Use of Cookies and Tracking Technologies

What it is

Fastly uses cookies, web beacons, tags, and scripts on its website to collect information about how visitors use the site and to support analytics and advertising purposes. These technologies can identify you across sessions and, through third-party providers, potentially across other websites.

Why it matters (compliance & governance perspective)

Cookie and tracking technology use is the primary mechanism through which personal data is collected from casual website visitors, and it triggers consent and disclosure obligations in the EU, UK, and California.

Consumer impact (what this means for users)

Visiting Fastly's website may result in cookies and tracking scripts collecting information about your device, browser, and behavior, which may be shared with third-party analytics and advertising providers. EU and UK residents should manage their cookie consent preferences; California residents can opt out of data sharing.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Cookie and tracking technology use is governed in the EU by the ePrivacy Directive (as implemented in national law) and GDPR, requiring informed consent prior to non-essential cookie placement. The UK has parallel requirements under PECR and UK GDPR. The FTC has issued guidance on tracking technologies and their role in online behavioral advertising. The IAB's Transparency and Consent Framework is widely used as a consent management approach, though its compliance with GDPR has itself been subject to regulatory challenge. (2) GOVERNANCE EXPOSURE: Medium. The combination of tracking technology use and sharing data with advertising and analytics partners creates meaningful regulatory exposure, particularly in the EU where non-essential cookies must be preceded by valid consent. The policy does not specify in detail which cookies are essential versus non-essential or provide a cookie inventory, which is increasingly expected by EU regulators. (3) JURISDICTION FLAGS: EU/EEA member states (through their national implementations of the ePrivacy Directive) and the UK (through PECR) create the strictest requirements. California's CPRA includes provisions relevant to tracking technologies used for cross-context behavioral advertising. Enterprise customers deploying Fastly scripts on their own websites may inherit compliance obligations for those scripts. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers who use any Fastly-provided JavaScript, pixels, or tracking tags on their own customer-facing properties should conduct a tag audit and ensure these tools are disclosed in their own cookie policies and consent management platforms. Failure to disclose third-party tracking tools has been a basis for regulatory action against website operators. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should review Fastly's cookie consent management implementation on its own website to assess whether it meets current standards (granular consent, easy withdrawal, no dark patterns). For enterprise customers, a vendor cookie audit should be conducted to identify any Fastly-associated tracking that may be active on their properties.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Controller vs. Processor Distinction medium
• Data Sharing with Advertising and Analytics Partners medium
• Cross-Border Data Transfers via Standard Contractual Clauses medium
• California Resident Rights under CCPA/CPRA medium
• Data Sharing in Corporate Transactions low
• Data Retention Practices medium

Related Analysis

• Netflix Updated Terms Authorize Voice Data Collection: April 2026

  Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.

• What Google Actually Knows About You

  Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.