetting, and display optimization, helping designers create beautiful typography while maintaining fast page loads. With easy integration and broad browser support, Font Awesome enhances aesthetics.

Essential

Speed Kit

Speed Kit is a web performance optimization platform that helps websites load faster and deliver better user experiences. It provides detailed performance metrics, Core Web Vitals monitoring, and actionable optimization recommendations. Speed Kit analyzes page speed, resource loading, and rendering to identify bottlenecks impacting user experience and search rankings. With automated optimization and real-time monitoring, Speed Kit helps businesses achieve faster load times and improved SEO.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site