> cdnjs is a Cloudflare CDN for JavaScript libraries. Cookies, ePrivacy consent and US data transfers explained for European websites. > > Canonical: https://www.flowconsent.com/en/services/cdn/cdnjs CDN # cdnjs Unclassified cdnjs is a free, open source content delivery network operated by Cloudflare that hosts more than four thousand JavaScript and CSS libraries, including jQuery, Bootstrap, Font Awesome, lodash, Moment.js, popper.js and many others. Developers reach it through cdnjs.cloudflare.com and get the file from the nearest Cloudflare edge. cdnjs itself does not set marketing cookies, but the underlying Cloudflare network can set the \_\_cf\_bm bot management cookie and logs every HTTP request, which raises the same GDPR questions as any other US CDN. [Block cdnjs until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cdn) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CDN](https://www.flowconsent.com/en/services/cdn) - Consent Unclassified - Prior consent Required - Documented cookies 1 - Third-party domains 3 - Servers Global Cloudflare anycast edge network with more than 300 cities including Frankfurt, Amsterdam, Paris, Madrid, Stockholm, Warsaw and Milan. Origin servers are operated by Cloudflare Inc. Overview ## What does cdnjs do? ## **What cdnjs does and how it appears on a website** cdnjs is a free, open source content delivery network maintained by Cloudflare that hosts more than four thousand JavaScript and CSS libraries. Developers paste a URL such as https\://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js into a script tag and Cloudflare serves the file from its global anycast edge. cdnjs is widely used for jQuery, Bootstrap, Font Awesome, lodash, Moment.js, anime.js, popper.js, Chart.js, Highlight.js and many more. ## **Cookies and data collected by cdnjs** cdnjs itself does not deploy analytics or marketing cookies. The underlying Cloudflare network can set the \_\_cf\_bm bot management cookie (30 minutes) on the cdnjs.cloudflare.com domain when it detects suspicious traffic. Every HTTP request is logged for cache statistics and abuse prevention, including the visitor IP, User-Agent header, requested URL and Referer header. ## **GDPR and ePrivacy implications** Article 5(3) ePrivacy applies because \_\_cf\_bm, even if classified as bot protection, is stored on the user device. Cloudflare argues that \_\_cf\_bm is strictly necessary, but several European supervisory authorities prefer informed consent. The transmission of the visitor IP to a US controlled provider also triggers GDPR rules on transfer and lawful basis. ## **International data transfers** Cloudflare Inc. is a US company subject to the CLOUD Act and FISA 702. It is certified under the EU-US Data Privacy Framework, which provides an adequacy basis for transfers to the United States. Cloudflare signs Standard Contractual Clauses in its enterprise DPA and has launched a Data Localization Suite that pins logs to EU regions for paying customers; cdnjs as a free service does not benefit from that suite. ## **Consent and legal basis** Legitimate interest under Article 6(1)(f) GDPR is defensible for loading essential libraries, but the Bonn Google Fonts ruling and similar decisions suggest that prior opt-in consent is the safer route when the CDN is in a third country. Self-hosting on the website origin or on an EU CDN such as Bunny CDN, Scaleway Edge or jsDelivr Europe Edge eliminates the question. ## **Practical compliance steps** Inventory every cdnjs URL referenced in the codebase, decide whether each library is critical for the first render or can be lazy loaded, download the matching versions and host them on your own origin or an EU CDN, add Subresource Integrity hashes to keep the security guarantee, and mention Cloudflare in the privacy notice if cdnjs is still used. Where cdnjs is kept, integrate the script tags into the Consent Management Platform so they only fire after opt-in. Compliance ## cdnjs and the GDPR cdnjs is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Legitimate interest under Article 6(1)(f) GDPR can be argued for fetching technical assets, but the Bonn Regional Court ruling on Google Fonts and similar decisions across the EU have made consent the safer path when a third party US CDN receives the visitor IP. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, German TTDSG / TDDDG, EU-US Data Privacy Framework, French CNIL 2020 cookie guidelines ### Impact assessment (DPIA) A standalone DPIA is rarely required for cdnjs. A transfer impact assessment focused on Cloudflare Inc. is recommended, covering the EU-US Data Privacy Framework certification, IP logging, retention of edge logs and the supplementary measures applied by Cloudflare. When several libraries are loaded from cdnjs in production, the assessment is best embedded in a wider review of third party JavaScript. ### Sample text for your banner > This website loads some JavaScript and CSS libraries from cdnjs, a content delivery network operated by Cloudflare Inc. When your browser fetches a file, your IP address, User-Agent and the requested URL are processed by Cloudflare under the EU-US Data Privacy Framework. By clicking Accept, you authorise this technical request. You can also Reject and we will serve the libraries from our own EU server. Cookies and trackers ## What cdnjs sets and contacts - Tracking method Content delivery network hosting open source JavaScript and CSS libraries. Operates through HTTP requests; Cloudflare bot management cookie \_\_cf\_bm may be set on the cdnjs.cloudflare.com domain. - Server location Global Cloudflare anycast edge network with more than 300 cities including Frankfurt, Amsterdam, Paris, Madrid, Stockholm, Warsaw and Milan. Origin servers are operated by Cloudflare Inc. - Data transferred outside the EU cdnjs.cloudflare.com is operated by Cloudflare Inc. (San Francisco, USA). Each request logs the visitor IP, User-Agent, requested file and referrer. Cloudflare is certified under the EU-US Data Privacy Framework and signs Standard Contractual Clauses through its customer DPA. ### Cookies set (1) | Name | Type | Duration | Purpose | | ---------- | ----------- | ---------- | ------------------------------------------------------------------------------------------------- | | \_\_cf\_bm | HTTP cookie | 30 minutes | Cloudflare bot management cookie set on cdnjs.cloudflare.com when suspicious traffic is detected. | ### Third-party domains contacted (3) - `cdnjs.cloudflare.com` - `cdnjs.com` - `cloudflare.com` Questions ## Frequently asked questions about cdnjs Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does cdnjs set? cdnjs itself does not set marketing or analytics cookies. The underlying Cloudflare network can set \_\_cf\_bm (30 minutes) on cdnjs.cloudflare.com for bot management. Server side logs capture IP, User-Agent, requested URL and Referer. ### Do I need consent to use cdnjs? Best practice for European websites is to gather opt-in consent before loading any third party script from cdnjs, especially in jurisdictions following the Bonn Regional Court approach. Self-hosting is the simplest alternative. ### What is the legal basis? Legitimate interest under Article 6(1)(f) GDPR can be argued for fetching essential libraries. Consent under Article 6(1)(a) is the safer route, particularly in Germany and France, and is required if \_\_cf\_bm is treated as non strictly necessary. ### Does cdnjs transfer data to the US? Yes. Cloudflare Inc. is US controlled and certified under the EU-US Data Privacy Framework. Edge logs may be replicated to US datacentres. Self-hosting on an EU origin or an EU CDN avoids the transfer. ### Do I need a DPIA? A standalone DPIA is rarely needed. A transfer impact assessment on Cloudflare Inc. is recommended, embedded in a broader review of third party JavaScript if many libraries are loaded. ### How do I implement cdnjs compliantly? Inventory the cdnjs URLs, self-host the libraries on your own origin or an EU CDN, add Subresource Integrity hashes and a Content Security Policy. If cdnjs is retained, integrate the script tags into the Consent Management Platform. ### Are there alternatives to cdnjs? Self-hosting is the simplest. EU alternatives include Bunny CDN, Scaleway Edge and jsDelivr Europe Edge. Many libraries also ship via npm and can be bundled directly into the application. ### How do I update my cookie policy for cdnjs? List Cloudflare Inc. as a sub-processor, describe the \_\_cf\_bm cookie and its purpose, mention the IP logging for every request, the EU-US Data Privacy Framework certification and link to the Cloudflare privacy policy. Same category ## More services: CDN [See the whole category](https://www.flowconsent.com/en/services/cdn) ### [WP Super Cache](https://www.flowconsent.com/en/services/cdn/wordpress-super-cache) [WordPress Super Cache is a web performance optimization tool that helps websites load faster by implementing caching, lazy loading, and resource optimization techniques. It automatically compresses and minifies CSS, JavaScript, and images. WordPress Super Cache improves Core Web Vitals scores, enhances user experience, and boosts search engine rankings through intelligent optimization strategies. With easy implementation and real-time monitoring, WordPress Super Cache delivers measurable speed improvements.](https://www.flowconsent.com/en/services/cdn/wordpress-super-cache) [CDN](https://www.flowconsent.com/en/services/cdn/wordpress-super-cache) · ### [Varnish](https://www.flowconsent.com/en/services/cdn/varnish) [Varnish is a web performance optimization tool that helps websites load faster by implementing caching, lazy loading, and resource optimization techniques. It automatically compresses and minifies CSS, JavaScript, and images. Varnish improves Core Web Vitals scores, enhances user experience, and boosts search engine rankings through intelligent optimization strategies. With easy implementation and real-time monitoring, Varnish delivers measurable speed improvements.](https://www.flowconsent.com/en/services/cdn/varnish) [CDN](https://www.flowconsent.com/en/services/cdn/varnish) · ### [CDN77](https://www.flowconsent.com/en/services/cdn/cdn77) [CDN77 is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. CDN77 integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, CDN77 helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/cdn77) [CDN](https://www.flowconsent.com/en/services/cdn/cdn77) · ### [Azure Edge Network](https://www.flowconsent.com/en/services/cdn/azure-edge-network) [Azure Edge Network is a content delivery network (CDN) that accelerates website performance by distributing content across a global network of edge servers. It reduces latency, improves page load times, and handles traffic spikes by serving cached content from the nearest location. Azure Edge Network supports static and dynamic content acceleration, DDoS protection, and SSL/TLS encryption. With real-time analytics and purge capabilities, Azure Edge Network ensures fast, reliable delivery.](https://www.flowconsent.com/en/services/cdn/azure-edge-network) [CDN](https://www.flowconsent.com/en/services/cdn/azure-edge-network) · ### [Tencent Cloud](https://www.flowconsent.com/en/services/cdn/tencent-cloud) [Tencent Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Tencent Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Tencent Cloud ensures optimal performance at scale.](https://www.flowconsent.com/en/services/cdn/tencent-cloud) [CDN](https://www.flowconsent.com/en/services/cdn/tencent-cloud) · ### [Gcore](https://www.flowconsent.com/en/services/cdn/gcore) [Gcore is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Gcore supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Gcore ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cdn/gcore) [CDN](https://www.flowconsent.com/en/services/cdn/gcore) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)