I have a website hosted in a European server. The website is static (serverless) so I can take advantage of a CDN to serve its whole content.
A CDN is, basically, a distributed network of servers. That means that a copy of my website would be hosted on several servers around the world. User requests are (ideally) directed to the server which is closest to the user. By doing so, a CDN improves the performance of the site.
How is this relevant concerning the GDPR?
By using a CDN I'm adding to the system a new third-party that will collect the IP and other metadata from my users. Obviously I can't get consent from the user beforehand: when they hit the server it is already too late.
Probably, users will get routed to a server close to them, but this is not guaranteed. I don't know to which server they are going to connect. I don't even know the country. It could be that a German user end up sending his IP, browser footprint, etc. to a server in Japan (unlikely but possible). Because I don't know it, I can't inform the user about it.
My assumptions are:
Are my assumptions correct?
Is there, in the frame of the GDPR, any other aspect to take in consideration when using a CDN?