Cloudflare Zaraz

Overview

Cloudflare Zaraz is a server-side tag management platform that fundamentally changes how third-party marketing and analytics scripts execute on websites. Instead of loading third-party JavaScript directly in the visitor's browser, Zaraz intercepts tag requests at Cloudflare's edge and executes them server-side, proxying only the necessary data to the third-party vendor. This architecture reduces the number of client-side scripts, improves page load performance, and limits direct third-party access to visitor browsers.

What This Script Does

Zaraz replaces traditional client-side tag managers (like Google Tag Manager) with an edge-computed approach.

• Script loaded: A single lightweight Zaraz loader script from the site's own domain (proxied through Cloudflare) replaces multiple third-party scripts. This loader captures page events and sends them to Cloudflare's edge.
• Edge processing: When a page event occurs (page view, click, form submission), the Zaraz loader sends the event data to Cloudflare's edge network. At the edge, Zaraz evaluates trigger rules and executes the configured third-party tags server-side — sending the appropriate data to Google Analytics, Meta Pixel, HubSpot, or any other configured vendor.
• Cookie management: Zaraz can manage first-party cookies on behalf of configured vendors (e.g., creating a _ga-equivalent cookie for Google Analytics). Cookie behavior is controlled through Zaraz's configuration rather than by third-party scripts running in the browser.
• Consent integration: Zaraz includes built-in consent management that controls which tags fire based on the visitor's consent state. Tags can be assigned to consent categories, and Zaraz blocks their execution until the appropriate consent is granted.
• Data collected: Page URL, referrer, browser user agent, page events, and any custom data layer variables configured by the site operator. This data is processed at Cloudflare's edge and selectively forwarded to configured vendors.
• Reduced third-party exposure: Because vendor scripts do not load directly in the browser, third-party vendors cannot access the visitor's cookies, DOM, or other browser APIs beyond what Zaraz explicitly provides.

Consent & Compliance

Cloudflare Zaraz falls under the functional consent category as tag management infrastructure.

Under GDPR and ePrivacy, Zaraz itself is a tag management tool — its compliance profile depends on which third-party tags it executes. The Zaraz loader script and edge processing are functional infrastructure. However, the tags it manages (analytics, marketing) retain their original consent requirements. Zaraz's architectural advantage is that it prevents third-party scripts from directly accessing the browser, reducing the cookie and tracking surface. The built-in consent management ensures tags only fire when appropriate consent is granted.

Under CCPA/CPRA, Zaraz's role as an intermediary means the data it forwards to third-party vendors inherits those vendors' CCPA obligations. The site operator must configure Zaraz to respect opt-out signals (Do Not Sell/Share) for marketing tags.

Should You Block This Without Consent?

No. Zaraz itself is functional infrastructure — a tag management layer that controls how other scripts execute. Blocking Zaraz would prevent all managed tags from functioning, including those with consent. The correct approach is to use Zaraz's built-in consent management to control individual tags based on visitor consent preferences, allowing the Zaraz loader to run unconditionally while gating each downstream vendor tag on the appropriate consent category.