Cloudflare plays two different privacy roles: it controls your data when you are its direct customer, but when you visit another website that uses Cloudflare's network, Cloudflare only processes your data on behalf of that website's operator, who is responsible for informing you about how your data is used.
This analysis describes what Cloudflare's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This distinction means that if you want to exercise privacy rights regarding data processed on behalf of a third-party website, you may need to contact that website's operator rather than Cloudflare directly, which can make it harder to know where to direct requests.
Definition expanded from generic contractual language to explicitly enumerate End User categories and clarify the direct contract requirement for Customers.
View full change record →If your data is processed because you visited a third-party site using Cloudflare's infrastructure, Cloudflare's policy may not be the right place to seek data access or deletion; you may need to contact the operator of the site you visited instead.
How other platforms handle this
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
"In this Privacy Policy, we use the term "Customer" to refer to individuals and organizations that directly contract with us for the purpose of using our products and services. We use the term "End Users" to refer to those individuals who (1) access or use our Customers' domains, networks, websites, application programming interfaces, and applications, or (2) Cloudflare's products and services are directed toward. Unlike Customers who directly interact with Cloudflare, End Users typically interact with our Customers' Internet properties that use our Services. In connection with providing our Services, Cloudflare may process End Users' data on behalf of Customers. In that case, Cloudflare is a data processor and the Customer is the data controller.Excerpt from Cloudflare's Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 4(7) and 4(8), which define controller and processor, and Article 28, which requires a Data Processing Agreement between controllers and processors.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This distinction means that if you want to exercise privacy rights regarding data processed on behalf of a third-party website, you may need to contact that website's operator rather than Cloudflare directly, which can make it harder to know where to direct requests.
If your data is processed because you visited a third-party site using Cloudflare's infrastructure, Cloudflare's policy may not be the right place to seek data access or deletion; you may need to contact the operator of the site you visited instead.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cloudflare.