Cloudflare

Overview

Cloudflare is a global CDN, network security, and performance infrastructure provider used by millions of websites. From a browser perspective, Cloudflare manifests in several distinct ways: as the CDN delivering site assets, as Turnstile (its CAPTCHA replacement), as Cloudflare Web Analytics (a privacy-first analytics tool), and as Bot Management challenge scripts. Each of these components has different privacy and consent characteristics.

What This Script Does

Cloudflare Turnstile

Turnstile is Cloudflare's CAPTCHA alternative (challenges.cloudflare.com/turnstile/v0/api.js). It runs a series of non-interactive browser challenges to distinguish humans from bots. Turnstile does not use cookies for tracking and explicitly avoids building behavioral profiles. It collects browser signals (user-agent, execution environment, proof-of-work challenge responses) and sends them to Cloudflare for verification. The challenge result is returned as a one-time token.

Cloudflare Web Analytics

Cloudflare Web Analytics (static.cloudflareinsights.com/beacon.min.js) is a lightweight, privacy-respecting analytics script. It uses no cookies, no fingerprinting, and no cross-site tracking. It collects aggregate page view counts, Core Web Vitals metrics, and geographic breakdowns from IP-derived country data (the IP itself is not stored). Cloudflare Web Analytics is explicitly designed as a GDPR-compliant, cookieless analytics solution.

Bot Management

On sites using Cloudflare's enterprise Bot Management, a challenge script may fire to verify browser legitimacy. This uses JavaScript execution challenges and behavioral signals (timing, event patterns) to score the request.

Cookies Set

• __cf_bm — First-party cookie (set under the site's own domain by Cloudflare). Bot management cookie used to identify and manage automated traffic. Duration: 30 minutes.
• cf_clearance — First-party cookie. Set after a visitor passes a Cloudflare security challenge (CAPTCHA or browser check). Duration: 1 day.
• _cfuvid — First-party cookie. Used by Cloudflare rate limiting to identify a visitor within a rate limit window. Duration: session.

Turnstile and Web Analytics set no persistent tracking cookies.

Domains Contacted

• challenges.cloudflare.com — Turnstile challenge API and verification endpoint.
• static.cloudflareinsights.com — Web Analytics beacon endpoint.
• Cloudflare's CDN operates at the network layer and does not require additional JavaScript for CDN functionality.

Data Collected Per Interaction

• For Turnstile: browser execution environment signals, user-agent, proof-of-work results, page URL. No persistent user identity.
• For Web Analytics: page URL, country (from IP, not stored), Core Web Vitals metrics (LCP, FID, CLS), browser and OS type. No IP storage, no cookies, no cross-site tracking.
• For Bot Management / __cf_bm: browser interaction timing and behavioral signals. Cookie duration is 30 minutes and is strictly functional.

Consent & Compliance

GDPR / ePrivacy: The __cf_bm and cf_clearance cookies are security and anti-abuse cookies, not tracking cookies. Security and fraud prevention cookies can qualify as strictly necessary under the ePrivacy Directive's Article 5(3) exemption. Cloudflare Web Analytics requires no consent as it collects no personal data and sets no cookies. Turnstile is designed to be a consent-free CAPTCHA replacement and explicitly avoids tracking. Most EU DPA guidance supports treating bot management and security cookies as strictly necessary.

CCPA / CPRA: Cloudflare processes data as a service provider under its customer agreement. Security and performance data processing is not a sale of personal information. Cloudflare is certified under the EU-US DPF and maintains comprehensive SCCs.

EU-US Data Privacy Framework: Cloudflare is certified under the EU-US DPF for EU-to-US personal data transfers.

Consent Category: Essential (security and CDN) / Analytics (Web Analytics — cookieless, no consent required).

Should You Block This Without Consent?

No. Cloudflare's security cookies (__cf_bm, cf_clearance) are strictly necessary for protecting the website from bot attacks and fraud. They do not track users across sites or build behavioral profiles. Cloudflare Web Analytics is cookieless and privacy-preserving by design. None of Cloudflare's standard components require prior user consent under GDPR, ePrivacy, or CCPA frameworks.