Is Cloudflare Web Analytics GDPR compliant?

What does Cloudflare Web Analytics do?

Cookieless traffic measurement. It stores nothing on the device, so the storage rule does not bite, though the request still reaches a US provider and belongs in your privacy policy.

Does Cloudflare Web Analytics need consent?

No consent is needed for Cloudflare Web Analytics on its own, because it does not store or read anything on the device beyond what is strictly necessary. That is not a free pass: it must still be named in your privacy policy, and the request itself still reveals the visitor's IP address to the provider.

GDPR Art. 13(1)(e)

Does Cloudflare Web Analytics send data outside the EEA?

Yes. Cloudflare Web Analytics processes data outside the European Economic Area, so you need a transfer mechanism under Chapter V and you have to say so in your privacy policy. In practice this means standard contractual clauses, or a provider certified under the EU-US Data Privacy Framework.

GDPR Art. 44 · GDPR Art. 46

What can I use instead of Cloudflare Web Analytics?

How do we detect Cloudflare Web Analytics?

We load your page in a real browser as a first-time visitor who clicks nothing, then look at what it contacted. Cloudflare Web Analytics is recognised by requests to cloudflareinsights.com, and we report whether it merely loaded or actually sent data, and whether it set a cookie before any choice was made.