I have a website hosted in a European server. The website is static (serverless) so I can take advantage of a CDN to serve its whole content.

A CDN is, basically, a distributed network of servers. That means that a copy of my website would be hosted on several servers around the world. User requests are (ideally) directed to the server which is closest to the user. By doing so, a CDN improves the performance of the site.

How is this relevant concerning the GDPR?

  1. By using a CDN I'm adding to the system a new third-party that will collect the IP and other metadata from my users. Obviously I can't get consent from the user beforehand: when they hit the server it is already too late.

  2. Probably, users will get routed to a server close to them, but this is not guaranteed. I don't know to which server they are going to connect. I don't even know the country. It could be that a German user end up sending his IP, browser footprint, etc. to a server in Japan (unlikely but possible). Because I don't know it, I can't inform the user about it.

My assumptions are:

  1. Without CDN, the hosting provider would collect that same data so I don't think there is a relevant difference. I just need to inform my users in the privacy policy which CDN provider I use and that it collects personal data on the basis of legitimate interests (Art.6(1)(f)), as I do with the hosting provider.

  2. Because there is a potential transfer of personal data out of the EU, I must ensure that the DPA that I sign with the CDN provider includes the SCC. Also, I must inform the users about this possible data transfer in my privacy policy.

Are my assumptions correct?

Is there, in the frame of the GDPR, any other aspect to take in consideration when using a CDN?

2 Answers 2


Are my assumptions correct?

Yes, this is precisely the sort of thing that would fall under the purview of "the purposes of the legitimate interests pursued by the controller or by a third party", as it fundamentally enables you to deliver the service to the data subject, and its also difficult to argue that "such interests are overridden by the interests or fundamental rights and freedoms of the data subject" given its a fundamental part of delivering the service before any consent can be given.

Its not the intention of the GDPR to solely require a direct relationship between the data controller and data subject, its intention is to allow the data subject to control more of the relationship than they did previously - in some cases, that control remains with the data controller, which is why not all of the lawful basis for processing rest on consent.

So long as you ensure that the CDN provider has a relevant privacy policy and is identified as a data processor in your privacy and data policy then you are good to go.

In my mind, this is similar to the issue of how the data subjects packets get to you from their computer - we aren't including all of the network providers who carry the packets between the data subject and the processor (despite the fact that those providers will have access to much of the same information as the CDN, such as IP address, source, destination etc), even though in many cases we don't know that information (for example which route it will take over the internet). The only difference here is that as the data controller, you know about the CDN and can include it in your policies, so you should.

  • Thank you very much for your answer. I would like to expand the question. What if you are using a CDN to load files after the main content had been loaded in order to increase performance and speed to have fast loading times? Is it a legitimate interest, as fast loading times directly convert to higher conversion rates?
    – velop
    Commented Feb 2, 2022 at 14:46

Yes, as long as they agree to the privacy policy it is acceptable.

If they are not allowed to agree or view the policy it would be a violation.

  • 1
    This is a very simplistic and therefore misleading answer. Agreeing to a policy is not the same as consent, which is anyway not the panacea some believe it to be. The answer is also very assertive, and could have been better explained with examples of how and why, perhaps referencing the law given that this is the Law SE. Definitely don't let the downvotes put you off contributing, but consider your answers carefully. Good luck!
    – Sam_Butler
    Commented Feb 28, 2020 at 13:49
  • When I downvoted this answer, I left a comment to explain why and give constructive feedback. To have that comment then downvoted is not in the spirit of this platform.
    – Sam_Butler
    Commented Mar 9, 2020 at 9:38
  • @Sam_Butler huh? You can’t downvote comments - I can see your original comment just fine above your one today.
    – user28517
    Commented Mar 10, 2020 at 8:44
  • Thanks @Moo, not sure what happened then. Showed as -1, now shows as 1 (comment upvotes). Maybe I was being oversensitive!
    – Sam_Butler
    Commented Apr 21, 2020 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .