Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
The jQuery JavaScript library delivered through a public CDN. The library sets no cookies, but each CDN request exposes the visitor IP and user agent to the CDN operator, often in the United States.
jQuery is a foundational JavaScript library, and many sites load it from a public content delivery network rather than hosting it themselves. The library sets no cookies and performs no tracking, but the act of fetching it from a third party CDN has a clear privacy dimension that often gets overlooked.
A jQuery CDN simply serves the library file from a fast, globally distributed network such as code.jquery.com, Google Hosted Libraries, cdnjs or jsDelivr. The benefit is speed and caching; the cost is that the visitor browser must contact a third party server to download the script.
Every request for the jQuery file carries the visitor IP address and user agent to the CDN operator. An IP address is personal data under the GDPR. This is the same mechanism the German courts addressed in the Google Fonts rulings, where loading a font from Google servers without consent was found unlawful.
Operators such as Google and Cloudflare are United States based and run global edge networks. Serving jQuery from them can therefore amount to a transfer of personal data to a third country, which needs an appropriate safeguard and a documented basis under the GDPR transfer rules.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because no cookies are set, consent is not strictly mandated for the script, but the IP transfer should be supported by a documented legitimate interest assessment. Given the German case law on third party asset loading, the risk is best rated medium until you either self host or formally justify the CDN use.
The cleanest approach is to self host jQuery from your own domain. The request then stays first party, no IP address leaves to a third party, and the whole transfer question disappears. If you must use a CDN, document the legitimate interest and prefer an EEA based operator where possible.
Websites using jQuery CDN must obtain user consent under GDPR regulations.
DPIA considerations
The library code processes no personal data, so a full DPIA is rarely needed. The point worth assessing is the systematic disclosure of every visitor IP and user agent to the CDN operator, which for operators such as Google or Cloudflare amounts to a transfer to the United States. Document a legitimate interest assessment for this transfer, or remove the issue entirely by self hosting the jQuery file.
Sample consent text
This site uses the jQuery JavaScript library. Where it is loaded from a public CDN, the CDN operator receives your IP address and browser details as part of delivering the file. jQuery itself sets no cookies. To avoid this, the library can be hosted on this site own servers.
Third-party domains contacted
code.jquery.comajax.googleapis.comcdnjs.cloudflare.comcdn.jsdelivr.netajax.aspnetcdn.comThis service may collect user data. Ensure GDPR compliance with FlowConsent.
No. The jQuery library sets no cookies and does no tracking. The privacy concern is not cookies but the network request itself, which exposes the visitor IP to the CDN operator.
Consent is not strictly mandated because no cookies are stored, but the IP transfer to the CDN operator should rest on a documented legitimate interest. Some EEA regulators prefer self hosting to avoid the question altogether.
Legitimate interest in fast, reliable delivery of the library, supported by a documented assessment that weighs the visitor IP exposure. If you cannot justify it, self hosting removes the need for any basis.
It can. Operators such as Google Hosted Libraries and cdnjs (Cloudflare) are United States based with global edge networks, so the visitor IP and user agent may be processed in a third country, triggering the GDPR transfer rules.
A full DPIA is rarely required, since the library processes no personal data beyond the IP disclosed by the request. Documenting a legitimate interest assessment for that transfer is usually sufficient.
Self host the jQuery file from your own domain. The request then stays first party, no IP address leaves to a third party CDN, and the transfer question disappears entirely. This is the simplest compliant setup.
Self hosting the library is the main alternative. You can also bundle jQuery with your own assets, or where possible drop jQuery in favour of modern native JavaScript so no external dependency is loaded at all.
If you load jQuery from a CDN, name the operator, state that your visitor IP and user agent are processed by it, and note any transfer outside the EEA. If you self host, no specific entry is needed.