Cloudflare Privacy Policy

This is Cloudflare's privacy policy explaining how Cloudflare — a major internet infrastructure company whose network handles a large portion of global web traffic — collects and uses your personal data when you visit their website, use their consumer products like 1.1.1.1 DNS, or when your internet traffic passes through Cloudflare's network on behalf of a business customer. The most important thing to know is that Cloudflare collects technical data including IP addresses, device identifiers, and browsing metadata both when you directly use Cloudflare products and when you use any website or app that relies on Cloudflare's infrastructure, meaning your data may be processed by Cloudflare even without a direct relationship. California residents and EU users can submit formal data access, deletion, or opt-out requests by contacting privacyquestions@cloudflare.com.

This document is Cloudflare's Privacy Policy governing the collection, use, storage, and disclosure of personal data across Cloudflare's network infrastructure, consumer-facing products, and enterprise services, with legal bases including consent, legitimate interests, and contractual necessity under applicable data protection laws including GDPR and CCPA. The policy creates obligations for Cloudflare to respond to data subject access requests, honor opt-out rights for California residents, and maintain data processing agreements with enterprise customers, while imposing on users the practical consequence that significant technical and operational data is collected as a byproduct of Cloudflare's role as a network intermediary. Notably, Cloudflare distinguishes between data it processes as a 'data controller' for its own purposes and as a 'data processor' on behalf of enterprise customers, creating a layered liability structure that limits Cloudflare's direct consumer obligations for end-user data flowing through customer-operated services. The policy engages GDPR (Articles 6, 13, 17, and 28), CCPA/CPRA (§1798.100 et seq.), and potentially COPPA given consumer product offerings; EU-US Data Privacy Framework and Standard Contractual Clauses are cited as transfer mechanisms for international data flows. Material compliance considerations include the adequacy of Cloudflare's data processor agreements with enterprise customers, the robustness of its consent mechanisms for tracking technologies, and the accuracy of its data retention disclosures given the scale and technical complexity of its infrastructure.