CDN

Cloudinary

Cloudinary is an image and video management platform widely used to host, transform, optimise, and deliver media assets via its global CDN. The visitor browser fetches media from a Cloudinary URL (res.cloudinary.com by default, or a customer subdomain) and Cloudinary applies on-the-fly transformations (resize, format conversion, AI background removal). Cloudinary does not set cookies in the visitor browser by default.

Block Cloudinary until consent Scan my site

Overview

What does Cloudinary do?

What Cloudinary is

Cloudinary is an image and video management platform founded in 2012, with headquarters in Santa Clara, California, and major R&D operations in Israel. It serves as a managed asset CDN: developers upload media to Cloudinary, then deliver it via URLs that include transformation parameters (resize, crop, format conversion, AI features). Cloudinary is widely used in e-commerce, media, and SaaS applications, with millions of websites worldwide.

What data Cloudinary processes

For each media request: visitor IP, user agent, referrer, URL, transformation parameters, and response metadata. The asset content itself is stored in Cloudinary buckets and processed during transformations. AI features (object recognition, automatic tagging, content moderation, background removal) analyse the image content with machine learning models. Cloudinary does not set cookies in the visitor browser; tracking is server-side only.

GDPR and ePrivacy implications

IP addresses are personal data. The processing relies on legitimate interest (Art. 6(1)(f)) as a necessary technical component of website delivery. The ePrivacy consent requirement does not apply because Cloudinary does not store or read information on the device. The asset content itself is processed by Cloudinary as a processor under the customer Cloudinary DPA.

International data transfers

By default, Cloudinary processes assets in the United States. Enterprise customers can request EU residency on Frankfurt (eu-cloudinary infrastructure). Transfers rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and on the EU-US Data Privacy Framework certification. A Transfer Impact Assessment is recommended, especially for sensitive content (member photos, identity documents).

Practical compliance steps

Sign the Cloudinary DPA, request EU residency on Enterprise plans, use signed URLs for private assets, configure auto-delete policies for user uploaded media that should not be retained, document Cloudinary in your RoPA as a processor, restrict AI feature use to documented purposes, and mention Cloudinary in the privacy notice with the chosen region.

Compliance

Cloudinary and the GDPR

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) for the CDN delivery role; contract performance (Art. 6(1)(b)) for the asset management functionality
Risk level: low
Applicable regulations: GDPR, ePrivacy Directive, CCPA

Impact assessment (DPIA)

Cloudinary processes the visitor IP and request metadata to deliver and transform media. Key DPIA considerations: (1) IP addresses are personal data, processed under legitimate interest; (2) US default residency triggers a transfer assessment, while EU residency on Frankfurt is available for Enterprise customers; (3) AI features (object recognition, content moderation, background removal) may process image content with sensitive personal data; (4) signed URLs and access controls should be used for private media (member photos, document uploads); (5) the asset content itself can be highly personal (user-uploaded photos, ID documents), which raises the stakes of any data breach.

Sample text for your banner

Our website uses Cloudinary, an image and video CDN, to deliver and transform our media assets. Cloudinary processes your IP address and request metadata to serve the media. By default, the infrastructure is in the United States; we have configured the EU region where contractually available. Transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework. Cloudinary does not set cookies in your browser.

Cookies and trackers

What Cloudinary sets and contacts

Tracking method: Image and video asset CDN: URLs hosted on res.cloudinary.com (or a customer subdomain) deliver and transform media on the fly. No JavaScript tracker in the visitor browser by default.
Server location: United States by default (Cloudinary Ltd. is headquartered in Santa Clara, California; subsidiaries in Israel and Singapore). EU region (eu-cloudinary, Frankfurt) is available for Enterprise customers.
Cookieless mode available: Yes
Data transferred outside the EU: Cloudinary processes the visitor IP and request metadata to deliver the requested media transformation. The default infrastructure is in the United States; EU residency is available for Enterprise customers and routes media through eu-cloudinary.com on Frankfurt. Transfers rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and on the EU-US Data Privacy Framework certification of Cloudinary Inc.

Cookies set (1)

Name	Type	Duration	Purpose
No cookies set by Cloudinary	N/A	N/A	Cloudinary is a server-side asset CDN and does not write cookies to the visitor browser. Any cookie received from a Cloudinary URL is set by the customer origin application served behind the CDN.

Third-party domains contacted (6)

cloudinary.com
www.cloudinary.com
res.cloudinary.com
api.cloudinary.com
eu-res.cloudinary.com
media-library.cloudinary.com

Questions

Frequently asked questions about Cloudinary

Can't find your question? Write to us, we answer fast.

Write to us

Does Cloudinary set cookies?

No. Cloudinary is a server-side asset CDN and does not set cookies in the visitor browser. Any cookie received from a Cloudinary URL is set by the customer origin application, not by Cloudinary.

Does Cloudinary require user consent?

No. The ePrivacy consent requirement does not apply because Cloudinary does not store or read information on the device. Processing of the visitor IP for media delivery relies on legitimate interest under Art. 6(1)(f) GDPR.

What is the legal basis for using Cloudinary?

Legitimate interest (Art. 6(1)(f) GDPR) for media delivery as a necessary technical component. Contract performance (Art. 6(1)(b)) for the asset management workflows in the controller dashboard.

Does Cloudinary transfer data to the United States?

By default yes. Cloudinary infrastructure is in the United States unless EU residency (Frankfurt) is contractually requested on an Enterprise plan. Transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework.

Do I need a DPIA for Cloudinary?

For ordinary marketing or product imagery, no. For platforms that handle user-generated content (member photos, identity documents, medical images), a short DPIA is recommended to document access controls, retention, and AI feature usage.

How do I implement Cloudinary compliantly?

Sign the Cloudinary DPA, request EU residency on Enterprise where applicable, use signed URLs for private assets, enforce strict upload validation, set retention policies for user-uploaded media, document Cloudinary in your RoPA, and mention Cloudinary with the chosen region in your privacy notice.

What are the alternatives to Cloudinary?

EU-friendly alternatives include Imgix (US, EU PoPs), Bunny Optimizer (Slovenia), Storyblok Image Service (Switzerland), Uploadcare (Estonia), Sirv (UK), Image Engine, ImageKit, Twicpics (France), and self-hosted options like Imgproxy or libvips behind your own CDN.

How do I update the cookie policy for Cloudinary?

Cloudinary does not set cookies, so no cookie policy entry is needed. Mention Cloudinary in the privacy notice under technical subprocessors, with the chosen region (US default or EU Frankfurt), the DPA reference, and the SCCs/DPF transfer mechanism.

Amazon S3

Amazon S3 is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Amazon S3 supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Amazon S3 ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

CDN

WPMU DEV Smush

WPMU DEV Smush is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. WPMU DEV Smush supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, WPMU DEV Smush remains a leading web development choice.

CDN

Glyphicons

Glyphicons is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Glyphicons integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Glyphicons helps organizations maintain robust websites that meet user expectations and technical requirements.

CDN

Vercel Analytics

Vercel Analytics is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Vercel Analytics is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Vercel Analytics offers reliable solutions that scale with organizational needs and evolving web standards.

CDN

Autoptimize

Autoptimize is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Autoptimize offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Autoptimize empowers organizations to optimize strategy and maximize return on investment.

CDN

Sotoon

Sotoon is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Sotoon integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Sotoon helps organizations maintain robust websites that meet user expectations and technical requirements.

CDN

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my banner Scan my site