FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Hosting

Cloudflare Workers

UnclassifiedOfficial website

Cloudflare Workers is a serverless platform that runs custom JavaScript and WebAssembly code at the edge of Cloudflare's global network, close to end users.

Block Cloudflare Workers until consentScan my site
Overview

What does Cloudflare Workers do?

What is Cloudflare Workers?

Cloudflare Workers is a serverless compute platform that runs custom JavaScript, TypeScript and WebAssembly code on the Cloudflare edge network. Workers can transform requests and responses, build APIs and full applications, and integrate with other Cloudflare products like KV, D1 and R2.

How does Cloudflare Workers process personal data?

The platform itself processes IP addresses, request headers and URLs to route traffic to the nearest POP. Cloudflare may set its own operational cookies such as __cf_bm for bot management and cf_clearance for challenge results. Any additional data processing depends on the code deployed by the operator of the Worker.

Is consent required?

Cloudflare classifies __cf_bm and cf_clearance as strictly necessary for security and bot mitigation, so they do not require consent under Article 5(3) of the ePrivacy Directive. Consent is required for any custom cookie that the Worker code sets for non strictly necessary purposes.

International data transfers

Workers run on the closest Cloudflare POP, including in the EU. However, Cloudflare is a US headquartered company, and control plane data, account information and certain logs are processed in the United States. Transfers are governed by Standard Contractual Clauses and the EU US Data Privacy Framework. The Cloudflare Data Localisation Suite can restrict data residency.

Compliance recommendations

Sign the Cloudflare Data Processing Addendum, document Workers in your record of processing activities, consider the Data Localisation Suite for EU only routing, and ensure that any cookie or storage operation performed by your Worker code respects consent obligations.

Compliance

Cloudflare Workers and the GDPR

Legal basis
legitimate_interest
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive

Impact assessment (DPIA)

A DPIA is generally not required for Cloudflare Workers as infrastructure, but the use case must be assessed. A DPIA is recommended when Workers process sensitive data, build profiling features or call third country services.

Sample text for your banner

We use Cloudflare Workers to run code at the edge for performance and security. Cloudflare may set strictly necessary security cookies and process technical data including your IP address.
Cookies and trackers

What Cloudflare Workers sets and contacts

Tracking method
serverless_edge_compute_operational_cookies
Server location
Cloudflare global edge network (US, EU, Asia, LATAM)
Cookieless mode available
Yes
Data transferred outside the EU
Cloudflare is a US headquartered controller with edge POPs worldwide. Although requests are served locally, control plane data and account level logs are processed in the United States. Transfers rely on Standard Contractual Clauses and the EU US Data Privacy Framework.

Cookies set (5)

NameTypeDurationPurpose
__cf_bmnecessary30 minutesCloudflare bot management cookie that distinguishes humans from automated traffic to protect the website.
cf_clearancenecessary30 daysConfirms that the visitor has successfully passed a Cloudflare security challenge.
__cflbnecessary1 dayCloudflare load balancer cookie used to provide session affinity to the appropriate origin server.
__cfwaitingroomnecessarysessionCloudflare Waiting Room cookie used to manage queueing of users during traffic spikes.
__cfruidnecessarysessionCloudflare rate limiting cookie used to identify trusted web traffic.

Third-party domains contacted (4)

  • cloudflare.com
  • workers.dev
  • cloudflareinsights.com
  • challenges.cloudflare.com
Questions

Frequently asked questions about Cloudflare Workers

Can't find your question? Write to us, we answer fast.

What cookies does Cloudflare Workers set?

Cloudflare itself may set __cf_bm to differentiate humans from bots and cf_clearance to remember the result of a security challenge. The Worker code deployed by the operator can also set arbitrary cookies, which must each be classified depending on their purpose.

Is consent required before running a Worker?

Workers as edge compute do not require consent for strictly necessary security cookies such as __cf_bm and cf_clearance. Consent is required for any custom cookie or local storage operation set by the Worker code for analytics, personalisation or marketing purposes.

What is the legal basis for Cloudflare Workers?

The legal basis is legitimate interest under Article 6(1)(f) of the GDPR for the security, performance and delivery of the website. For features that require consent under the ePrivacy Directive, the legal basis is the user's explicit consent.

Does Cloudflare Workers transfer data outside the EU?

Yes. Although Workers execute on the closest POP, including in the EU, Cloudflare's control plane, account information and some logs are processed in the United States. Transfers are governed by Standard Contractual Clauses and the EU US Data Privacy Framework.

Is a DPIA required for Cloudflare Workers?

A standalone DPIA is generally not required for Workers used as plain infrastructure. A DPIA is recommended when Workers process sensitive data, build profiling features, call third country services or implement automated decision making.

How do I implement Workers compliantly?

Sign the Cloudflare DPA, enable the Data Localisation Suite for EU only routing where required, audit the cookies and storage operations performed by your Worker code, log only what you need, hash identifiers and respect consent signals received from the CMP.

Are there privacy friendly alternatives?

Alternatives include EU based edge platforms like Scaleway Edge Services, Clever Cloud, Fastly Compute@Edge in EU regions, OVHcloud and self hosted Node or Rust services. The choice depends on geographic coverage and the level of data residency you need.

How should I update my cookie policy to mention Cloudflare Workers?

Mention Cloudflare as a processor for hosting, performance and security. Describe the __cf_bm and cf_clearance cookies as strictly necessary, disclose potential transfers to the United States, list your own application cookies separately and provide a clear opt out path for non strictly necessary processing.

Same category

More services: Hosting

See the whole category

mini_httpd

mini_httpd is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. mini_httpd integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, mini_httpd helps organizations maintain robust websites that meet user expectations and technical requirements.

Hosting

EasyEngine

EasyEngine is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. EasyEngine offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, EasyEngine empowers organizations to optimize strategy and maximize return on investment.

Hosting

VirtFusion

VirtFusion is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. VirtFusion supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, VirtFusion ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Hosting

libwww-perl-daemon

libwww-perl-daemon is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. libwww-perl-daemon supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, libwww-perl-daemon ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Hosting

actionhero.js

actionhero.js is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. actionhero.js integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, actionhero.js helps organizations maintain robust websites that meet user expectations and technical requirements.

Hosting

MiniServ

MiniServ is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. MiniServ integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, MiniServ helps organizations maintain robust websites that meet user expectations and technical requirements.

Hosting

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site