Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
MaxCDN is a legacy content delivery network, now migrated into the United States based StackPath, that serves static assets without tracking cookies while logging the visitor IP.
MaxCDN was a content delivery network that cached and served static assets such as images, CSS, JavaScript and fonts from edge servers close to the visitor. The MaxCDN brand is now largely discontinued and has been migrated into StackPath, a United States based edge platform. It historically powered services such as BootstrapCDN, which delivered the Bootstrap framework files to many websites.
When a browser requests an asset from a MaxCDN or NetDNA domain, the request transmits the visitor IP address and User Agent to the edge server, which logs them for delivery, caching and security. The asset delivery does not set tracking cookies. As with any third party file host, the central privacy point is the transmission of the visitor IP to the provider rather than advertising cookies, in line with the German court rulings on third party asset loading.
Because no information is stored on or read from the visitor device, the ePrivacy consent rule does not apply to MaxCDN asset delivery. The processing of the visitor IP relies on legitimate interest under Article 6(1)(f) GDPR as strictly necessary delivery. Since the platform is operated from the United States under StackPath, the transfer of the IP to a third country must be addressed with Standard Contractual Clauses or an equivalent safeguard.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Serving assets through MaxCDN is treated as strictly necessary and does not require prior consent, as no tracking cookies are set. The transmission of the visitor IP to a United States provider should nonetheless be disclosed transparently in the privacy policy, naming the provider and explaining the delivery purpose.
MaxCDN is now part of StackPath, which is based in the United States, so the visitor IP that reaches the network is transferred to a third country. This transfer should rely on Standard Contractual Clauses in the data processing agreement, supported by any supplementary measures appropriate after the Schrems II decision.
Because the MaxCDN brand is deprecated and migrated into StackPath, first confirm which service actually serves your assets and whether you can move to a maintained, ideally EU based alternative. Sign the relevant data processing agreement, confirm the Standard Contractual Clauses, list the provider in your records and privacy policy, and confirm no tracking cookies are set.
Websites using MaxCDN must obtain user consent under GDPR regulations.
DPIA considerations
A full data protection impact assessment is generally not required for MaxCDN because it processes only the IP address and User Agent for delivery and sets no tracking cookies. The main point to document is the transfer of the visitor IP to the United States via StackPath, which needs Standard Contractual Clauses and post Schrems II supplementary measures. Note that the brand is deprecated, so plan a migration to a maintained provider.
Sample consent text
We use the MaxCDN content delivery network, now operated through StackPath, to serve static files quickly. This transmits your IP address to the provider in the United States solely to deliver the requested content. No tracking cookies are set for this purpose.
Third-party domains contacted
maxcdn.comnetdna-cdn.comnetdna-ssl.combootstrapcdn.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| None | Not applicable | Not applicable | MaxCDN sets no tracking cookies for asset delivery. The asset request itself stores nothing on the visitor device, however the edge server, now operated through StackPath in the United States, logs the visitor IP address and User Agent for content delivery, caching and security. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
No. MaxCDN delivers static assets and does not set tracking cookies for that delivery. The edge server logs the visitor IP address and User Agent to serve the files and protect against abuse, but nothing is stored on the visitor device.
Generally no. MaxCDN sets no tracking cookies and serves assets that are strictly necessary, so the ePrivacy consent requirement does not apply. You should still disclose that asset requests transmit the visitor IP to the provider in the United States.
The processing of the visitor IP relies on legitimate interest under Article 6(1)(f) GDPR, namely the secure and efficient delivery of website assets. This is treated as strictly necessary, so no separate consent is required for the delivery itself.
Yes. MaxCDN is now part of StackPath, which is based in the United States, so the visitor IP that reaches the network is transferred there. This transfer should be covered by Standard Contractual Clauses and supplementary measures appropriate after the Schrems II decision.
A full data protection impact assessment is generally not required. MaxCDN processes only the IP address and User Agent for delivery and sets no tracking cookies. The main point to record is the transfer of the visitor IP to the United States and the safeguards that cover it.
First confirm which service actually serves your assets, since the MaxCDN brand is deprecated and migrated into StackPath. Sign the data processing agreement, confirm the Standard Contractual Clauses, list the provider in your records and privacy policy, and confirm no tracking cookies are set.
Because the MaxCDN brand is discontinued, consider a maintained content delivery network such as CDN77, BunnyCDN, Cloudflare, Fastly or Amazon CloudFront. An EU based provider can simplify the transfer assessment, while United States providers usually need Standard Contractual Clauses for the visitor IP.
Because MaxCDN sets no cookies, you do not need a cookie table entry for it. Add the provider to the list of recipients in your privacy policy, explain that asset requests transmit the visitor IP for delivery and security, and note the transfer to the United States under Standard Contractual Clauses.