Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Bunny Stream is the video streaming product of BunnyWay d.o.o., a Slovenian content delivery network operator. It offers adaptive HLS and DASH playback, storage zones, transcoding and a no code embed player. Although Bunny is headquartered in the European Union, the global edge network and player analytics still trigger consent obligations under the ePrivacy Directive when the embed is placed on a website.
Bunny Stream is the video streaming product of BunnyWay d.o.o., the Slovenian operator of the BunnyCDN platform. The service combines storage zones for the master files, multi bitrate transcoding, a global edge network and an HTML5 player that integrates as an iframe or as a JavaScript SDK. Publishers upload videos to a Stream Library, configure the language, the watermark and the analytics options, and embed the player on their website. The platform competes with Vimeo, Mux, Cloudflare Stream and JW Player, with a stronger European footprint.
The Bunny Stream player typically writes a session identifier (bcdn_id), a video identifier and local storage entries to remember the playback position, the volume and the chosen quality. When analytics are activated, the player also collects the IP address (truncated upon request), the user agent, the playback events (play, pause, seek, percentage watched), the referrer and the device type. The data is sent to the Bunny back end and aggregated into a dashboard accessible by the publisher.
The cookies and local storage entries written by the Bunny Stream player are not strictly necessary when the embed loads before the user explicitly clicks play. Pre loading the player therefore requires consent under Article 5(3) of the ePrivacy Directive, the CNIL doctrine on video embeds and the German DSK guidance. The cleanest pattern is to display a click to load placeholder until the visitor confirms, or to gate the embed behind your Consent Management Platform.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
BunnyWay d.o.o. is established in Slovenia and processes most of the data within the European Union. Customers can pin the storage zone to specific EU regions such as Frankfurt or Stockholm. The global edge network, however, may serve content from points of presence in the United States, Asia or Latin America when the visitor is closer to those edges. Transfers outside the EEA rely on Standard Contractual Clauses included in the Data Processing Agreement signed with BunnyWay.
Embed the Bunny Stream player only after the visitor accepts the relevant cookie category through your Consent Management Platform, or use a click to load placeholder. Pin the storage zone to an EU region, restrict edge replication to the EEA when possible, sign the Data Processing Agreement and the Standard Contractual Clauses with BunnyWay, document the data flows in your record of processing and reference Bunny in your privacy notice with a link to the Bunny privacy policy.
Websites using Bunny Stream must obtain user consent under GDPR regulations.
DPIA considerations
A standard Bunny Stream embed serving public videos is generally low to medium risk. A DPIA becomes appropriate when the player streams videos that contain personal data, when DRM tokens identify users, when behavioural analytics are activated, or when the global edge serves regions outside the EEA. Document the storage region, the analytics scope and the access rights of BunnyWay support staff.
Sample consent text
Videos on this page are streamed by Bunny Stream operated by BunnyWay d.o.o. in Slovenia. The embedded player writes cookies for playback continuity and aggregated analytics. Loading the player after your consent allows us to deliver smooth playback while respecting your privacy. You can withdraw consent at any time from the cookie preferences link.
Third-party domains contacted
b-cdn.netmediadelivery.netiframe.mediadelivery.netvideo.bunnycdn.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| bcdn_id | first_party | 1 year | Stores the unique visitor identifier used by the Bunny Stream player to deduplicate views and aggregate playback analytics. |
| bcdn_session | first_party | Session | Stores the active session identifier used to deliver adaptive bitrate streaming and segment requests. |
| bcdn_pref | first_party | 1 year | Stores playback preferences such as the chosen quality, the volume and the autoplay state. |
Bunny Stream uses cookies for user preferences — inform visitors with a consent banner.
The player typically writes a session identifier (bcdn_id), a video identifier and local storage entries for the playback position, the volume and the chosen quality. When analytics are enabled, additional identifiers are stored to deduplicate views and aggregate playback events.
Yes, in most cases. Pre loading the player before the user clicks play triggers the consent obligation of Article 5(3) ePrivacy because the cookies are not strictly necessary at that point. The cleanest solution is a click to load placeholder or to gate the iframe behind your Consent Management Platform.
The legal basis is consent under Article 6(1)(a) GDPR for the analytics and continuity cookies set by the player. Strictly necessary cookies that maintain a video stream the user has explicitly started can rely on the Article 5(3) ePrivacy exemption, in which case contract performance under Article 6(1)(b) GDPR is the relevant ground.
Bunny is headquartered in Slovenia and stores master files in EU regions when the publisher selects them. The global edge network may, however, deliver content from points of presence in the United States, Asia or Latin America. Transfers rely on Standard Contractual Clauses included in the BunnyWay Data Processing Agreement.
For public marketing videos a DPIA is rarely mandatory. A DPIA becomes appropriate when the videos contain personal data, when DRM tokens identify users individually, when behavioural analytics are activated or when the global edge serves regions outside the EEA. Document the storage region, the analytics scope and the access rights of BunnyWay support.
Use a click to load placeholder or block the embed behind a Consent Management Platform until the visitor accepts. Pin the storage zone to an EU region, restrict edge replication where possible, sign the Data Processing Agreement and Standard Contractual Clauses, document the retention of analytics events and reference Bunny in your privacy notice.
Common alternatives include Vimeo, Mux, Cloudflare Stream, JW Player, api.video, Wistia and self hosted players powered by Plyr or Video.js with a CDN such as Akamai or AWS CloudFront. Each offers different feature sets, pricing and hosting regions.
List the cookies and local storage entries written by the player, document BunnyWay d.o.o. as a processor, explain the EU storage zone and the global edge network, reference the Standard Contractual Clauses and provide a clear consent management link with a working revocation flow.