Is consent required for Cloudflare on my website?

No. Cloudflare's security cookies (__cf_bm, cf_clearance) are strictly necessary for bot protection and fraud prevention. Cloudflare Web Analytics is cookieless and sets no identifiers. Neither component requires prior user consent.

What cookies does Cloudflare set?

__cf_bm (30-min, bot management), cf_clearance (1-day, set after passing a security challenge), and _cfuvid (session, rate limiting). Turnstile and Web Analytics set no cookies. Scripts load from challenges.cloudflare.com and static.cloudflareinsights.com.

How does ConsentStack classify Cloudflare?

ConsentStack classifies Cloudflare as essential. Security cookies like __cf_bm and cf_clearance are never blocked. Cloudflare Web Analytics is classified as analytics but is cookieless, so ConsentStack can load it without a consent gate if desired.

What tracker domains does Cloudflare use?

ConsentStack has catalogued tracker domains for Cloudflare including cloudflare.com and cloudflarestream.com. These are the network destinations Cloudflare's scripts contact, which a consent platform blocks until a visitor agrees.

Cloudflare - Security, Analytics & Privacy Classification

Back to Vendor Library

Overview

Cloudflare is a global CDN, network security, and performance infrastructure provider used by millions of websites. From a browser perspective, Cloudflare manifests in several distinct ways: as the CDN delivering site assets, as Turnstile (its CAPTCHA replacement), as Cloudflare Web Analytics (a privacy-first analytics tool), and as Bot Management challenge scripts. Each of these components has different privacy and consent characteristics.

What This Script Does

Cloudflare Turnstile

Turnstile is Cloudflare's CAPTCHA alternative (challenges.cloudflare.com/turnstile/v0/api.js). It runs a series of non-interactive browser challenges to distinguish humans from bots. Turnstile does not use cookies for tracking and explicitly avoids building behavioral profiles. It collects browser signals (user-agent, execution environment, proof-of-work challenge responses) and sends them to Cloudflare for verification. The challenge result is returned as a one-time token.

Cloudflare Web Analytics

Cloudflare Web Analytics (static.cloudflareinsights.com/beacon.min.js) is a lightweight, privacy-respecting analytics script. It uses no cookies, no fingerprinting, and no cross-site tracking. It collects aggregate page view counts, Core Web Vitals metrics, and geographic breakdowns from IP-derived country data (the IP itself is not stored). Cloudflare Web Analytics is explicitly designed as a GDPR-compliant, cookieless analytics solution.

Bot Management

On sites using Cloudflare's enterprise Bot Management, a challenge script may fire to verify browser legitimacy. This uses JavaScript execution challenges and behavioral signals (timing, event patterns) to score the request.

Cookies Set

__cf_bm — First-party cookie (set under the site's own domain by Cloudflare). Bot management cookie used to identify and manage automated traffic. Duration: 30 minutes.
cf_clearance — First-party cookie. Set after a visitor passes a Cloudflare security challenge (CAPTCHA or browser check). Duration: 1 day.
_cfuvid — First-party cookie. Used by Cloudflare rate limiting to identify a visitor within a rate limit window. Duration: session.

Turnstile and Web Analytics set no persistent tracking cookies.

Domains Contacted

challenges.cloudflare.com — Turnstile challenge API and verification endpoint.
static.cloudflareinsights.com — Web Analytics beacon endpoint.
Cloudflare's CDN operates at the network layer and does not require additional JavaScript for CDN functionality.

Data Collected Per Interaction

For Turnstile: browser execution environment signals, user-agent, proof-of-work results, page URL. No persistent user identity.
For Web Analytics: page URL, country (from IP, not stored), Core Web Vitals metrics (LCP, FID, CLS), browser and OS type. No IP storage, no cookies, no cross-site tracking.
For Bot Management / __cf_bm: browser interaction timing and behavioral signals. Cookie duration is 30 minutes and is strictly functional.

Consent & Compliance

GDPR / ePrivacy: The __cf_bm and cf_clearance cookies are security and anti-abuse cookies, not tracking cookies. Security and fraud prevention cookies can qualify as strictly necessary under the ePrivacy Directive's Article 5(3) exemption. Cloudflare Web Analytics requires no consent as it collects no personal data and sets no cookies. Turnstile is designed to be a consent-free CAPTCHA replacement and explicitly avoids tracking. Most EU DPA guidance supports treating bot management and security cookies as strictly necessary.

CCPA / CPRA: Cloudflare processes data as a service provider under its customer agreement. Security and performance data processing is not a sale of personal information. Cloudflare is certified under the EU-US DPF and maintains comprehensive SCCs.

EU-US Data Privacy Framework: Cloudflare is certified under the EU-US DPF for EU-to-US personal data transfers.

Consent Category: Essential (security and CDN) / Analytics (Web Analytics — cookieless, no consent required).

Should You Block This Without Consent?

No. Cloudflare's security cookies (__cf_bm, cf_clearance) are strictly necessary for protecting the website from bot attacks and fraud. They do not track users across sites or build behavioral profiles. Cloudflare Web Analytics is cookieless and privacy-preserving by design. None of Cloudflare's standard components require prior user consent under GDPR, ePrivacy, or CCPA frameworks.

Is Cloudflare GDPR compliant?

Cloudflare typically loads analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Cloudflare can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Cloudflare, not on Cloudflare itself.

Visit website

Products (3)

Cloudflare Web Analytics

Cloudflare Web Analytics is a privacy-focused web analytics service. Scripts track page views and Core Web Vitals performance metrics without setting cookies or collecting personally identifiable information. Data is aggregated at the edge and does not build individual visitor profiles.

Cloudflare Turnstile

Cloudflare Turnstile is a CAPTCHA alternative for bot detection and spam prevention. Scripts analyze browser behavioral signals, attributes, and interaction patterns to verify human visitors without requiring visual puzzle-solving challenges. Sets minimal functional tokens; does not build visitor profiles.

Cloudflare Zaraz

Cloudflare Zaraz is a third-party script manager that runs marketing and analytics tags server-side through Cloudflare's edge network. Scripts are proxied rather than loaded directly from third-party domains, reducing client-side tracking exposure and improving page load performance.

Consent Categories

Essential Analytics

Also Known As

Cloudflare Turnstilecf_clearance cookieCloudflare Web AnalyticsCloudflare bot managementCloudflare CAPTCHACloudflare WAF scriptTurnstile widget

Industries

Computer SecurityComputers Electronics and Technology

Tracked Domains (2)

Cloudflare's trackers are very common, seen on about 19% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

cloudflare.comAnalytics

cloudflare.com is an analytics domain operated by Cloudflare, used to measure visits, sessions, and on-site behavior. Seen on about 19% of scanned sites.

cloudflarestream.comEssential

cloudflarestream.com is an essential domain operated by Cloudflare, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

Cookies Cloudflare Sets (8)

__cf_bm

Cloudflare bot-management cookie set on the customer apex when a request transits Cloudflare. 30-minute expiration; required for bot scoring.

cf_clearance

Cloudflare cookie indicating the visitor has passed a managed challenge (CAPTCHA / Turnstile). 30-minute expiration.

__cflb

Cloudflare Load Balancer session-affinity cookie pinning the visitor to a backend pool.

__cfruid

Cloudflare legacy rate-limiting identifier. Set by the edge proxy when the site uses the older Rate Limiting product, to track per-visitor request counts within a rolling window.

_cfuvid

Cloudflare Rate Limiting Rules visitor identifier. Set when the site has explicitly configured rate-limit rules that need to distinguish individual users sharing a single NAT IP address.

cf_use_ob

Cloudflare Always Online routing instruction cookie. Tells the edge to fetch the resource from the Always Online cache rather than the live origin. Expires after 30 seconds.

__cf_waitingroom

Cloudflare Waiting Room cookie tracking the visitor's position in a queue during peak traffic.

cf_ob_info

Cloudflare Always Online metadata cookie. Records HTTP status, originating data center, and Ray ID when the edge served a cached copy because the origin was unreachable. Expires after 30 seconds.