> Cloudflare Workers serverless edge: operational cookies, consent expectations and EU US data transfer safeguards.
>
> Canonical: https://www.flowconsent.com/en/services/hosting/cloudflare-workers

Hosting

# Cloudflare Workers

Unclassified · [Official website](https://workers.cloudflare.com)

Cloudflare Workers is a serverless platform that runs custom JavaScript and WebAssembly code at the edge of Cloudflare's global network, close to end users.

[Block Cloudflare Workers until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=hosting) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [Hosting](https://www.flowconsent.com/en/services/hosting)

- Consent

  Unclassified

- Prior consent

  Not required

- Documented cookies

  5

- Third-party domains

  4

- Servers

  Cloudflare global edge network (US, EU, Asia, LATAM)

Overview

## What does Cloudflare Workers do?

## **What is Cloudflare Workers?**

Cloudflare Workers is a serverless compute platform that runs custom JavaScript, TypeScript and WebAssembly code on the Cloudflare edge network. Workers can transform requests and responses, build APIs and full applications, and integrate with other Cloudflare products like KV, D1 and R2.

## **How does Cloudflare Workers process personal data?**

The platform itself processes IP addresses, request headers and URLs to route traffic to the nearest POP. Cloudflare may set its own operational cookies such as \_\_cf\_bm for bot management and cf\_clearance for challenge results. Any additional data processing depends on the code deployed by the operator of the Worker.

## **Is consent required?**

Cloudflare classifies \_\_cf\_bm and cf\_clearance as strictly necessary for security and bot mitigation, so they do not require consent under Article 5(3) of the ePrivacy Directive. Consent is required for any custom cookie that the Worker code sets for non strictly necessary purposes.

## **International data transfers**

Workers run on the closest Cloudflare POP, including in the EU. However, Cloudflare is a US headquartered company, and control plane data, account information and certain logs are processed in the United States. Transfers are governed by Standard Contractual Clauses and the EU US Data Privacy Framework. The Cloudflare Data Localisation Suite can restrict data residency.

## **Compliance recommendations**

Sign the Cloudflare Data Processing Addendum, document Workers in your record of processing activities, consider the Data Localisation Suite for EU only routing, and ensure that any cookie or storage operation performed by your Worker code respects consent obligations.

Compliance

## Cloudflare Workers and the GDPR

- Legal basis

  legitimate\_interest

- Risk level

  medium

- Applicable regulations

  GDPR, ePrivacy Directive

### Impact assessment (DPIA)

A DPIA is generally not required for Cloudflare Workers as infrastructure, but the use case must be assessed. A DPIA is recommended when Workers process sensitive data, build profiling features or call third country services.

### Sample text for your banner

> We use Cloudflare Workers to run code at the edge for performance and security. Cloudflare may set strictly necessary security cookies and process technical data including your IP address.

Cookies and trackers

## What Cloudflare Workers sets and contacts

- Tracking method

  serverless\_edge\_compute\_operational\_cookies

- Server location

  Cloudflare global edge network (US, EU, Asia, LATAM)

- Cookieless mode available

  Yes

- Data transferred outside the EU

  Cloudflare is a US headquartered controller with edge POPs worldwide. Although requests are served locally, control plane data and account level logs are processed in the United States. Transfers rely on Standard Contractual Clauses and the EU US Data Privacy Framework.

### Cookies set (5)

| Name              | Type      | Duration   | Purpose                                                                                                   |
| ----------------- | --------- | ---------- | --------------------------------------------------------------------------------------------------------- |
| \_\_cf\_bm        | necessary | 30 minutes | Cloudflare bot management cookie that distinguishes humans from automated traffic to protect the website. |
| cf\_clearance     | necessary | 30 days    | Confirms that the visitor has successfully passed a Cloudflare security challenge.                        |
| \_\_cflb          | necessary | 1 day      | Cloudflare load balancer cookie used to provide session affinity to the appropriate origin server.        |
| \_\_cfwaitingroom | necessary | session    | Cloudflare Waiting Room cookie used to manage queueing of users during traffic spikes.                    |
| \_\_cfruid        | necessary | session    | Cloudflare rate limiting cookie used to identify trusted web traffic.                                     |

### Third-party domains contacted (4)

- `cloudflare.com`
- `workers.dev`
- `cloudflareinsights.com`
- `challenges.cloudflare.com`

Questions

## Frequently asked questions about Cloudflare Workers

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### What cookies does Cloudflare Workers set?

Cloudflare itself may set \_\_cf\_bm to differentiate humans from bots and cf\_clearance to remember the result of a security challenge. The Worker code deployed by the operator can also set arbitrary cookies, which must each be classified depending on their purpose.

### Is consent required before running a Worker?

Workers as edge compute do not require consent for strictly necessary security cookies such as \_\_cf\_bm and cf\_clearance. Consent is required for any custom cookie or local storage operation set by the Worker code for analytics, personalisation or marketing purposes.

### What is the legal basis for Cloudflare Workers?

The legal basis is legitimate interest under Article 6(1)(f) of the GDPR for the security, performance and delivery of the website. For features that require consent under the ePrivacy Directive, the legal basis is the user's explicit consent.

### Does Cloudflare Workers transfer data outside the EU?

Yes. Although Workers execute on the closest POP, including in the EU, Cloudflare's control plane, account information and some logs are processed in the United States. Transfers are governed by Standard Contractual Clauses and the EU US Data Privacy Framework.

### Is a DPIA required for Cloudflare Workers?

A standalone DPIA is generally not required for Workers used as plain infrastructure. A DPIA is recommended when Workers process sensitive data, build profiling features, call third country services or implement automated decision making.

### How do I implement Workers compliantly?

Sign the Cloudflare DPA, enable the Data Localisation Suite for EU only routing where required, audit the cookies and storage operations performed by your Worker code, log only what you need, hash identifiers and respect consent signals received from the CMP.

### Are there privacy friendly alternatives?

Alternatives include EU based edge platforms like Scaleway Edge Services, Clever Cloud, Fastly Compute\@Edge in EU regions, OVHcloud and self hosted Node or Rust services. The choice depends on geographic coverage and the level of data residency you need.

### How should I update my cookie policy to mention Cloudflare Workers?

Mention Cloudflare as a processor for hosting, performance and security. Describe the \_\_cf\_bm and cf\_clearance cookies as strictly necessary, disclose potential transfers to the United States, list your own application cookies separately and provide a clear opt out path for non strictly necessary processing.

Same category

## More services: Hosting

[See the whole category](https://www.flowconsent.com/en/services/hosting)

### [mini\_httpd](https://www.flowconsent.com/en/services/hosting/mini-httpd)

[mini\_httpd is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. mini\_httpd integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, mini\_httpd helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/hosting/mini-httpd)

[Hosting](https://www.flowconsent.com/en/services/hosting/mini-httpd)

·

### [EasyEngine](https://www.flowconsent.com/en/services/hosting/easyengine)

[EasyEngine is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. EasyEngine offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, EasyEngine empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/hosting/easyengine)

[Hosting](https://www.flowconsent.com/en/services/hosting/easyengine)

·

### [VirtFusion](https://www.flowconsent.com/en/services/hosting/virtfusion)

[VirtFusion is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. VirtFusion supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, VirtFusion ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/virtfusion)

[Hosting](https://www.flowconsent.com/en/services/hosting/virtfusion)

·

### [libwww-perl-daemon](https://www.flowconsent.com/en/services/hosting/libwww-perl-daemon)

[libwww-perl-daemon is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. libwww-perl-daemon supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, libwww-perl-daemon ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/libwww-perl-daemon)

[Hosting](https://www.flowconsent.com/en/services/hosting/libwww-perl-daemon)

·

### [actionhero.js](https://www.flowconsent.com/en/services/hosting/actionhero-js)

[actionhero.js is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. actionhero.js integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, actionhero.js helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/hosting/actionhero-js)

[Hosting](https://www.flowconsent.com/en/services/hosting/actionhero-js)

·

### [MiniServ](https://www.flowconsent.com/en/services/hosting/miniserv)

[MiniServ is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. MiniServ integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, MiniServ helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/hosting/miniserv)

[Hosting](https://www.flowconsent.com/en/services/hosting/miniserv)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)