Cloudflare transfers your personal data to the United States and other countries, where data protection laws may offer fewer protections than in your home country, and relies on Standard Contractual Clauses for EU, UK, and Swiss users.
This analysis describes what Cloudflare's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
If you are in the EU, UK, or Switzerland, your data is transferred to the U.S. under Standard Contractual Clauses, a mechanism whose adequacy has been subject to ongoing legal scrutiny, and you may have fewer legal protections in the destination country.
Interpretive note: The adequacy of Standard Contractual Clauses as a transfer mechanism depends on complementary measures and evolving regulatory guidance following Schrems II; the document does not specify whether a Transfer Impact Assessment has been conducted.
Removed specific Data Privacy Framework certifications in favor of broader consent-based language emphasizing U.S. governance and reduced local protections, with vaguer reference to transfer mechanisms.
View full change record →EU, UK, and Swiss users' personal data is transferred to the U.S. under Standard Contractual Clauses, and while this is a recognized transfer mechanism, its adequacy depends on complementary measures and evolving regulatory developments.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Cloudflare is a U.S.-based company and the information we collect is governed by U.S. law. By accessing or using our Services or otherwise providing information to us, you consent to the processing, transfer and storage of information in and to the U.S. and other countries, where you may not have the same rights and protections as you do under local law. When we transfer the personal data of those in the EEA, UK and/or Switzerland, we rely on transfer mechanisms including the EU Standard Contractual Clauses.Excerpt from Cloudflare's Privacy Policy
REGULATORY LANDSCAPE: International data transfers from the EU engage GDPR Chapter V, specifically Articles 44 through 49.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
If you are in the EU, UK, or Switzerland, your data is transferred to the U.S. under Standard Contractual Clauses, a mechanism whose adequacy has been subject to ongoing legal scrutiny, and you may have fewer legal protections in the destination country.
EU, UK, and Swiss users' personal data is transferred to the U.S. under Standard Contractual Clauses, and while this is a recognized transfer mechanism, its adequacy depends on complementary measures and evolving regulatory developments.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cloudflare.