Cloudflare shares your personal data with third-party service providers for functions like billing and marketing, and may also transfer your data as part of a business sale, merger, or acquisition.
This analysis describes what Cloudflare's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
A merger or acquisition could result in your personal data being transferred to a new corporate entity with different privacy practices, and you may not be notified before the transfer occurs.
Removed contractual restrictions on third-party use and protection requirements, and added new category of disclosure for corporate transactions (M&A, asset sales, etc.).
View full change record →Your personal data could be transferred to a new company if Cloudflare is acquired or merged, potentially under different privacy terms, which is a standard but material risk in any platform relationship.
How other platforms handle this
Protect us, our business, our users, and others, for example to enforce our terms of service, prevent spam or other unwanted communications, and investigate or protect against fraud
we may use, retain or share information with law enforcement or others in circumstances where a person's vital interests require protection, such as in the case of emergencies.
Third-party apps use data from Gemini consistent with their own privacy policies and terms.
"Cloudflare may share your information with third-party vendors and other service providers that perform services on our behalf, such as billing, marketing, and analytics. We may also disclose your information in connection with, or during negotiations concerning, a corporate merger, consolidation, the sale of substantially all of our stock or assets, financing, acquisition, divestiture or dissolution of all or a portion of our business.Excerpt from Cloudflare's Privacy Policy
REGULATORY LANDSCAPE: GDPR requires that data transfers in corporate transactions maintain lawful basis and that users be informed of changes to data controller identity.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
A merger or acquisition could result in your personal data being transferred to a new corporate entity with different privacy practices, and you may not be notified before the transfer occurs.
Your personal data could be transferred to a new company if Cloudflare is acquired or merged, potentially under different privacy terms, which is a standard but material risk in any platform relationship.
ConductAtlas has identified this type of provision across 287 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cloudflare.