Overview
Netlify is a cloud platform for building, deploying, and hosting modern web applications, particularly those built with static site generators and JavaScript frameworks. Unlike traditional hosting providers, Netlify offers an integrated development workflow including continuous deployment from Git, serverless functions, edge computing, and form handling. Netlify's presence in a website's technology stack is typically as the hosting infrastructure itself rather than as a third-party embed.
What This Script Does
When a site is hosted on Netlify, the platform serves the site's content from its global CDN (edge network). The core hosting functionality does not inject additional scripts or set tracking cookies — it simply delivers the website's files to visitors.
Netlify offers several optional features that do have a client-side footprint:
Netlify Analytics
An optional paid feature that collects visitor metrics server-side using access logs rather than client-side JavaScript. Unlike Google Analytics, Netlify Analytics does not set cookies or load tracking scripts in the visitor's browser. All data collection occurs at the CDN edge using request metadata (IP addresses, user agents, referrers).
Netlify Forms
When enabled, Netlify's form handling intercepts HTML form submissions and routes them to Netlify's backend. A small JavaScript snippet may be injected to handle AJAX form submissions. The data collected is whatever the form fields contain, as defined by the site developer. No cookies are set specifically for form handling.
Netlify Identity
If the site uses Netlify Identity for authentication, the netlify-identity-widget script loads and sets authentication cookies (nf_jwt and related tokens) to manage user sessions. These cookies are strictly necessary for authenticated access.
Consent & Compliance
Netlify is classified as functional and essential. As hosting infrastructure, it is essential for the website to function at all. Its optional features (Analytics, Forms, Identity) serve functional purposes without behavioral tracking.
Under GDPR and the ePrivacy Directive, Netlify's hosting and CDN services are essential infrastructure that do not require consent. Netlify Analytics is server-side and does not fall under the ePrivacy cookie consent requirements since it uses no client-side storage. Netlify Identity authentication cookies are strictly necessary. Form handling processes only data the visitor voluntarily submits.
Under CCPA/CPRA, Netlify acts as a service provider processing data on behalf of the website operator. Server-side analytics data (IP addresses, page views) constitutes personal information that should be disclosed in the site's privacy policy.
Should You Block This Without Consent?
No. Netlify is essential hosting infrastructure. Blocking it would make the website entirely inaccessible. Even its optional features (server-side analytics, form handling, authentication) operate without behavioral tracking cookies and serve functional purposes. There is nothing to block in a consent management context.
Is Netlify GDPR compliant?
Netlify typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Netlify can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Netlify, not on Netlify itself.
Consent Categories
Also Known As
Industries
Tracked Domains (2)
netlify.comEssentialnetlify.com is an essential domain operated by Netlify, used to keep the site working, including security, load balancing, and sessions.
netlify.appEssentialnetlify.app is an essential domain operated by Netlify, used to keep the site working, including security, load balancing, and sessions.
Frequently Asked Questions
Related Vendors
Manage consent for Netlify
ConsentStack automatically detects and manages Netlify trackers so your site stays compliant with global privacy regulations.