In reply to ruth weizenbaum.

GDPR requires information to and consent of user before any request to CDN.

Most CDN providers seem to disagree with your approach today: you can check CloudFlare or KeyCDN's documentation about this for example. Those companies offer Data Processing Agreements to help you as a site owner remain compliant.

Automattic also offers Data Processing Agreements; you can request one by following the instructions here.

It's also worth noting that WordPress itself loads data from a CDN by default. This would make 30% of the web non-compliant with the GDPR if your statement above were true. This is discussed here:
https://core.trac.wordpress.org/ticket/44001

The ticket is still open. Don't hesitate to chime in with your remarks if you'd like.

Most Jetpack functions void GDPR, using Jetpack in EU is high legal risk.

Jetpack was updated before the GDPR came into effect, and a few things were added to allow you to keep using the plugin and make sure your site remains compliant with the GDPR. You can read more about this here. Note that just like with every other plugin, there is no simple turn-key solution: you do need to take action on your site (like updating your privacy policy) when installing additional plugins that can deal with personal information on your site.
You can also check Jetpack Privacy Center to learn more about all this and find links to the documents you may need.