CDN from Cloudflare block

Hi @anna88sabu,

First of all, please excuse my late reply.

Technically, it is possible to block Cloudflare CDN for JavaScript and similar libraries with Real Cookie Banner. However, it is necessary to consider the consequences of this action.

We must point out that the following statements do not constitute legal advice. Therefore, I can only give you evaluations from our intensive experience with the EU legal regulations in practice and a technical assessment of the situation.

cdnjs.cloudflare.com (I expect you mean that one) is typically a so-called CDN (Content Delivery Network). This stores files on a large number of servers worldwide in order to be able to deliver them to the website visitor from the geographically closest server as quickly as possible. In almost all cases, not all servers are located in the EU or in secure third countries within the meaning of EU data protection law. The transfer of the website visitor’s IP address as personal data to the CDN’s servers and especially the potential transfer to unsafe third countries can usually only take place after your website visitors have given their consent. In general, a CDN is not a technically essential part of the web hosting, so that a legitimate interest does not come into question. Compare, among others, the decision of the VG Wiesbaden of 01.12.2021, Ref. 6 L 738/21.WI, the judgment of the OLG Cologne of 09.10.2020, Ref. 6 U 32/20 or the judgment of the LG München I of 20.01.2022, Ref. 3 O 17493/20. For you as a website operator, this means that we have the legal opinion that the CDN may only be used after consent has been given. However, refusing the CDN will result in parts of your website not working, as necessary scripts will not be able to load. Therefore, if you deliberately use the CDN, you should avoid it. If the CDN is surprisingly used on your website, it is probably because your theme or one of your WordPress plugins uses it. You would have to host their scripts locally, which is only offered as an option by a few themes or plugins. As of today, we don’t know of any practical solution to this problem other than asking the theme/plugin manufacturer to host them locally. Consequently, there is no service template for the CDN you might be useful.

If you have any further questions, please don’t hesitate to let us know!

Best regards,

Jan

Hi Themis,

thanks for your additions and research. We must point out that the following statements do not constitute legal advice. Therefore, I can only give you evaluations from our intensive experience with the EU legal regulations in practice and a technical assessment of the situation.

It is correct that there has been a new legal basis for EU-US data transfer since June 2023 with the TADPF (adequacy decision according to Art. 45 GDPR). We have also reported on this topic in our blog at https://devowl.io/2023/us-data-processing-tadpf/. In order for data processing in the USA to be considered secure, companies must self-certify. Cloudflare, Inc. is self-certified in accordance with the requirements of the TADPF (see entry at https://www.dataprivacyframework.gov/list). This means that EU-US data transfer is currently no longer a problem for Cloudflare.

However, Cloudflare operates servers in at least the following countries that are considered unsafe in terms of the level of data protection in the EU, whereby the personal data of your website visitors could be processed there (as of March 2024): Afghanistan, Albania, Algeria, Angola, Antigua And Barbuda, Armenia, Australia, Azerbaijan, Bahamas, Bahrain, Bangladesh, Barbados, Belarus, Belize, Benin, Bhutan, Bolivia, Bosnia And Herzegovina, Botswana, Brazil, Brunei Darussalam, Burkina Faso, Burundi, Cambodia, Cameroon, Cape Verde, Central African Republic, Chad, Chile, China, Colombia, Comoros, Congo, Congo, Democratic Republic, Costa Rica, Cuba, Djibouti, Dominica, Dominican Republic, Ecuador, Egypt, El Salvador, Equatorial Guinea, Eritrea, Ethiopia, Fiji, Gabon, Gambia, Georgia, Ghana, Grenada, Guatemala, Guinea, Guinea-Bissau, Guyana, Haiti, Honduras, India, Indonesia, Iran, Islamic Republic Of, Iraq, Jamaica, Jordan, Kazakhstan, Kenya, Kiribati, North Korea, Kuwait, Kyrgyzstan, Lao People’s Democratic Republic, Lebanon, Lesotho, Liberia, Libyan Arab Jamahiriya, Madagascar, Malawi, Malaysia, Maldives, Mali, Marshall Islands, Mauritania, Mauritius, Macedonia, Mexico, Federated States Of Micronesia, Moldova, Monaco, Mongolia, Montenegro, Morocco, Mozambique, Myanmar, Namibia, Nauru, Nepal, Nicaragua, Niger, Nigeria, Oman, Pakistan, Palau, Panama, Papua New Guinea, Paraguay, Peru, Philippines, Qatar, Russian Federation, Rwanda, Saint Kitts And Nevis, Saint Lucia, Samoa, San Marino, Sao Tome And Principe, Saudi Arabia, Senegal, Serbia, Seychelles, Sierra Leone, Singapore, Solomon Islands, Somalia, South Africa, Sri Lanka, Sudan, Suriname, Swaziland, Syrian Arab Republic, Taiwan, Tajikistan, Tanzania, Thailand, Timor-Leste, Togo, Tonga, Trinidad And Tobago, Tunisia, Turkey, Turkmenistan, Tuvalu, Uganda, Ukraine, United Arab Emirates, Uzbekistan, Vanuatu, Holy See (Vatican City State), Venezuela, Vietnam, Yemen, Zambia and Zimbabwe.

In our opinion, the best solution to the problem with the other unsafe third countries is the agreement of Standard Contractual Clauses with Cloudflare, which Cloudflare also provides for the conclusion of the contract (https://www.cloudflare.com/cloudflare-customer-scc/). In the Cloudflare service of Real Cookie Banner you can state if you have concluded Standard Contractual Clauses. This means that your website visitors will see in the cookie banner that you are taking this appropriate safeguard to ensure the security of their personal data.

I hope this information helps you!

Best regards,
Jan

Hi Themis,

Your assumption is totally correct. In our service templates in the PRO version, these fields are already prefilled (if the template is already updated to the latest requirements).

If you are happy with our support want to do us a favor, please rate Real Cookie Banner on wordpress.org! Thanks 🙂

Best regards,
Jan