> Bootstrap does not set cookies but loading it from jsDelivr may transmit visitor IP. Self-hosting, EU CDN options and GDPR compliance guide. > > Canonical: https://www.flowconsent.com/en/services/framework/bootstrap Frameworks # Bootstrap Unclassified · [Official website](https://getbootstrap.com) Bootstrap is the most popular open source CSS framework, providing a responsive grid system, typography, form controls, navigation, modals and a comprehensive set of utility classes. Originally released by Twitter and maintained today by an independent team, Bootstrap also ships an optional JavaScript bundle for interactive components such as dropdowns, tabs and collapsible panels. Bootstrap itself does not set cookies. The privacy considerations come from how the framework is delivered: bundled in the application or loaded from cdn.jsdelivr.net. [Block Bootstrap until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=framework) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Frameworks](https://www.flowconsent.com/en/services/framework) - Consent Unclassified - Prior consent Not required - Documented cookies 0 - Third-party domains 4 - Servers When self-hosted: same origin as the website. From cdn.jsdelivr.net: Cloudflare and Fastly global edge. From getbootstrap.com / npm: developer download. Overview ## What does Bootstrap do? ## **What Bootstrap does and how it appears on a website** Bootstrap is a CSS framework released in 2011 by Mark Otto and Jacob Thornton at Twitter and now maintained by an independent open source team. It provides a 12 column responsive grid, typography scale, button, form, navigation, card, modal and alert components, plus utility classes for spacing, color and typography. An optional JavaScript bundle adds dropdowns, tooltips, popovers, carousels and collapsible panels. On a website Bootstrap appears as a CSS file plus an optional JavaScript file, served from the same domain or from cdn.jsdelivr.net. ## **Cookies and data collected** Bootstrap does not set cookies, does not write to localStorage and does not perform any tracking. The CSS file is static. The optional JavaScript only manipulates the DOM in response to user clicks. The only data exchanged with the network is the HTTP request that downloads the files from the hosting CDN. ## **GDPR and ePrivacy implications** Bootstrap does not store information on the user device, so the strict consent rule of Article 5(3) ePrivacy does not apply. However, requesting the CSS or JavaScript from jsDelivr transmits the visitor IP to a non-EU operator. The Bonn Regional Court ruling on Google Fonts shows that this transmission may require a clear legal basis or consent. ## **International data transfers** cdn.jsdelivr.net is the default Bootstrap CDN. It runs on Cloudflare Inc. and Fastly Inc., both US controlled and certified under the EU-US Data Privacy Framework. Self-hosting on an EU server, or using an EU specific CDN such as Bunny CDN or Scaleway Edge, removes the cross-border transfer. ## **Consent and legal basis** For self-hosted Bootstrap, legitimate interest (Article 6(1)(f) GDPR) is the standard basis. For CDN delivery, gather opt-in consent through a Consent Management Platform before requesting the file, or document a legitimate interest assessment that demonstrates data minimisation and EU-US Data Privacy Framework adequacy. ## **Practical compliance steps** Install Bootstrap through npm and bundle the CSS with PostCSS or Sass and the JavaScript with the rest of the application code. Serve the resulting files from your own domain or an EU CDN. Add Subresource Integrity hashes and a Content Security Policy. Document the framework in the privacy notice if the optional JavaScript components are loaded from a public CDN. Compliance ## Bootstrap and the GDPR - Legal basis Legitimate interest under Article 6(1)(f) GDPR when Bootstrap is self-hosted. When loaded from a non-EU CDN, the Bonn Regional Court ruling on Google Fonts may require prior consent unless self-hosting or an EU CDN is used. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, German TTDSG / TDDDG, EU-US Data Privacy Framework ### Impact assessment (DPIA) A DPIA is generally not necessary for Bootstrap. A short transfer impact assessment is enough when the framework is loaded from jsDelivr or another non-EU CDN, documenting that only IP and User-Agent are transmitted and that self-hosting eliminates the transfer. ### Sample text for your banner > This website uses the Bootstrap CSS framework. Bootstrap itself does not set cookies and does not collect data. The compiled CSS and optional JavaScript are served from our own domain. No specific Bootstrap consent is required. Cookies and trackers ## What Bootstrap sets and contacts - Tracking method CSS framework with optional JavaScript components, loaded as static files. No cookies set by Bootstrap itself; hosting CDN logs HTTP requests. - Server location When self-hosted: same origin as the website. From cdn.jsdelivr.net: Cloudflare and Fastly global edge. From getbootstrap.com / npm: developer download. - Cookieless mode available Yes - Data transferred outside the EU Bootstrap is open source under the MIT license and was originally released by Twitter. The library does not transfer data. The main public CDN (cdn.jsdelivr.net) is operated by jsDelivr through Cloudflare Inc. and Fastly Inc., both US controlled and certified under the EU-US Data Privacy Framework. ### Third-party domains contacted (4) - `cdn.jsdelivr.net` - `cdnjs.cloudflare.com` - `getbootstrap.com` - `unpkg.com` Questions ## Frequently asked questions about Bootstrap Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Bootstrap set any cookies? No. Bootstrap is a CSS framework with optional JavaScript components and sets no cookies, uses no localStorage and performs no tracking. ### Do I need consent to use Bootstrap? Self-hosted Bootstrap needs no specific consent. Loading from jsDelivr or another non-EU CDN may require consent because the visitor IP is transmitted to a US provider. ### What is the legal basis for Bootstrap? Legitimate interest under Article 6(1)(f) GDPR when self-hosted. With a public CDN, gather opt-in consent or document a legitimate interest assessment. ### Does Bootstrap transfer data to the United States? Only when loaded from cdn.jsdelivr.net (Cloudflare and Fastly) or cdnjs.cloudflare.com. Self-hosting on an EU server eliminates the transfer. ### Is a DPIA required for Bootstrap? No. A short transfer impact assessment is enough for the public CDN scenario. ### How do I implement Bootstrap compliantly? Install via npm, bundle the CSS and optional JavaScript with the rest of the application, serve from your own domain or an EU CDN, add Subresource Integrity hashes and configure a Content Security Policy. ### Are there alternatives to Bootstrap? Tailwind CSS, Bulma, Foundation, UIKit, Pico CSS, Beer CSS, Open Props for CSS only, and component libraries such as Shoelace, Material Web Components and Spectrum CSS. ### How do I update the cookie policy for Bootstrap? Self-hosted Bootstrap requires no mention. With a third party CDN, list the provider, the IP transfer on each load and the applicable EU-US Data Privacy Framework or Standard Contractual Clauses basis. Same category ## More services: Frameworks [See the whole category](https://www.flowconsent.com/en/services/framework) ### [Angular Material](https://www.flowconsent.com/en/services/framework/angular-material) [Angular Material is a JavaScript framework designed for building fast, interactive, and scalable web applications. It provides component-based architecture, reactive data binding, and efficient DOM rendering. Angular Material supports server-side rendering, static site generation, and progressive web apps. With a rich ecosystem of plugins and developer tools, Angular Material accelerates frontend development and delivers exceptional user experiences with optimized performance and SEO-friendly output.](https://www.flowconsent.com/en/services/framework/angular-material) [Frameworks](https://www.flowconsent.com/en/services/framework/angular-material) · ### [CodeIgniter](https://www.flowconsent.com/en/services/framework/codeigniter) [CodeIgniter is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. CodeIgniter integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, CodeIgniter helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/framework/codeigniter) [Frameworks](https://www.flowconsent.com/en/services/framework/codeigniter) · ### [Typer.js](https://www.flowconsent.com/en/services/framework/typer-js) [Typer.js is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Typer.js integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Typer.js helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/framework/typer-js) [Frameworks](https://www.flowconsent.com/en/services/framework/typer-js) · ### [Jekyll](https://www.flowconsent.com/en/services/framework/jekyll) [Jekyll is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Jekyll integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Jekyll helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/framework/jekyll) [Frameworks](https://www.flowconsent.com/en/services/framework/jekyll) · ### [Intersection Observer](https://www.flowconsent.com/en/services/framework/intersection-observer) [Intersection Observer is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Intersection Observer offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Intersection Observer empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/framework/intersection-observer) [Frameworks](https://www.flowconsent.com/en/services/framework/intersection-observer) · ### [Laravel Echo](https://www.flowconsent.com/en/services/framework/laravel-echo) [Laravel Echo is a backend web framework providing a structured environment for building robust server-side applications and APIs. It offers routing, database management, authentication, and middleware support. Laravel Echo follows established design patterns and conventions promoting clean, maintainable code. With ORM integration, template engines, and security features, Laravel Echo accelerates backend development and enables teams to deliver scalable web applications efficiently.](https://www.flowconsent.com/en/services/framework/laravel-echo) [Frameworks](https://www.flowconsent.com/en/services/framework/laravel-echo) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)