Zaraz responds to CNIL guidance with new privacy controls

France’s data protection authority, the CNIL, recently published guidelines on GDPR-compliant ways to load Google Analytics and similar marketing tools. The guidance follows earlier notices to organizations that their use of such tools resulted in impermissible data transfers to the United States. Cloudflare has responded with a set of Zaraz privacy features plus a step-by-step configuration guide aimed at helping sites keep using these tools without sending EU personal data to the US.

What the new Zaraz settings do

The new controls are available now in the Zaraz dashboard. The full list:

  • Remove URL query parameters: Strips all query parameters from URLs reported to third-party servers, turning https://example.com/?q=hello into https://example.com. This removes identifiers like UTM parameters, gclid, and similar values that can be used for fingerprinting. Applies to all Zaraz integrations.
  • Hide originating IP address: Prevents the visitor’s IP address from being sent to a third-party tool’s server. Configured per tool, currently supported for Google Analytics Universal, Google Analytics 4, and Facebook Pixel, with more tools to follow. A less strict option on the Zaraz settings page trims IP addresses across all tools.
  • Clear user agent strings: Removes pieces of information from the User-Agent header, such as versions and extensions, that could enable tracking or fingerprinting. Applies to server-side integrations only.
  • Removal of external referrers: Hides the referring page URL from third-party servers, except when the referrer is on the same domain, to avoid splitting analytics sessions. Applies to all Zaraz integrations.

Setting up Google Analytics with the new features

The following steps use Google Analytics Universal as the example, but the same principles apply to Facebook Pixel and other server-side integrations Zaraz supports.

Step 1: Install Zaraz. For sites proxied by Cloudflare (Orange Clouded), Zaraz loads automatically with no code changes. Sites not proxied by Cloudflare can load Zaraz manually with a JavaScript snippet. A Chrome extension is available to check whether a site is Orange Clouded.

Step 2: Add Google Analytics via the Zaraz dashboard. When added through the Zaraz tools library, Google Analytics loads server-side by default. No cloud environment or proxy server setup is needed. A request goes from the end user’s browser to a Cloudflare Worker on the site’s own domain, and that Worker communicates with Google Analytics’ servers directly; there is no direct browser-to-Google connection. Note that proxying alone is not sufficient under the CNIL guidance.

Step 3: Configure the tool and hide IP addresses. In the tool’s settings, enter the Tracking ID and toggle on “Hide Originating IP Address.” Zaraz removes the IP at the edge, before any request reaches Google’s servers. Sites that want Zaraz to run only within the EU can use Cloudflare’s Data Localization Suite. More complex configurations, such as Ecommerce tracking, Custom Dimensions, and Custom Metrics, can be set up as well.

Step 4: Enable the privacy features. Toggle on the new privacy options from the Zaraz Settings page, under the Privacy section.

Step 5: Clean the Google Analytics configuration. Several implementation habits should be reviewed:

  • Avoid including any personally identifiable information. Applying the CNIL’s anonymization guidance will likely make unique identifiers such as Google Analytics’ User ID View ineffective; sites that rely on those features may want to stop using such tools to avoid data discrepancies.
  • To hide the Client ID, go to the Google Analytics settings page, click “add field,” choose “Client ID,” and insert any string as a constant value. This limits Google’s ability to aggregate data and will likely create discrepancies in session and user counts, though event counting should still work.
  • Remove cross-site identifiers from the implementation, including CRM identifiers and URL query parameters used to share identifiers across domains. Avoid cross-domain tracking (also called “site linking”).
  • Review custom configuration for personal data: go through Custom Dimensions, event parameters/properties, Ecommerce Data, and User Properties. A forthcoming Zaraz Data Loss Prevention feature is expected to automate this process at scale.

Step 6: Done. Following this guide will create some limitations in Google Analytics. Dropping UTM parameters and referrers means traffic sources and campaigns can’t be tracked; dropping User ID disables the User ID View. Those trade-offs are a step toward a more privacy-oriented web, and Cloudflare indicates more privacy tools are on the way. Additional background is available on the Data Localization Suite and on keeping analytics data within the EU. Feedback or feature requests can be directed to a Cloudflare account manager or via the team’s Discord channel.