StackPath

What StackPath Was

StackPath was a content delivery network and edge platform that helped websites load faster and stay protected by serving content from points of presence close to the visitor. Alongside caching it offered a web application firewall and bot protection that inspected requests at the edge and could block, rate limit or challenge suspicious traffic. It is important to state the current status plainly, because StackPath wound down its CDN and legacy Highwinds CDN in November 2023, discontinued its WAF at the same time, and ceased all operations in 2024. Akamai acquired select CDN assets and Gcore acquired the web application and API protection technology, but the StackPath service itself is no longer available. This page therefore serves as reference material and as guidance for operators who still need to remove StackPath and move to a supported provider. Treating it as a live integration would be inaccurate.

Cookies and Data Collected

While it operated, the StackPath web application firewall could set a range of first party cookies, mostly in scenarios such as a captcha or JavaScript challenge or when load balancing was applied. Documented WAF cookies included names such as sp_lit, sbtsck, SPC, SPLB, cnfc, pvstr, DGCC and similar values used for handshake, challenge and routing purposes. The sbtsck cookie, for example, was associated with captcha and handshake handling and was typically short lived. As a CDN and edge security layer, StackPath also processed request metadata such as IP address, user agent and request headers to apply its security rules. These values can constitute personal data because they can identify or single out a visitor. Since the service has shut down, no new cookies are set, but legacy references should be cleaned up.

GDPR and ePrivacy Implications

When StackPath was in use the request metadata and security cookies it handled were personal data under the GDPR, and StackPath acted as a processor for the website operator who remained the controller. Content delivery and network security are recognised legitimate interests under Article 6(1)(f), so that basis could support the processing provided a balancing test was documented. The ePrivacy Directive applied separately to the cookies, since storing and reading information on a device generally needs consent unless it is strictly necessary for a service the user explicitly requested. Strictly necessary security and load balancing cookies are often treated as exempt, while anything broader needs consent. Because the service has ended, the live ePrivacy question is largely moot for StackPath itself, but the same analysis must now be carried out for whatever replacement provider has taken over the role.

Consent Requirements and CMP Integration

Historically many operators classified the StackPath security and load balancing cookies as strictly necessary and loaded them without prior consent, on the basis that they protected and delivered the requested site. That position was only sound where the cookies were genuinely limited to security and routing and not reused for other purposes. With the service discontinued the practical task is different, because your consent management platform should no longer list StackPath as an active vendor. You should remove StackPath entries from your cookie banner and cookie inventory, and add the replacement provider with an accurate classification. If any StackPath cookies are still being served by stale configuration, treat that as a defect to fix rather than a category to keep.

International Data Transfers

StackPath was a United States company based in Dallas, Texas, and ran a global edge network, so traffic from European visitors could be processed in the United States and at edge locations in other regions. Transfers to the United States during its operation would have needed an appropriate mechanism such as Standard Contractual Clauses or, later, the EU US Data Privacy Framework. Because the service has shut down, the live transfer question now attaches to the replacement provider rather than to StackPath. As the controller you should update your records of processing to remove StackPath, confirm the transfer mechanism for the new provider, and run a transfer impact assessment for that provider where your risk approach requires one. Keeping clear records of this transition helps demonstrate accountability.

Practical Compliance Steps

Start by confirming whether StackPath is still referenced anywhere in your stack, including DNS records, CNAME entries, edge configuration and tag managers. Migrate to a supported content delivery and security provider such as Akamai, Cloudflare, Fastly or Gcore, and validate that traffic now routes correctly. Remove StackPath cookies, scripts and vendor entries from your cookie banner, cookie policy and records of processing. Carry out a fresh legitimate interest assessment and, where needed, a transfer impact assessment for the new provider, and sign its data processing agreement. Update your privacy notice and cookie policy to reflect the current provider rather than StackPath. Finally, monitor for any residual StackPath cookies and remove them so your published documentation matches reality.