Tailwind CSS CDN

The Tailwind CSS CDN does not set cookies, does not register a service worker, does not run analytics scripts and does not store anything in localStorage. The only data it processes is the standard server log generated by the HTTP request: the visitor IP address, the user agent, the language headers, the referrer (the URL of your page) and the timestamp. This log is held by the edge operator (Cloudflare, Fastly, Bunny CDN), by the CDN platform (jsDelivr, unpkg or cdn.tailwindcss.com) and by Tailwind Labs Inc. when the official endpoint is used.

Article 5(3) of the ePrivacy Directive only triggers a consent requirement when the service reads or writes information on the user terminal beyond what is strictly necessary. The Tailwind CSS CDN does neither (no cookies, no localStorage, no fingerprinting), so it does not need a cookie banner consent. The processing of the IP at the edge still falls under the GDPR, but it can be justified by legitimate interest (Art. 6(1)(f)) in delivering the requested CSS. The CDN call must, however, be disclosed in the privacy notice.

The IP exposure to the CDN edge is processed under Article 6(1)(f) GDPR, legitimate interest in delivering the page styling to the visitor browser. Document the balancing test in your record of processing: necessity (no first party copy available without extra build steps), reasonable expectations of the visitor (loading remote assets is standard web behaviour) and minimisation (the request only carries technical headers, no personal identifiers beyond the IP and user agent).

Often, yes. Tailwind Labs (cdn.tailwindcss.com), unpkg, Cloudflare and Fastly are US companies, even if their edge nodes are distributed globally. A request that terminates at a European edge may still result in log replication to the US headquarters. Document the transfer in your record of processing, rely on the EU US Data Privacy Framework where the operator is certified, otherwise on Standard Contractual Clauses, and consider self hosting the production CSS bundle to remove the transfer entirely.

No, a DPIA is generally not required for a static CSS asset served by a public CDN. The processing has a low risk profile: no cookies, no profiling, no special category data and only standard server log items. A DPIA only becomes necessary when the CDN call is bundled with other higher risk processing (for example a large scale tracking solution from the same vendor) or when your sector regulator imposes a default DPIA for any US transfer.

Either move to the production workflow (Tailwind CLI or PostCSS build, then serve a purged CSS file from your own origin) or, if you keep the CDN, pin a specific version and add a Subresource Integrity hash to the script tag. Configure a Content Security Policy that restricts style sources to your origin plus the chosen CDN. Disclose the CDN call in the privacy notice with the recipient operator (Cloudflare, Fastly, Tailwind Labs) and the legitimate interest justification.

The recommended alternative is self hosting: run the Tailwind CLI or PostCSS build at deploy time, generate a CSS file containing only the classes you actually use, and serve it from the same origin as the rest of the site. This removes the third party CDN call entirely. If you must keep a CDN, prefer a jsDelivr or unpkg pinned version with Subresource Integrity, or use a European CDN such as BunnyCDN with EU only point of presence and a documented sub processor list.

Add a brief paragraph that names the CDN endpoint actually used (cdn.tailwindcss.com, cdn.jsdelivr.net or unpkg.com), the operator (Tailwind Labs Inc., Prospect One Sp. z o.o. for jsDelivr, Cloudflare Inc. for unpkg and the front edges), the categories of data processed (IP, user agent, referrer, timestamp), the legal basis (Art. 6(1)(f) GDPR legitimate interest), the absence of cookies and the international transfer mechanism (DPF or SCCs). State the retention period at the CDN level and the contact for exercising data subject rights.