cloudflare.com

Cloudflare Cookie Policy: Key Terms and Risks

1. Data Collection and Use

Cloudflare uses cookies, tracking pixels, and similar technologies on its own websites and, in some cases, on websites using Cloudflare services.

Information potentially collected

Depending on the cookie category and service, Cloudflare may collect:

• Online identifiers and cookie identifiers
• Device, browser, and operating-system information
• IP address and security-related signals
• Website activity, such as pages visited, time spent, page-load speeds, and navigation
• Language and other preferences
• CAPTCHA, bot-detection, and traffic-related information
• Email engagement data, including whether messages were opened or links clicked
• Advertising and browsing activity used to measure or target advertisements

Purposes

Cloudflare states that it uses cookies to:

• Provide core website and service functionality
• Detect bots, fraud, and malicious activity
• Secure accounts and websites
• Balance network traffic
• Remember settings and preferences
• Analyze website performance and improve design
• Measure marketing and advertising effectiveness
• Deliver interest-based advertising for Cloudflare products and services

Cloudflare may place certain security cookies—including _cf_bm, cf_clearance, and _cflb—on visitors’ devices when visiting Cloudflare’s websites or customers’ websites.

2. Cookie Categories and User Choices

• Strictly Necessary: Required for security and core functionality. Cannot be disabled through Cloudflare’s preference controls.
• Functional: Remember choices such as language and personalization. Opting out may cause features to malfunction.
• Performance: Collect aggregated usage and technical statistics. Users may opt out.
• Targeting: Usually placed by advertising partners to track activity and deliver relevant ads. Users may opt out.

Users can manage available preferences through the “Cookie Preferences” link—or “Your Privacy Choices” in the United States. Browser settings can also delete or block cookies.

Practical risk: Disabling cookies may reset sessions, disable automatic login, and reduce website or service functionality. Blocking HTML images in email can reduce tracking pixels but may also prevent normal images from displaying.

3. Third-Party Sharing

Cloudflare may use third-party providers and advertising platforms to:

• Support marketing and analytics
• Place targeting cookies
• Measure advertising performance
• Deliver interest-based advertisements

The policy says Cloudflare does not sell personal information “in the conventional sense” and does not sell, rent, or share information for direct-marketing purposes as described under California’s Shine the Light law.

However, it expressly acknowledges that making identifiers or browsing activity available to advertising partners may qualify as a “sale” or “sharing” under the California Consumer Privacy Act (CCPA), even if no money is directly exchanged.

Cloudflare’s Zaraz product can load third-party tools through Cloudflare’s network rather than directly in the browser. Nevertheless, third-party cookies may still be placed, subject to consent.

4. AI/ML Training

This Cookie Policy does not state whether cookie data or personal information is used to train artificial-intelligence or machine-learning models. It also does not provide an opt-out or describe AI-related data practices.

Users would need to review Cloudflare’s Privacy Policy, product-specific terms, or AI-related documentation for an answer. The absence of a statement here should not be interpreted as either permission or a prohibition.

5. User Rights and Obligations

The policy provides cookie controls, including the ability to:

• Opt out of Functional, Performance, and Targeting cookies where available
• Use browser controls to delete or block cookies
• Opt out of interest-based advertising through linked industry or regional tools

It does not comprehensively describe rights to access, correct, delete, restrict, or obtain a copy of personal information. Those rights are likely addressed in the Privacy Policy and may depend on location.

Users should understand that:

• Strictly Necessary cookies cannot be turned off through the site preference tool.
• Opting out may impair functionality.
• Email tracking pixels may require disabling HTML images in the email client.
• Cookie choices may need to be managed separately across browsers, devices, or websites.

6. Liability and Disputes

This document contains no meaningful liability disclaimer, indemnity provision, governing-law clause, arbitration requirement, or dispute-resolution procedure. It is a cookie policy, not a complete service contract.

Potential limitations or dispute procedures would likely appear in Cloudflare’s Terms of Use, customer agreement, or Privacy Policy. The policy’s statements that cookies improve security and reduce malicious traffic should not be read as a guarantee that security threats will be prevented.

7. Changes

The provided text does not explain:

• How policy changes will be announced
• Whether users receive email notice
• Whether continued website use constitutes acceptance
• When changes become effective

Users should check the policy and Cloudflare’s privacy notices periodically. The document’s footer links to Cookie Preferences, Privacy Policy, and Terms of Use, which may contain additional procedures and obligations.

Cloudflare Self-Serve Subscription Agreement: Key User Implications

> Scope note: This agreement must be read with Cloudflare’s Privacy Policy, Data Processing Addendum (DPA), Service-Specific Terms, Cookie Policy, and—where relevant—the Domain Registration Agreement. The subscription agreement itself does not provide a complete description of all personal data collected.

1. Data Collection & Usage

Customer Content

You and your end users retain ownership of data transmitted to or through Cloudflare, including content, code, video, images, and other materials. However, you grant Cloudflare a worldwide, royalty-free, sublicensable license to:

• Collect, use, copy, store, transmit, modify, and create derivative works of Customer Content;
• Do so as necessary to provide the Services.

Cloudflare may also modify or inspect traffic and infrastructure for security, performance, and analytics. Depending on enabled features, it may:

• Block or challenge suspected threats;
• Add cookies to your domain;
• Add performance-tracking scripts;
• Add firewall rules;
• Scan infrastructure and configurations;
• Make other changes intended to improve security, performance, or analytics.

Cloudflare says it will make material modifications clear and, where possible, provide an option to disable them.

Network Data

Cloudflare owns “Network Data”—models, observations, reports, analyses, statistics, databases, and other information derived from server, network, or traffic data generated while providing the Services. It may use Network Data to provide, maintain, develop, and improve its Services. Network Data may include Personal Data, which Cloudflare says it will handle under applicable data-protection laws.

2. User Rights

• You retain rights in Customer Content as provided to Cloudflare.
• If your content includes regulated personal data, Cloudflare acts as a processor or sub-processor under the DPA.
• The agreement does not itself list detailed access, deletion, correction, portability, objection, or opt-out rights. Those rights depend on applicable law and the Privacy Policy/DPA.
• You remain responsible for obtaining all required consents, permissions, and legal rights to transmit personal data.
• You may terminate your account through the dashboard, but subscription fees generally remain payable through the current term.

3. Third-Party Sharing and Access

Cloudflare may use subprocessors and third-party service providers, particularly for operating and securing the Services. The agreement permits Cloudflare to sublicense its Customer Content license as necessary to provide the Services.

You may also authorize third-party apps, integrations, or providers to access your account through OAuth, API tokens, or other credentials. Those providers control their own data practices and terms. Cloudflare disclaims responsibility for their security, availability, performance, or resulting harm.

Anyone with your credentials may obtain, alter, or delete account data and settings. You bear the risk of granting such access.

4. AI/ML Training

The agreement does not expressly say that Customer Content is used to train general-purpose AI models. However, Cloudflare may use Network Data—including derived models, analyses, and statistics—to develop and improve its Services. The agreement also grants rights to modify and create derivative works of Customer Content when necessary to provide the Services.

Users should therefore review the Privacy Policy, DPA, and applicable Service-Specific Terms for any product-specific AI or training provisions. Do not assume that all data is excluded from model development merely because direct AI training is not mentioned here.

5. Key Obligations and Restrictions

You must:

• Keep usernames, passwords, API tokens, and other credentials secure;
• Promptly report suspected unauthorized access;
• Pay recurring or usage-based charges and keep payment information current;
• Comply with applicable laws, sanctions, export controls, and anti-corruption rules;
• Ensure Customer Content is lawful and does not infringe third-party rights;
• Avoid unlawful content, malware, phishing, spam, and technical abuse.

You generally may not resell or transfer access, circumvent quotas, disrupt the network, reverse engineer the Services, scrape or mine data, use free services to process credit-card information, store protected health information without written consent, or use the Services as a VPN/proxy service.

Subscriptions automatically renew for an equivalent term at then-current rates unless cancelled before the next billing date. Fees are generally nonrefundable, including for unused time.

6. Liability and Disputes

The Services are provided “as is” and “as available.” Cloudflare disclaims warranties and does not guarantee uninterrupted operation, accuracy, or security.

Cloudflare generally excludes liability for indirect, consequential, special, incidental, and punitive damages. Its total liability is capped at the amount paid for the Services during the preceding 12 months, subject to rights that cannot legally be limited.

You must indemnify Cloudflare for claims arising from your use, unlawful conduct, breach of the agreement, or violation of third-party rights.

Most disputes must be resolved through binding AAA arbitration, not a jury trial or class action. Individual small-claims actions, certain agency actions, injunctive relief, and intellectual-property claims are exceptions. California law applies; court proceedings that are permitted generally use San Francisco County courts.

7. Changes and Service Discontinuation

Cloudflare may change the agreement, prices, or Services. It will use reasonable efforts—including email—to notify users of material agreement changes. Changes generally take effect at the beginning of the next Subscription Term. If you disagree, your stated remedy is to stop renewing.

Prices require at least 30 days’ notice. Cloudflare may suspend, terminate, modify, or discontinue Services, sometimes without notice and generally without liability. Electronic notices satisfy legal communication requirements, so users should keep account email addresses current.