Flickity

Flickity is a front end JavaScript carousel and slider library created by Dave DeSandro under the Metafizzy brand. It runs entirely in the visitor browser to power touch friendly, responsive carousels and galleries. Because all of its logic executes on the client side and it stores nothing about the visitor, Flickity is a low risk, functional component from a privacy point of view.

What Flickity is

Flickity turns a group of elements into a flickable, swipeable carousel with options such as autoplay, page dots, previous and next buttons, free scrolling and fullscreen. It is delivered as a CSS file and a JavaScript file that you either host on your own server or load from a public content delivery network. The library has no backend service and sends no data to Metafizzy when it runs.

Data and cookies

Flickity sets no cookies and writes nothing to local storage or session storage that identifies a visitor. It does not collect names, email addresses, behavioural profiles or any other personal data. The library simply reads the markup already on the page and renders an interactive carousel, so there is no tracking layer to disclose in a cookie banner.

GDPR and ePrivacy implications

Because Flickity sets no cookies and reads no information from the visitor device, the consent rules of the ePrivacy Directive are not triggered by the library itself. The one nuance under the GDPR appears when you load Flickity from a third party CDN. In that case the visitor browser must request the file from the CDN, which means the visitor IP address and user agent reach the CDN operator. That request is a small data transfer you should be aware of.

Consent requirements

A self hosted Flickity needs no consent because nothing is stored on the device and no personal data is processed. The appropriate legal basis is legitimate interest under Article 6(1)(f) of the GDPR for providing a functional interface. If you load the library from a non essential third party CDN, some organisations choose to rely on consent for that external request, but most treat a single static asset request as a functional necessity covered by legitimate interest.

Data transfers

The common CDNs for Flickity are jsDelivr, unpkg and cdnjs, and their servers may sit outside the European Union, including in the United States. When the browser fetches the file, the visitor IP address travels to that CDN. This is the only realistic international transfer linked to Flickity, and it disappears the moment you host the files yourself.

Practical compliance steps

To keep things simple, host Flickity on your own domain so no visitor IP leaves your infrastructure. If you prefer a CDN, add a Subresource Integrity hash to the script and style tags so the file cannot be tampered with, and record the CDN in your records of processing activities. Mention the functional carousel in your privacy notice for completeness, and you can leave your cookie policy untouched because the library sets no cookies.