jQuery

What jQuery does and how it appears on a website

jQuery is an open source JavaScript library maintained by the OpenJS Foundation. It exposes a small, chainable API that smooths out browser inconsistencies for DOM manipulation, event binding, animations and AJAX. On a website jQuery appears as a single .js file declared in a script tag, either bundled with the rest of the JavaScript (self-hosted) or fetched from a public CDN such as code.jquery.com, ajax.googleapis.com or cdnjs.cloudflare.com.

Cookies and data collected by jQuery

jQuery itself stores nothing on the device. It does not set cookies, does not write to localStorage, does not fingerprint the browser. The only personal data involved is the standard HTTP request to fetch the script: the visitor IP address, the User-Agent header, the referring page URL and TLS metadata. That data is processed by the CDN that hosts the file, not by jQuery as a software component.

GDPR and ePrivacy implications

Loading a script does not store information on the user device, so the strict cookie consent rule of Article 5(3) ePrivacy Directive does not apply per se. However, the request itself transmits the IP address to the third party CDN, which is personal data under the GDPR. The Bonn Regional Court ruling of 20 January 2022 on Google Fonts confirmed that this transmission requires either a clear legal basis or prior consent. The same logic applies to any external CDN used to deliver jQuery.

International data transfers

All three major public jQuery CDNs are US controlled. code.jquery.com is operated by the OpenJS Foundation through StackPath / Edgio infrastructure, ajax.googleapis.com is part of Google global infrastructure, and cdnjs.cloudflare.com runs on Cloudflare. Even when the response is served from a European edge node, the provider remains subject to US law. Google LLC and Cloudflare Inc. are certified under the EU-US Data Privacy Framework, which provides an adequacy basis for the transfer; the jQuery Foundation CDN relies on Standard Contractual Clauses.

Consent and legal basis

For self-hosted jQuery, legitimate interest under Article 6(1)(f) GDPR is sufficient since no third party receives data. When using a public CDN, the operator must either obtain prior opt-in consent before the script tag is rendered, or document a strong legitimate interest balanced against the visitor right to data protection. The safest option for European websites is to self-host the file or to use an EU CDN such as Bunny CDN, KeyCDN or Scaleway Edge.

Practical compliance steps

Audit every page for jQuery script tags pointing to a third party origin, download the matching version, host it on the same domain or on an EU CDN, add a Subresource Integrity hash to the script tag for security, document the choice in the privacy notice, and remove the dependency on code.jquery.com or googleapis.com if user consent is not collected. Where consent is preferred, integrate the script load into the Consent Management Platform so it only fires after opt-in.