> unpkg is a Cloudflare CDN for npm packages. Cookies, ePrivacy consent and US data transfers explained for European websites. > > Canonical: https://www.flowconsent.com/en/services/cdn/unpkg CDN # unpkg Unclassified · [Official website](https://unpkg.com) unpkg is a fast, global content delivery network for everything published on npm. It was created by Michael Jackson, the maintainer of React Router and Remix, and runs on top of Cloudflare. Developers reference any npm package version with a URL such as https\://unpkg.com/react\@18/umd/react.production.min.js and get the file from the nearest Cloudflare edge. unpkg itself does not set marketing cookies, but Cloudflare may set \_\_cf\_bm and logs every request, raising the same GDPR considerations as any other US CDN. [Block unpkg until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cdn) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CDN](https://www.flowconsent.com/en/services/cdn) - Consent Unclassified - Prior consent Required - Documented cookies 1 - Third-party domains 2 - Servers Cloudflare global anycast edge network with EU points of presence. Origin operated by unpkg / Michael Jackson on Cloudflare infrastructure. Overview ## What does unpkg do? ## **What unpkg does and how it appears on a website** unpkg is a free content delivery network that serves any file from any package published on npm. It is widely used for quick prototyping, documentation pages, demos and learning materials. A URL such as https\://unpkg.com/lodash\@4 fetches the latest minor version of lodash from the closest Cloudflare edge. unpkg is operated by Michael Jackson, the maintainer of React Router and Remix, in collaboration with Cloudflare, who donates the infrastructure. ## **Cookies and data collected by unpkg** unpkg itself does not place marketing or analytics cookies. The Cloudflare edge can set the \_\_cf\_bm bot management cookie (30 minutes) on unpkg.com when suspicious traffic is detected. Every request is logged for caching and abuse prevention, including IP, User-Agent, requested URL and Referer. ## **GDPR and ePrivacy implications** As with cdnjs and jsDelivr, loading from unpkg transmits the visitor IP to a US provider. The Bonn Regional Court ruling on Google Fonts and similar decisions across EU member states show that prior consent is the safest interpretation when no other legal basis applies. ## **International data transfers** Cloudflare Inc. is a US controlled provider certified under the EU-US Data Privacy Framework, providing an adequacy basis for transfers to the United States. unpkg itself is operated by a US natural person on Cloudflare infrastructure; the entity does not publish a DPA for free users. ## **Consent and legal basis** Production deployments should not rely on unpkg. The recommended pattern is to install packages through npm or pnpm, bundle them with the rest of the application, and serve from the same origin or an EU CDN. If unpkg is used in a prototype or demo, gather opt-in consent before each script tag, or place a clear notice next to it. ## **Practical compliance steps** Audit every script and link tag pointing to unpkg.com in the production codebase, replace them with bundled or self-hosted equivalents, add Subresource Integrity hashes for any unpkg URL that must remain in development tools, and document the choice in the privacy notice if unpkg is still used on customer facing pages. Compliance ## unpkg and the GDPR unpkg is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Legitimate interest under Article 6(1)(f) GDPR can be argued for fetching technical packages. Consent under Article 6(1)(a) is the safer route in EU jurisdictions that follow the Bonn Regional Court approach to third party scripts. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, German TTDSG / TDDDG, EU-US Data Privacy Framework, French CNIL 2020 cookie guidelines ### Impact assessment (DPIA) A DPIA is rarely necessary for unpkg alone. Document a transfer impact assessment on Cloudflare Inc. and unpkg LLC covering IP logging, edge log retention, the EU-US Data Privacy Framework certification and supplementary measures. Where many packages are loaded, fold the assessment into a broader review of third party JavaScript. ### Sample text for your banner > This website loads some scripts from unpkg, a content delivery network for npm packages operated on Cloudflare. Your IP address, User-Agent and the requested URL are processed by Cloudflare under the EU-US Data Privacy Framework. By clicking Accept, you authorise this technical request. You can also Reject and we will bundle the libraries with our own application code. Cookies and trackers ## What unpkg sets and contacts - Tracking method Content delivery network for npm packages. Files are served on demand from the latest published versions; Cloudflare may set \_\_cf\_bm bot management cookie on the unpkg.com domain. - Server location Cloudflare global anycast edge network with EU points of presence. Origin operated by unpkg / Michael Jackson on Cloudflare infrastructure. - Data transferred outside the EU unpkg.com is fronted by Cloudflare Inc. (United States). Each fetch logs the visitor IP, User-Agent, requested URL and Referer. Cloudflare is certified under the EU-US Data Privacy Framework and signs Standard Contractual Clauses through its DPA. ### Cookies set (1) | Name | Type | Duration | Purpose | | ---------- | ----------- | ---------- | -------------------------------------------------------------------------------------- | | \_\_cf\_bm | HTTP cookie | 30 minutes | Cloudflare bot management cookie set on unpkg.com when suspicious traffic is detected. | ### Third-party domains contacted (2) - `unpkg.com` - `cloudflare.com` Questions ## Frequently asked questions about unpkg Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does unpkg set? unpkg itself sets no cookies. Cloudflare can place \_\_cf\_bm (30 minutes) on unpkg.com for bot management. Server logs capture IP, User-Agent, URL and Referer. ### Do I need consent to use unpkg? For production traffic, the safer approach is to avoid unpkg and bundle packages instead. If unpkg is kept, gather opt-in consent or document a legitimate interest assessment. ### What is the legal basis? Legitimate interest under Article 6(1)(f) GDPR is defensible for fetching essential libraries. Consent under Article 6(1)(a) is the safer route in jurisdictions following the Bonn approach. ### Does unpkg transfer data to the US? Yes. Cloudflare Inc. is US controlled and certified under the EU-US Data Privacy Framework. Avoid the transfer by bundling the packages. ### Is a DPIA required? Not for unpkg alone. A short transfer impact assessment is enough. ### How do I implement unpkg compliantly? Install npm packages locally, bundle them with the application, deploy from your own domain or an EU CDN, and remove every reference to unpkg.com from production HTML. ### Are there alternatives to unpkg? Bundling via Vite, Webpack, esbuild or Rollup. EU CDN alternatives: Bunny CDN, Scaleway Edge. jsDelivr offers a similar service over Cloudflare and Fastly. ### How do I update my cookie policy for unpkg? Mention Cloudflare Inc. as sub-processor, describe \_\_cf\_bm, the IP logging on every request, the EU-US Data Privacy Framework and link to the Cloudflare privacy policy. Same category ## More services: CDN [See the whole category](https://www.flowconsent.com/en/services/cdn) ### [Hostinger CDN](https://www.flowconsent.com/en/services/cdn/hostinger-cdn) [Hostinger CDN is a content delivery network (CDN) that accelerates website performance by distributing content across a global network of edge servers. It reduces latency, improves page load times, and handles traffic spikes by serving cached content from the nearest location. Hostinger CDN supports static and dynamic content acceleration, DDoS protection, and SSL/TLS encryption. With real-time analytics and purge capabilities, Hostinger CDN ensures fast, reliable delivery.](https://www.flowconsent.com/en/services/cdn/hostinger-cdn) [CDN](https://www.flowconsent.com/en/services/cdn/hostinger-cdn) · ### [Cloudimage](https://www.flowconsent.com/en/services/cdn/cloudimage) [Cloudimage is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Cloudimage integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Cloudimage helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/cloudimage) [CDN](https://www.flowconsent.com/en/services/cdn/cloudimage) · ### [Superspeed](https://www.flowconsent.com/en/services/cdn/superspeed) [Superspeed is a web performance optimization platform that helps websites load faster and deliver better user experiences. It provides detailed performance metrics, Core Web Vitals monitoring, and actionable optimization recommendations. Superspeed analyzes page speed, resource loading, and rendering to identify bottlenecks impacting user experience and search rankings. With automated optimization and real-time monitoring, Superspeed helps businesses achieve faster load times and improved SEO.](https://www.flowconsent.com/en/services/cdn/superspeed) [Analytics](https://www.flowconsent.com/en/services/cdn/superspeed) · ### [Amazon S3](https://www.flowconsent.com/en/services/cdn/amazon-s3) [Amazon S3 is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Amazon S3 supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Amazon S3 ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cdn/amazon-s3) [CDN](https://www.flowconsent.com/en/services/cdn/amazon-s3) · ### [Cloudflare Rocket Loader](https://www.flowconsent.com/en/services/cdn/cloudflare-rocket-loader) [Cloudflare Rocket Loader is a customer support and helpdesk platform that helps businesses manage, track, and resolve customer inquiries efficiently. It provides a unified ticketing system, knowledge base, and multi-channel support across email, chat, phone, and social media. Cloudflare Rocket Loader features automated ticket routing, SLA management, and self-service portals, enabling faster resolutions, higher satisfaction, and reduced operational costs for support teams.](https://www.flowconsent.com/en/services/cdn/cloudflare-rocket-loader) [CDN](https://www.flowconsent.com/en/services/cdn/cloudflare-rocket-loader) · ### [WP Fastest Cache](https://www.flowconsent.com/en/services/cdn/wp-fastest-cache) [WP Fastest Cache is a web performance optimization tool that helps websites load faster by implementing caching, lazy loading, and resource optimization techniques. It automatically compresses and minifies CSS, JavaScript, and images. WP Fastest Cache improves Core Web Vitals scores, enhances user experience, and boosts search engine rankings through intelligent optimization strategies. With easy implementation and real-time monitoring, WP Fastest Cache delivers measurable speed improvements.](https://www.flowconsent.com/en/services/cdn/wp-fastest-cache) [CDN](https://www.flowconsent.com/en/services/cdn/wp-fastest-cache) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)