A Cloud-Based Middleman for Third-Party Scripts

A recent ruling by the Austrian Data Protection Authority (Datenschutzbehörde) has put EU companies using Google Analytics in a difficult spot. The regulator found that a website’s use of the analytics tool violated the GDPR as interpreted by the 2020 “Schrems II” decision, because Google Analytics could transmit full or truncated IP addresses to servers in the United States.

For site operators, the obvious answer—disabling all trackers—would leave them blind to user behavior. A more practical path is to keep popular tools like Google Analytics while preventing personal data from leaving the EU in the first place. That’s the problem Cloudflare Zaraz is designed to solve.

Why the Austrian Ruling Matters

The GDPR doesn’t outright forbid transferring EU residents’ personal data to other countries. It requires that such transfers happen under legal mechanisms that guarantee GDPR-level protections. Until Schrems II, the EU-US Privacy Shield was one such mechanism. The Court of Justice of the European Union invalidated that agreement in July 2020, finding it didn’t adequately protect EU data from US government surveillance. Standard Contractual Clauses remain a valid transfer tool, but only when supplemented with additional safeguards.

Following Schrems II, the advocacy group NOYB filed 101 complaints against European sites using Google Analytics and Facebook Connect, arguing these trackers sent personal data to the US without sufficient supplementary measures. The Austrian decision is the first major ruling on those complaints. The Datenschutzbehörde concluded that IP addresses qualify as personal data—they can be linked to individuals—and that Google lacked the supplementary measures needed to justify transferring them to the US.

The ruling applies to a single website’s implementation, not a continent-wide ban on Google Analytics. Still, it sets a precedent that other European regulators may follow. The stakes are high for any site running third-party tools: every request a browser makes to an external server—whether for a script, an analytics beacon, or an image pixel—exposes the visitor’s IP address. That’s inherent to how the web has worked since its early days.

If regulators across Europe adopt the same interpretation, the industry may need to rethink how IP addresses factor into internet architecture altogether. Cloudflare and others are exploring protocols like Oblivious DNS over HTTPS to decouple IP addresses from the content being queried, but that’s a longer-term vision. In the meantime, companies need immediate, scalable answers—especially given that the median website loads more than 20 third-party solutions, and sites at the 90th percentile load close to 90.

Moving Third-Party Tools to the Cloud

Zaraz is a third-party manager that loads tools like analytics packages, advertising pixels, and widgets on Cloudflare’s edge using Workers, rather than in the visitor’s browser. This approach addresses two weaknesses of traditional tag management. First, the browser never communicates directly with the third-party vendor, so the user’s IP address isn’t exposed in every request. Second, since all third-party scripts run on Cloudflare servers instead of the client, site operators gain visibility and control over what data those scripts handle.

A concrete example: when Google Analytics loads via Google Tag Manager or a direct script tag, the browser fetches analytics.js and then sends HTTP POST requests to https://www.google-analytics.com/collect. Both steps reveal the end-user’s IP address, and the URL may carry identifiers like the Google Client ID. With Zaraz, all communication flows between Cloudflare’s servers and Google’s endpoints. There’s no browser-to-Google traffic at all, giving operators a layer of control that didn’t exist before.

That control extends to privacy settings. Zaraz customers can simply toggle off IP address transfer when configuring tools like Google Analytics or the Facebook Pixel/Conversion API, preventing the very data point that triggered the Austrian ruling from leaving their servers. A related Data Loss Prevention (DLP) feature scans all outgoing requests for sensitive information—names, email addresses, credit card numbers, IP addresses—and can mask or alert on matches. This gives organizations full visibility into what their third-party tools are collecting.

Keeping Data in the EU

Cloudflare retains logs as part of its service, so EU companies rightly ask whether Zaraz just shifts the data flow problem from Google to Cloudflare. For Enterprise customers, Zaraz can be combined with the Data Localisation Suite, which includes two relevant features. Regional Services lets customers specify where Cloudflare processes traffic, including Zaraz workloads. Since Zaraz runs in a first-party context under the customer’s domain, all Data Localisation settings apply to it: a visitor’s request can be routed to an EU data center, processed there, and never inspected by Cloudflare’s network outside that region.

The Customer Metadata Boundary extends this further, ensuring that even metadata—records describing activity on Cloudflare’s network—stays within the EU for customers who enable it. Zaraz also doesn’t log end-user information by default, and for Data Localisation Suite customers, even error logs—the one exception to that rule—can be disabled entirely.

Privacy Features on the Roadmap

Zaraz’s near-term development plans include three privacy-oriented additions:

  • Consent Manager: A built-in tool that integrates with Zaraz, letting site operators act on user consent choices without patching together separate systems.
  • Geolocation Triggers: New trigger rules based on a visitor’s location, allowing specific tools to load or specific events to fire only for users in certain regions.
  • DLP Pattern Templates: Pre-built scanning patterns for common PII categories, so customers don’t have to create their own regex rules from scratch.

These features aim to give EU companies a practical way forward: they can keep using the analytics and marketing tools their teams rely on, without exposing EU residents’ personal data to jurisdictions where GDPR protections don’t apply.