Cloudflare automatically collects technical data including your IP address, browser type, and pages visited whenever you use its services or visit a website powered by Cloudflare's network, even if you have no direct relationship with Cloudflare.
This analysis describes what Cloudflare's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Your IP address and browsing behavior are collected passively across a vast range of internet destinations that use Cloudflare's infrastructure, which represents a significant breadth of data collection relative to a single service provider.
Language simplified from detailed enumeration (ISP, referring/exit pages, clickstream data) to broader categories, with clearer delineation of data collection on behalf of Customers.
View full change record →Every time you visit a website using Cloudflare's network, your IP address and device information may be logged, regardless of whether you have an account with Cloudflare or are aware of its involvement.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.
"When you use our Services, we automatically receive and record information from your browser or device, which may include your IP address or device identifier, the type of browser and/or device you're using to access our Services, and the page or feature you requested. Cloudflare also collects information on behalf of our Customers about End Users of our Customers' websites and applications. This information may include log data, IP addresses, and other information regarding users of our Customers' websites.Excerpt from Cloudflare's Privacy Policy
REGULATORY LANDSCAPE: Automatic collection of IP addresses and device identifiers constitutes personal data processing under GDPR, requiring a documented legal basis.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Your IP address and browsing behavior are collected passively across a vast range of internet destinations that use Cloudflare's infrastructure, which represents a significant breadth of data collection relative to a single service provider.
Every time you visit a website using Cloudflare's network, your IP address and device information may be logged, regardless of whether you have an account with Cloudflare or are aware of its involvement.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cloudflare.