Prospect One

Overview

jsDelivr is a free, open-source content delivery network (CDN) purpose-built for open-source JavaScript libraries and npm packages. Operated by Prospect One, a web infrastructure company, jsDelivr serves billions of requests per month to web developers worldwide who use it to load popular front-end libraries — jQuery, Bootstrap, Vue.js, React, lodash, Font Awesome, and thousands of others — without self-hosting them. The CDN has edge nodes across multiple continents and is available at no cost under an open-source community model.

jsDelivr is unique among CDNs in providing a permanent URL structure that never 404s — even for deleted or deprecated npm packages — making it a reliable long-term asset hosting option. It also supports a GitHub integration that allows any public GitHub repository's files to be served via the CDN automatically.

What This Script Does

jsDelivr is a pure asset delivery service with no client-side tracking code, advertising capabilities, or behavioral data collection.

How it works:

• Requests to cdn.jsdelivr.net/npm/[package]@[version]/[file] or cdn.jsdelivr.net/gh/[user]/[repo]/[file] are resolved at the CDN edge and the requested static file (JS, CSS, fonts, images) is returned
• The browser loads the file as a standard <script>, <link>, or <img> resource — no jsDelivr JavaScript executes within the page context
• No cookies are set on the visitor's browser by jsDelivr for any purpose
• No localStorage or sessionStorage entries are written
• No tracking pixels or beacons are fired

Server-side access logs: jsDelivr's CDN infrastructure logs standard HTTP access data — including the requesting IP address, requested URL, timestamp, user agent string, and referrer — for purposes of abuse prevention, security monitoring, and aggregate usage statistics (used to publish download counts on npm). This logging occurs at the infrastructure level, not through any browser-side mechanism, and constitutes server log data rather than cookie-based tracking.

Subresource Integrity (SRI): jsDelivr URLs are compatible with the integrity attribute for Subresource Integrity verification, allowing browsers to cryptographically verify that the delivered file matches the expected content and reject tampered assets.

URL structure examples:

• https://cdn.jsdelivr.net/npm/[email protected]/dist/axios.min.js
• https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css
• https://cdn.jsdelivr.net/gh/username/repository@version/path/to/file.js

Consent & Compliance

jsDelivr falls under the essential consent category.

• GDPR/ePrivacy: No consent required. jsDelivr does not set cookies, access terminal device storage, or perform any browser-side tracking. The server-side IP logging for abuse prevention constitutes legitimate interest processing under Article 6(1)(f) GDPR and does not trigger the Article 5(3) ePrivacy requirement for consent.
• CCPA/CPRA: jsDelivr does not collect personal information for commercial purposes. Server-side access logs are not shared or sold.
• ePrivacy Directive: Article 5(3) applies only to the reading or writing of information on terminal equipment. jsDelivr does not engage in this activity.
• Data transfers: jsDelivr CDN infrastructure is distributed globally. Prospect One is a EU-based entity; server log data processing is covered under standard EU data protection requirements.

Should You Block This Without Consent?

No. jsDelivr is essential infrastructure for delivering front-end libraries and assets. It does not set cookies, track users, or collect behavioral data. Blocking it would break any functionality dependent on the libraries it serves. No consent gate is warranted.