Cloudflare separates itself into two roles: when you use Cloudflare's own products directly, Cloudflare is responsible for your data; but when a website you visit uses Cloudflare behind the scenes, that website's owner is responsible, not Cloudflare.
If your data is processed by Cloudflare on behalf of a business you use, that business — not Cloudflare — is legally responsible for it, meaning Cloudflare will redirect your privacy requests to them and may not act on your behalf directly.
Cross-platform context
See how other platforms handle Controller vs Processor Distinction and similar clauses.
Compare across platforms →This distinction determines who you must contact to exercise your privacy rights — for most internet traffic passing through Cloudflare, you must go to the website owner, not Cloudflare directly, which can make it harder to exercise rights.
REGULATORY FRAMEWORK: This provision directly implicates GDPR Art. 4(7) (controller definition), Art. 4(8) (processor definition), Art. 28 (processor obligations including written DPA requirements), and Art. 82 (joint liability). Under CCPA, the analogous distinction between 'business' and 'service provider' is governed by §1798.140(ag) and §1798.100. The ICO and EU supervisory authorities, including the Irish DPC, hold enforcement authority over these classifications.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.