I hope it applies to CDN's, I suspect data collection is the very reason they exist and that many are already collecting data, but even it tech circles it flies under the radar. On top of this there's potential issues with any third party and we'll need stronger guarantees from cloud hosts, data centers and the like.

CDN's are especially nefarious when it comes to privacy because they make it so hard to block third party content while retaining functionality.

Technically there isn't any difference. It's a request to a server. You send over your IP (defined as personal data) to a third party server.

But for data collection there is a big difference given that FB knows who you are, you are probably already logged in, and log/use that data. Do CDNs such as Cloudflare, Google Fonts etc log and analyse usage behaviour?

Regardless, I agree, it will be very interesting to see what will happen when all these external services are dragged into GDPR cases. Lots of sites includes fonts, chat widgets, buttons and other stuff that track behaviour without being consented by the user and left out of their privacy policies.