vxe-table

vxe-table is a feature rich data grid component for Vue.js, maintained by the x-extends community and distributed under the permissive MIT license. It targets developers who need editable tables, virtual scrolling, grouping, filtering, tree grids and form integration without paying for a commercial library. Because every feature runs in the visitor browser using JavaScript shipped with the page, vxe-table belongs to the family of pure UI libraries that have almost no privacy footprint of their own.

What vxe-table is and how it is delivered

vxe-table is published as an npm package and bundled into the consumer application during the build step. At runtime the compiled JavaScript executes inside the user browser, reads data that the host application already holds in memory, and renders rows, columns and editors. No vendor controlled server takes part in the request lifecycle. Optionally the library can be loaded from a public content delivery network, but most production deployments ship it inside the main application bundle on the publisher own domain.

What data and cookies it collects

vxe-table does not write to document.cookie, does not use localStorage or sessionStorage for any vendor purpose, does not generate device fingerprints and does not phone home. The component receives the data the application chooses to display (for example a customer list, a product catalogue or an internal report) and renders it; that data never leaves the page. As a result the library itself does not create any cookie that needs to appear in a consent banner.

GDPR and ePrivacy implications

Article 5(3) of the ePrivacy Directive only requires consent when an operator stores information on, or accesses information already stored on, the user terminal. Because vxe-table performs neither operation it falls outside the scope of the cookie rule. Under GDPR the library is not a separate processor: it is a piece of code that runs within the controller own application, comparable to a charting library or a date picker. The processing of personal data shown inside the grid is governed by the application data flow, not by vxe-table.

Consent and transparency requirements

No consent banner entry is mandatory for vxe-table when it is bundled with the application and served from the publisher own domain. If the team chooses to load the script from a public CDN such as jsDelivr or unpkg, the CDN operator will see the visitor IP and the URL of the requested asset. That transfer should be mentioned briefly in the privacy notice under technical delivery providers, but legitimate interest is normally the appropriate legal basis and a banner opt in is not needed.

Practical compliance steps

Self host the bundle through the application build pipeline rather than loading it from a third party CDN; pin a specific version, verify the integrity hash, and review the MIT license text in the project documentation. If sensitive personal data is shown inside the grid, apply the same access controls, retention rules and minimisation principles to that screen as to any other view in the application. Document the library in the software bill of materials so that future security advisories can be triaged quickly.