Dyte

What Dyte is and what it does

Dyte is a developer platform that provides WebRTC based SDKs and APIs for embedding live video, voice and chat into websites and applications. It was acquired by Cloudflare in late 2023 and is now part of the Cloudflare Realtime product line, sharing the same global edge network for low latency media routing.

Typical use cases include telehealth consultations, online classrooms, remote sales, customer support video calls and collaborative tools. Dyte exposes prebuilt UI components, headless SDKs for web and mobile, and REST APIs for meeting management and recording.

Data and cookies collected by Dyte

When the Dyte SDK is loaded on a page, it fetches JavaScript and configuration from Dyte and Cloudflare domains, opens WebSocket signalling channels and negotiates peer connections for audio and video. During a session it processes audio and video streams, screen shares, chat messages, participant names, device identifiers, IP addresses, browser and operating system metadata, plus quality of service telemetry.

Dyte itself relies mainly on session storage and local storage for SDK state, but also sets a small number of functional cookies on its prebuilt meeting portal (app.dyte.io) for authentication, session continuity and consent preferences. Audio and video streams can qualify as biometric data when processed for unique identification, which engages the special category regime of Article 9 GDPR.

GDPR and ePrivacy implications

Loading Dyte from a third party domain and writing to local storage on the user device falls under Article 5(3) of the ePrivacy Directive. Prior consent is required unless the storage is strictly necessary for a service explicitly requested by the user, which is typically only the case once they have actively asked to join a meeting.

Under the GDPR, the operator of the site is the controller, while Dyte/Cloudflare acts as processor under a Data Processing Addendum. The risk profile is elevated by the use of WebRTC media streams, persistent device identifiers, fingerprinting signals from getUserMedia, and cross-border routing through US and Indian infrastructure.

Consent requirements and legal basis

For a contact widget that loads the Dyte SDK proactively on every page, opt-in consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy is the safest legal basis. The SDK and all related cookies must remain blocked until the user accepts the relevant category in the consent banner.

When the meeting itself is the requested service (for example a scheduled telehealth appointment), Article 6(1)(b) contract performance may justify the core processing, but tracking cookies, analytics events and recording features still need separate consent.

Cross-border data transfers

Cloudflare and Dyte operate a global infrastructure with primary presence in the United States and India. European audio, video and signalling data is regularly routed through US and Indian servers. The United States is covered by the EU-US Data Privacy Framework when Cloudflare is certified, otherwise Standard Contractual Clauses apply, supplemented by encryption in transit and at rest.

India does not benefit from an EU adequacy decision, so Standard Contractual Clauses under Article 46(2)(c) GDPR plus a Transfer Impact Assessment are required. Document the routing logic and any data residency options offered by Cloudflare Realtime in your records of processing.

Practical compliance steps

Lazy load the Dyte SDK only after the user grants consent or actively initiates a call, sign the Cloudflare/Dyte Data Processing Addendum, and reference both Dyte and Cloudflare in your privacy policy as joint subprocessors. Disable session recording by default and offer an explicit opt-in before any meeting is recorded.

Run a Data Protection Impact Assessment for telehealth, education and HR use cases, restrict access to recordings, configure short retention periods, and review Cloudflare Realtime documentation for region pinning options. Keep an up to date list of Dyte domains in your Content Security Policy and consent management tool.