← All guides

Cloudflare Zaraz: server-side tagging is still third-party processing

Prerequisites

Access to the Zaraz configuration and a complete list of the tools, triggers and transferred fields activated there.

Cloudflare Zaraz supports numerous analytics, advertising and marketing services as well as its own HTTP requests. The fact that tags are integrated via Zaraz instead of directly in the browser does not automatically mean data economy. For each activated service purpose, check transferred fields, cookies and consent logic separately.

Check

After the change, check browser memory, network connections and web server, proxy and application logs separately. A product setting does not automatically prove that no visitor IP is stored at all levels.

Check third-party connections

As a technical basis, additionally External fonts and CDNs: avoid unnecessary third-party connections Use: The decisive factor is which external hosts the browser actually contacts and whether the resource can be delivered locally.

Reset

If the reduced configuration affects a required function, restore only the relevant setting and then recheck data flow, storage, retention and third-party connections.

Related guides

• Plausible proxy: Visitor IP is still passed on to Analytics
• CAPTCHA and spam protection: first local, then external
• Cloudflare Turnstile: CAPTCHA replacement is still a third party
• hCaptcha: integrate data efficiently and recognize third-party connections

Sources and verification

This guide is based on multiple current sources. Vendor documentation is not treated as proof that every concrete installation automatically follows the same privacy characteristics.

• Documentation 1
• Documentation 2

Important: IP processing is not IP storage

An IP address has to be processed to establish and deliver a network connection. Hosting providers, firewalls or DDoS protection may also process or retain it for a limited time for security purposes. No Logging distinguishes this security layer from unnecessary persistent visitor logging by the website, application and ordinary access logs.