Cloudflare Acquires Zaraz to Move Third-Party Tools Off the Browser
Cloudflare has acquired Zaraz, the startup behind a server-side approach to loading third-party scripts, and is launching the integrated product as Cloudflare Zaraz in beta. The service is available free of charge to all Cloudflare customers through the dashboard, with no code changes required. Zaraz was built on Cloudflare Workers from the start, which made the integration straightforward.
The core idea is simple: instead of loading analytics, advertising, chat widgets, and marketing tools as JavaScript in the user's browser, Zaraz runs the integrations on Cloudflare's edge network. Less code executing in the browser means faster page loads and a smaller attack surface.
Why Third-Party Scripts Are a Problem
Third-party tools have become a significant drag on web performance. Zaraz's founders, Yo'av Moshe and Yair Tiram, saw this firsthand — one side pushing to add more tools, the other pushing back on performance and security. After scanning the top 5,000 US domains, they found that third-party tools slowed the web by an average of 40%.
Tag managers were supposed to solve this, but they made it worse. Even Google's own Merchandise Store, which runs mostly Google tools, sees third-party scripts block the main thread for roughly four seconds. GTM itself is responsible for over a second of that blocking. The rise of Customer Data Platforms added more browser-side code, not less.
The scale of the problem is staggering. The median website in 2021 loads 21 third-party solutions on mobile and 23 on desktop. At the 90th percentile, those numbers jump to 89 and 91, respectively. That volume of external code hurts metrics like Total Blocking Time and Time to Interactive, and it affects the bottom line — Google and Deloitte data shows that a 0.1-second improvement in load time can lift conversion rates by up to 10%.
Security and privacy are just as concerning. Because most tools fetch remote JavaScript resources, site owners often have no idea what's actually running on their pages. Many tools chain to other third-party resources or redirect requests to unknown endpoints, exposing users to malicious scripts and creating compliance headaches under GDPR and CCPA.
Browser vendors are also tightening restrictions on third-party cookies, pushing marketing and advertising tools toward API-based integrations that can run server-side. Building that infrastructure at the edge makes sense — it has to run close to the end user to stay fast.
What Cloudflare Zaraz Does
Cloudflare Zaraz lets customers implement a wide range of third-party solutions — from analytics to CRMs — entirely from the dashboard. The beta ships with a library of 18 supported tools. Once configured, the tool loads on the cloud backend, with no JavaScript running in the visitor's browser. The beta also offers an Events API and preset variables for more complex integrations, plus out-of-the-box dataLayer compatibility so Google Tag Manager users can switch without touching their codebase.
Moving execution off the browser not only speeds up pages but also adds a layer of control over sensitive data like Personally Identifiable Information and Protected Health Information, which is too often passed carelessly to vendors. Cloudflare also announced PageShield for sites that still include third-party resources.
Instacart's Results
Instacart tested Zaraz on its shoppers.instacart.com domain with two goals: stronger security and privacy, and better performance metrics. The fact that Zaraz stores no information about the end user and acts purely as a pipeline was a deciding factor. To keep full visibility, Instacart used Cloudflare Workers to proxy all traffic to and from Zaraz through its own subdomain.
The performance gains on mobile were substantial. Total Blocking Time dropped from 500 ms to 0 ms, Time to Interactive improved 63% (from 11.8 to 4.26 seconds), CPU time fell 60% (from 3.62 to 1.45 seconds), and JavaScript weight shrank 63% (from 448 KB to 165 KB).
Desktop improvements were similar in scope. Total Blocking Time went from 65 ms to 0 ms, Time to Interactive improved 23% (from 1.64 to 1.26 seconds), CPU time dropped 55% (from 1.57 to 0.7 seconds), and JavaScript weight was reduced by the same margin as mobile. Zaraz also worked directly with some vendors to optimize integrations further.
Roadmap and Platform Plans
The Zaraz team will continue leading product development from Cloudflare's Portugal office. The stated goal is to turn Zaraz into a platform where third-party vendors can build their own edge-based integrations. Work has already started on expanding the SDK for that purpose.
Several improvements are already in place. Cloudflare customers need no code changes — once enabled, Zaraz's script is inlined directly into the <head> of the HTML. The entire service now runs on the customer's own domain, which helps with control and compliance.
Planned features include geolocation triggers, so different tools can be loaded for visitors in different regions based on local regulations, and Data Loss Prevention, which scans outgoing requests to third-party endpoints for sensitive information like names, emails, and Social Security numbers. The DLP feature is already in use by some enterprise customers.
Zaraz's founders say their research showed the average website could be 40% faster if third-party tools were loaded more efficiently. With the backing of Cloudflare's network, they intend to push the entire industry toward server-side loading and away from traditional tag managers and customer data platforms. The beta is free for Cloudflare users; enterprise customers with custom requirements can join a waitlist for additional functionality.
