[fariszr]

In this case it's not enough just to be GDPR compliant, the website admin has to have Data processing agreement with the CDN, which you won't get from a free CDN such as JSdelivr.

That's my understanding.