Lucide

What Lucide is

Lucide is a community maintained open source icon library, originally forked from Feather Icons in 2020 and now containing approximately 1500 minimalist SVG icons. The project is released under the ISC licence and ships as an npm package, a web component, a React, Vue, Svelte and Solid wrapper, and as raw SVG files. Lucide is widely used by SaaS dashboards, design systems and developer documentation portals because it offers a consistent stroke and a permissive licence.

What data and cookies Lucide collects

Lucide itself collects nothing. It does not include analytics, does not set cookies, does not fingerprint the visitor and does not phone home. The only personal data involved is the HTTP request metadata (IP address, User Agent, Referer) that is naturally observable by the server delivering the SVG or JavaScript file. When Lucide is self hosted on the operator infrastructure this metadata stays under the operator control. When it is loaded from a public CDN such as jsDelivr or unpkg, that metadata is observable by the CDN operator.

GDPR and ePrivacy implications

Because no information is stored or read on the visitor device, the ePrivacy strictly necessary rule does not even need to be invoked: Article 5(3) ePrivacy Directive only applies to storage or access on terminal equipment. The GDPR still applies to the IP address that is shared with the CDN when the file is loaded externally. Following the Schrems II ruling and the case law on Google Fonts in Germany, sending an EU visitor IP to a US CDN without clear information or legal basis has been flagged as a risk, even though the impact is very limited.

Consent requirements and legal basis

When Lucide is self hosted, the operator can rely on legitimate interest under Article 6(1)(f) GDPR to serve the icons because the impact on the visitor is minimal and the assets are necessary to render the page. When the icons are loaded from a third party CDN the simplest path to compliance is to self host them or to use a CDN with EU presence. If a US CDN remains in use, a clear mention in the privacy notice plus a consent gate on first request is a defensible approach, especially for German audiences sensitive to the Google Fonts case law.

Data transfers and hosting

jsDelivr is operated by Prospect One in Poland but uses Fastly and Cloudflare as edge networks, both with US headquarters and worldwide PoPs. unpkg is operated by NPM Inc. (subsidiary of Microsoft, United States) and uses Cloudflare. As a result, requests issued by EU visitors to fetch Lucide assets can be routed through US edges and are observable by US controllers. Self hosting on the operator origin or using an EU only CDN (Bunny CDN with EU only zones, Scaleway Edge) eliminates the third country exposure.

Practical compliance steps

The easiest compliant pattern is to bundle Lucide locally with your build pipeline so the icons are served from the same origin as the rest of the site. If using a CDN is preferred, choose one with an EU only routing option, or document the CDN in your privacy notice as a recipient and rely on Standard Contractual Clauses or the EU US Data Privacy Framework. Because Lucide sets no cookies, no CMP toggle is technically required, but listing it as a third party resource is best practice.