Why Third-Party Scripts Are a Privacy Problem
Website owners control how their own code collects, transmits, and stores user data. But the reality is that most sites—around 94% of the web, according to the HTTP Archive—load third-party code. Those third-party scripts, typically delivered from remote servers and executed in the browser, operate with nearly the same privileges as the hosting site itself. They can modify page content, set cookies, read form fields, inspect URLs, and track visitors. This unrestricted access was a design necessity when such tools were first built, but it has created ongoing risks: compromised scripts have hijacked visitor data, and even well-intentioned tools routinely collect more sensitive information than site owners realize.
Managed Components: A Permission-Based Replacement
Cloudflare has open-sourced Managed Components, a new API for loading third-party tools in a more secure and privacy-aware fashion. The approach eliminates third-party scripts by default. Instead, each tool runs as a component under the control of a Component Manager like Cloudflare Zaraz.
Managed Components are transparent about their needs. When you add one to your site, the Component Manager lists the permissions it requires, such as setting cookies, making client-side network requests, or installing a widget. You can revoke optional permissions if you want a stricter privacy posture.
You also control what data each component receives. The Component Manager shows exactly which information a tool consumes—IP addresses, user agent strings, and so on—and lets you filter, mask, or block each field.
Content-Aware Data Loss Prevention
Zaraz is adding Data Loss Prevention (DLP) capabilities that go beyond field-level controls. DLP filters inspect the actual content flowing into a Managed Component, detecting personally identifiable information like names, email addresses, and Social Security numbers even when they appear in unexpected fields.
These filters are configurable by condition. You can apply them only to users in specific geographies, on particular pages, or with certain cookies, and you can mix rules. Each filter can also be scoped to specific Managed Components, so the same filter can behave differently depending on the destination.
Actions are per-filter. For a detected SSN you might block the event entirely, while a suspected first name only triggers a warning. Masking is also available: an email like [email protected] can be sent as [email protected], preserving the event while hiding the address.
Because DLP rules run inside the component manager, they fence the information before the component ever accesses it—not just at the network boundary before transmission.
Availability
Managed Components are open source, so you can write your own if a tool you use isn't covered. Cloudflare Zaraz is available today as a Component Manager. The advanced permissions handling, data masking, and DLP Filters are in a closed beta that users can join.
