Bootstrap Icons

No. Bootstrap Icons is a pure SVG and CSS asset library. It contains no JavaScript that reads cookies, no fingerprinting code and no telemetry calls. When the files are served from your own origin the only data exchanged is the HTTP request for the icon files. When the library is loaded from jsDelivr or unpkg, the CDN provider logs the visitor IP address, User Agent and Referer, which under GDPR is personal data even though no cookie is set. The mitigation is to host the assets locally rather than reference the public CDN.

When Bootstrap Icons is self hosted you do not need consent because no personal data leaves your servers and Article 5(3) ePrivacy does not apply. When the library is loaded from a public CDN, EU regulators expect either consent or a documented legitimate interest, given that the visitor IP is sent to a third party. The CNIL, the German DSK and the AEPD all consider remote font and asset loading a sensitive integration since the LG München I Google Fonts ruling of 2022. Self hosting removes the issue.

For self hosted use, the most appropriate basis is legitimate interest under Art. 6(1)(f) GDPR: rendering a website is a clear and proportionate purpose, no profile is built, and the data subject impact is negligible. A documented balancing test should be kept in the record of processing activities. For CDN use, controllers should either rely on consent under Art. 6(1)(a) GDPR or perform a stricter balancing test that accounts for the international transfer of the IP address and the lack of control over CDN logs.

Yes if you use the public CDN. jsDelivr routes traffic through Cloudflare and Fastly edges, both headquartered in the United States. unpkg is hosted entirely on Cloudflare. After Schrems II (CJEU C 311/18), transfers to the US require Standard Contractual Clauses plus supplementary measures, or reliance on the EU US Data Privacy Framework adequacy decision under which Cloudflare and Fastly are certified. If you self host the icons inside the EU or on an EU only CDN, no third country transfer occurs and these obligations fall away.

A full Data Protection Impact Assessment under Art. 35 GDPR is not required for Bootstrap Icons because the processing is low risk, limited in scope and does not involve special category data. A short notice in the Art. 30 record of processing activities is enough. If you load the library from a public CDN, the record should describe the categories of data (IP, User Agent, Referer), the recipient (Cloudflare, Fastly, ProspectOne), the legal basis, the transfer mechanism and the retention period applied by the CDN provider.

Install the npm package, copy the icons folder into your asset pipeline, or download the release zip from the official GitHub repository. Reference the local bootstrap icons.css file in your HTML head or import the SVG sprite. Add a Content Security Policy directive that allows self only, no external CDN. If a third party theme injects the CDN URL automatically, override the path or use Subresource Integrity. Mention Bootstrap Icons in the technical cookies and tools section of the privacy notice for transparency.

Other open source icon sets with similar licences include Heroicons (Tailwind Labs), Lucide (Feather fork), Phosphor Icons, Tabler Icons, Material Symbols and Remix Icon. All can be self hosted to avoid third country transfers. Closed source options like Font Awesome Pro require a licence but offer a self host package. For accessibility and performance, prefer inline SVG with an aria label or aria hidden attribute over icon fonts, which can cause flash of unstyled text and screen reader issues.

Although Bootstrap Icons does not set cookies, the privacy notice should mention it for transparency, especially if the public CDN is used. Add an entry under technical assets explaining that the library is loaded from cdn.jsdelivr.net or unpkg.com, that the IP address is processed by the CDN to deliver the file, that the legal basis is legitimate interest or consent, and that no profile is created. Update the entry whenever you switch between CDN and self hosted delivery.