Privacy policy clauses for Amazon CloudFront
Amazon CloudFront is a content delivery network (CDN) operated by Amazon Web Services that caches and distributes website content globally from servers located near end users. Websites use CloudFront to improve page load speed, reduce bandwidth costs, and enhance performance for geographically dispersed audiences.
Free scan · No signup · Results in 60 seconds
What data Amazon CloudFront collects
Your privacy policy must disclose each of the following data types when you use Amazon CloudFront.
When does Amazon CloudFront trigger privacy obligations?
Data Flow Activation
The moment you deploy Amazon CloudFront as your CDN, your origin server's traffic is routed through AWS infrastructure globally. CloudFront immediately begins collecting and processing:
- –Client IP addresses — logged for every request to determine optimal edge location routing
- –Request headers — including User-Agent, Referer, and custom headers, which may contain personal data depending on your application logic
These data flows are automatic and occur before any user consent mechanism can execute.
Regulatory Triggers
GDPR (applies if any visitor is in the EU): IP addresses qualify as personal data under GDPR recital 30. Once CloudFront processes them, you have a controller-processor relationship requiring a Data Processing Agreement (DPA) under GDPR Article 28. AWS provides a Data Processing Addendum; you must execute it before CloudFront processes any EU resident data.
