Essential vendor · Cloudflare, Inc.
Cloudflare Cookies: List With Purpose and Retention
Last verified 2026-10-16 · Updated 2026-10-16
On this page
Cookies Cloudflare Sets on Your Site
Cloudflare sets up to 9 cookies on sites that run its bot, load balancing, and rate limiting products, led by __cf_bm, and Cloudflare describes all of them as strictly necessary.
| Name | Type | Category | Party | Retention | What it does |
|---|---|---|---|---|---|
__cf_bm | Cookie | Essential | First-party | 30 minutes (1800 seconds) | The __cf_bm cookie is a Cloudflare bot protection cookie that lasts 30 minutes and needs no consent as a strictly necessary cookie. |
__cflb | Cookie | Essential | First-party | Session | The __cflb cookie keeps the visitor on the same origin server behind a Cloudflare load balancer, from several seconds up to 24 hours. |
__cfruid | Cookie | Essential | First-party | Session | The __cfruid cookie supports Cloudflare rate limiting and lasts for the browser session. |
__cfwaitingroom | Cookie | Essential | First-party | Not documented | The __cfwaitingroom cookie keeps the place of the visitor in a Cloudflare waiting room during a traffic peak. |
_cfuvid | Cookie | Essential | First-party | Session | The _cfuvid cookie lets a Cloudflare rate limiting rule count requests per visitor, and Cloudflare sets it only for sites that use that option. |
_cfuvid | Cookie | Essential | Third-party | Session | The _cfuvid cookie on .hubspot.com comes from HubSpot running on Cloudflare, for rate limiting of the HubSpot API endpoints. |
cf_clearance | Cookie | Essential | First-party | Not documented | The cf_clearance cookie remembers that the visitor passed a Cloudflare challenge, and Cloudflare sets it with SameSite=None, Secure, and Partitioned. |
cf_ob_info | Cookie | Essential | First-party | 30 seconds | The cf_ob_info and cf_use_ob cookies support Cloudflare Always Online and expire after 30 seconds. |
Scripts, Pixels, and Endpoints Cloudflare Loads
Cloudflare loads 3 known scripts, pixels, and data endpoints. Each row gives the host to look for in the Network tab of Chrome DevTools or in a cookie scanner report.
| Type | Resource | Host | What it does |
|---|---|---|---|
| Script | Cloudflare Turnstile (api.js) | challenges.cloudflare.com | The Turnstile script shows the Cloudflare challenge widget that protects a form from bots. |
| Script | Cloudflare Web Analytics beacon (beacon.min.js) | static.cloudflareinsights.com | The Web Analytics beacon measures page views and page speed for the Cloudflare Web Analytics dashboard. |
| Data endpoint | Cloudflare Web Analytics endpoint (cdn-cgi/rum) | cloudflareinsights.com | The Web Analytics endpoint receives the page view and timing data from the beacon. |
Does Cloudflare Need Consent?
No, the Cloudflare cookies need no consent in the EU and the UK, and need no prior opt-in in California. The table gives the rule for each law, taken from the page of the __cf_bm cookie.
| Law | Consent before the cookies are set | Opt-out right | Source |
|---|---|---|---|
| EU ePrivacy Directive + GDPR | Not required | None | Article 5(3), ePrivacy Directive |
| UK PECR | Not required | None | Regulation 6 and Schedule A1, PECR |
| California CCPA | No general opt-in | None while the vendor acts as a service provider | Cal. Civ. Code 1798.120 |
The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up Cloudflare, such as the Cloudflare bot products.
Read the reason for each answer in the consent rules for the __cf_bm cookie.
How to Add Cloudflare to a Consent Banner
Cloudflare sets strictly necessary cookies, so your consent banner names the cookies and lets Cloudflare run for every visitor. List the cookies in your Cookies Policy, so visitors know what Cloudflare stores.
Add Cloudflare to TermsFeed Free Cookie Consent
Cloudflare sets the __cf_bm cookie in an HTTP response header, so TermsFeed Free Cookie Consent has no code to hold back. List the cookie in your Cookies Policy as a strictly necessary cookie.
Cookie Consent is free and needs no account. Build your free consent banner with TermsFeed Free Cookie Consent.
Add Cloudflare to TermsFeed Privacy Consent
Add Cloudflare to the Essential vendor category of TermsFeed Privacy Consent only to name the cookie in the Preferences Center. Essential vendors run for every visitor without consent, and visitors get no switch to turn them off.
Privacy Consent detects the location of each visitor and records every answer in a consent log. Set up Cloudflare as a custom vendor with TermsFeed Privacy Consent.
Follow every step, the vendor settings, and the check in Chrome DevTools in how to handle the __cf_bm cookie.
Who Runs Cloudflare
Cloudflare, Inc. runs Cloudflare from the United States. Cloudflare sits in front of your web server as a reverse proxy, so its cookies reach the visitor in the HTTP responses of your own domain.
Read how Cloudflare, Inc. handles the data in the Cloudflare privacy policy, and sign the Cloudflare Customer Data Processing Addendum before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.
Cloudflare Cookie FAQs
Does Cloudflare need consent?
No, the Cloudflare cookies need no consent in the EU and the UK, and need no prior opt-in in California. Firstly, the ePrivacy Directive exempts the strictly necessary cookies of Cloudflare from consent while the cookies stay strictly necessary. Secondly, the UK PECR exempts the strictly necessary cookies of Cloudflare from consent while the cookies stay strictly necessary. Thirdly, the CCPA sets no general opt-in requirement for the strictly necessary cookies of Cloudflare, and the table gives the opt-out right of visitors. The consent section of this page gives the table for each law.
How long do Cloudflare cookies last?
The cookies of Cloudflare with a documented lifetime last up to 30 minutes (1800 seconds), and 4 cookies last for the browser session. A session cookie such as __cflb has no expiry date, and the __cf_bm cookie lasts longest. 2 cookies have no documented lifetime. Check their expiry in Chrome DevTools on your own site. The retention column of the cookie list gives the lifetime of each cookie.
How do I handle Cloudflare cookies in a consent banner?
List the Cloudflare cookies in your Cookies Policy as strictly necessary cookies, because Cloudflare sets them for every visitor. Cloudflare sets the cookies in HTTP response headers, so no script on your page needs a tag in TermsFeed Free Cookie Consent. The page of the __cf_bm cookie gives the steps and the checks.
Sources for the Cloudflare Cookies
The facts on this page come from the documentation Cloudflare publishes, checked on 2026-10-16. The list gives every source, so you check each fact yourself.
- Cloudflare Docs, Cloudflare cookies
- HubSpot Knowledge Base, Cookies set in a visitor's browser by HubSpot
- TermsFeed website auditor scan, 9 October 2026 (internal)
- Cloudflare privacy policy
- Cloudflare Customer Data Processing Addendum