> Microsoft Ajax CDN under the GDPR: it sets no cookies but exposes the visitor IP to Microsoft in the US, much like the Google Fonts case law. > > Canonical: https://www.flowconsent.com/en/services/cdn/microsoft-ajax-content-delivery-network CDN # Microsoft Ajax Content Delivery Network Unclassified · [Official website](https://docs.microsoft.com/en-us/aspnet/ajax/cdn/overview) The Microsoft Ajax Content Delivery Network (ajax.aspnetcdn.com) is a public CDN operated by Microsoft Corporation that hosts popular JavaScript libraries, including jQuery, jQuery UI, Modernizr and the ASP.NET AJAX scripts. Many older ASP.NET, SharePoint and intranet sites reference these scripts directly from the Microsoft Ajax CDN. The CDN itself does not place cookies, but each request exposes the visitor IP address to Microsoft servers, which has GDPR transparency and transfer implications. [Block Microsoft Ajax Content Delivery Network until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cdn) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CDN](https://www.flowconsent.com/en/services/cdn) - Consent Unclassified - Prior consent Required - Documented cookies 1 - Third-party domains 3 - Servers Global Microsoft Azure Front Door and Azure CDN edges with backend origins in the United States; operated by Microsoft Corporation, Redmond, Washington Overview ## What does Microsoft Ajax Content Delivery Network do? ## **What the Microsoft Ajax CDN is** The Microsoft Ajax Content Delivery Network, served from ajax.aspnetcdn.com, is a public CDN operated by Microsoft Corporation that hosts cached copies of popular JavaScript libraries (jQuery and jQuery UI, Modernizr, ASP.NET AJAX, the Microsoft Ajax Library). It was originally launched to accelerate the loading of these libraries by serving them from a globally distributed Microsoft edge. The CDN is widely referenced in legacy ASP.NET applications, SharePoint sites and tutorials. Microsoft has officially announced the retirement of this service and recommends migrating to a generic CDN. ## **What data and cookies it collects** The Microsoft Ajax CDN does not set cookies, does not run analytics on the visitor, does not fingerprint and does not include any visitor side tracking script. The only personal data it sees is the HTTP request metadata that any server naturally observes when delivering an asset: IP address, User Agent, Referer and Accept Language. Microsoft uses these data points for CDN performance routing, anti DDoS measures and aggregated traffic reporting, and may retain them for a limited period in operational logs. ## **GDPR and ePrivacy implications** Because no information is stored or read on the visitor device, the ePrivacy strictly necessary rule does not even apply. The GDPR still applies to the visitor IP that is shared with Microsoft when the asset is loaded. After Schrems II and the Google Fonts case law in Germany, even the passive exposure of an EU visitor IP to a US controller has been treated as a transfer that requires either a clear basis and information or, preferably, the use of a self hosted alternative. The same logic applies to the Microsoft Ajax CDN. ## **Consent requirements and legal basis** For a self hosted equivalent, the legal basis is legitimate interest under Article 6(1)(f) GDPR. For the Microsoft Ajax CDN, the safest pattern is to migrate the scripts to a self hosted copy or to an EU only CDN, eliminating the third country transfer. If the operator chooses to keep referencing ajax.aspnetcdn.com, the privacy notice should mention Microsoft Corporation as a recipient, cite the EU US Data Privacy Framework certification of Microsoft as the transfer mechanism, and ideally provide a consent gate for visitors who refuse the transfer. ## **Data transfers and hosting** The Microsoft Ajax CDN is served from Microsoft Azure Front Door and Azure CDN edges located worldwide, including in the EU, with backend origins in the United States. Microsoft Corporation is the data controller for the operational logs and participates in the EU US Data Privacy Framework. Although the CDN often serves European visitors from an EU edge, the parent company is US established and engages US support and engineering teams, so the transfer should be treated as a real transfer to the United States in the privacy notice. ## **Practical compliance steps** Because Microsoft has announced the retirement of the Ajax CDN, the recommended step is to bundle jQuery and other libraries locally with your build system or to load them from an EU CDN with EU only routing. If migration is not immediate, list ajax.aspnetcdn.com in the third party resources section of your privacy notice, mention Microsoft Corporation as the recipient, cite the EU US Data Privacy Framework and provide visitors with information about how to block the request through their browser settings or an extension. Compliance ## Microsoft Ajax Content Delivery Network and the GDPR Microsoft Ajax Content Delivery Network is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for serving JavaScript libraries needed to render the page, combined with consent (Art. 6(1)(a) GDPR) where the exposure of the visitor IP to a US controller is treated as requiring consent (notably for German audiences after the Google Fonts case law). - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, TTDSG (Germany), Schrems II case law ### Impact assessment (DPIA) A DPIA is not required for using the Microsoft Ajax CDN. The service does not set cookies, does not perform analytics on visitors and only sees the standard HTTP request metadata (IP address, User Agent, Referer) inherent to any external asset load. The only personal data involved is the visitor IP, which is well below the threshold of Article 35 GDPR. ### Sample text for your banner > Some pages on our site load JavaScript libraries (such as jQuery) from the Microsoft Ajax Content Delivery Network (ajax.aspnetcdn.com), operated by Microsoft Corporation in the United States. This means your IP address is shared with Microsoft for the duration of the request. The Microsoft Ajax CDN itself does not place cookies or trackers on your device. Cookies and trackers ## What Microsoft Ajax Content Delivery Network sets and contacts - Tracking method Static JavaScript assets (jQuery, jQuery UI, ASP.NET AJAX) served from a Microsoft operated public CDN; no cookies, no tracking pixels - Server location Global Microsoft Azure Front Door and Azure CDN edges with backend origins in the United States; operated by Microsoft Corporation, Redmond, Washington - Cookieless mode available Yes - Data transferred outside the EU The Microsoft Ajax CDN is operated by Microsoft Corporation, headquartered in the United States. When a visitor loads a page that references ajax.aspnetcdn.com, their IP address and User Agent are exposed to the Microsoft edge they hit, which may be located outside the EEA. Microsoft is a US controller that participates in the EU US Data Privacy Framework. Microsoft has announced the deprecation of the Ajax CDN in favour of a generic CDN replacement, so this service is being phased out. ### Cookies set (1) | Name | Type | Duration | Purpose | | ----------- | ------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | no\_cookies | first\_party | N/A | The Microsoft Ajax CDN serves static JavaScript files and does not set any cookies of its own. This entry exists for inventory completeness so the absence of cookies is explicitly documented. | ### Third-party domains contacted (3) - `ajax.aspnetcdn.com` - `ajax.microsoft.com` - `aspnetcdn.com` Questions ## Frequently asked questions about Microsoft Ajax Content Delivery Network Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does the Microsoft Ajax CDN set cookies? No. The Microsoft Ajax CDN is a static asset delivery service that does not set cookies, does not write local storage and does not fingerprint visitors. The only data exposed is the HTTP request metadata (IP address, User Agent, Referer) that any web server naturally observes when serving an asset. ### Is consent required to use the Microsoft Ajax CDN? Consent is not required because no information is stored or read on the visitor device. However, after the German Google Fonts case law, exposing an EU visitor IP to a US controller without information or basis is considered problematic. The safest path is to self host the libraries or use a CDN with EU only routing. If you keep the Microsoft Ajax CDN, mention it in your privacy notice and rely on legitimate interest combined with the EU US Data Privacy Framework certification of Microsoft. ### What is the legal basis for using the Microsoft Ajax CDN? For self hosted libraries the basis is legitimate interest under Article 6(1)(f) GDPR. For the Microsoft Ajax CDN the safest position is to combine legitimate interest with transparent disclosure of the transfer to the United States, citing the EU US Data Privacy Framework certification of Microsoft as the transfer mechanism. For stricter German audiences, a consent gate can be added in the functional category of the CMP. ### Does the Microsoft Ajax CDN transfer data to the United States? Microsoft routes Ajax CDN requests through Azure edges located worldwide, including in the EU. However, Microsoft Corporation is established in the United States, runs global operations and engages US support and engineering teams, so requests should be treated as transfers to the US and disclosed in the privacy notice. Microsoft is certified under the EU US Data Privacy Framework. ### Is a DPIA required for the Microsoft Ajax CDN? No. The CDN does not perform profiling, automated decision making, large scale processing of sensitive data or systematic monitoring. The only personal data involved is the HTTP request metadata that any web server naturally sees, which is well below the Article 35 GDPR threshold. ### How do I use the Microsoft Ajax CDN compliantly? Because Microsoft has announced the retirement of the Ajax CDN, migrate the libraries to a self hosted bundle or to a CDN with EU only routing as a priority. While the migration is pending, document the resource in your privacy notice as a third party served from Microsoft Corporation, cite the EU US Data Privacy Framework as the transfer mechanism and ensure your CMP does not load any other Microsoft script automatically. ### What are the alternatives to the Microsoft Ajax CDN? The simplest alternative is to bundle jQuery, jQuery UI and Modernizr locally with your build system, eliminating the third party request entirely. Public alternatives include jsDelivr (Polish operator, US backbone), unpkg (US), cdnjs (Cloudflare, US) and Bunny CDN (Slovenian operator with EU only zone options). For German audiences a self hosted setup is recommended to avoid Google Fonts style claims. ### How do I update the cookie policy when using the Microsoft Ajax CDN? You do not need to add a cookie entry because the CDN does not set cookies. Add a short paragraph in the third party resources section of your privacy notice, indicating that some pages load JavaScript libraries from ajax.aspnetcdn.com operated by Microsoft Corporation, that this exposes the visitor IP to Microsoft in the United States and that the transfer is covered by the EU US Data Privacy Framework. Same category ## More services: CDN [See the whole category](https://www.flowconsent.com/en/services/cdn) ### [Uploadcare](https://www.flowconsent.com/en/services/cdn/uploadcare) [Uploadcare is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Uploadcare supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Uploadcare ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cdn/uploadcare) [CDN](https://www.flowconsent.com/en/services/cdn/uploadcare) · ### [Cloudflare](https://www.flowconsent.com/en/services/cdn/cloudflare) [Cloudflare is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Cloudflare is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Cloudflare offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/cdn/cloudflare) [CDN](https://www.flowconsent.com/en/services/cdn/cloudflare) · ### [Tencent Cloud](https://www.flowconsent.com/en/services/cdn/tencent-cloud) [Tencent Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Tencent Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Tencent Cloud ensures optimal performance at scale.](https://www.flowconsent.com/en/services/cdn/tencent-cloud) [CDN](https://www.flowconsent.com/en/services/cdn/tencent-cloud) · ### [Ionicons](https://www.flowconsent.com/en/services/cdn/ionicons) [Ionicons is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Ionicons integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Ionicons helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/ionicons) [CDN](https://www.flowconsent.com/en/services/cdn/ionicons) · ### [Font Awesome](https://www.flowconsent.com/en/services/cdn/font-awesome) [Font Awesome is a web font service providing access to a curated library of high-quality typefaces optimized for digital use. It delivers fonts through a global CDN with smart caching and efficient loading to minimize performance impact. Font Awesome supports variable fonts, subsetting, and display optimization, helping designers create beautiful typography while maintaining fast page loads. With easy integration and broad browser support, Font Awesome enhances aesthetics.](https://www.flowconsent.com/en/services/cdn/font-awesome) [Essential](https://www.flowconsent.com/en/services/cdn/font-awesome) · ### [ImageKit](https://www.flowconsent.com/en/services/cdn/imagekit) [Imagekit is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Imagekit supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Imagekit ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cdn/imagekit) [CDN](https://www.flowconsent.com/en/services/cdn/imagekit) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)