> Compliance analysis of Cloudflare Turnstile: privacy first design, ePrivacy exemption for security, cookies set, EU residency option, DPF and DPIA triggers. > > Canonical: https://www.flowconsent.com/en/services/security/cloudflare-turnstile Security # Cloudflare Turnstile Essential · [Official website](https://www.cloudflare.com/products/turnstile) Cloudflare Turnstile is a free, CAPTCHA-free bot detection service from Cloudflare that verifies users are human through invisible proof-of-work challenges, browser signals, and behavioural analysis, without presenting visible CAPTCHA puzzles. It is designed to be privacy-preserving: no persistent tracking cookies, no advertising data sharing, and minimal personal data processing. Legitimate interest supports its use for security without requiring consent, making it one of the most GDPR-friendly CAPTCHA alternatives available. [Block Cloudflare Turnstile until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Not required - Documented cookies 3 - Third-party domains 5 - Servers Cloudflare operates an anycast network of more than 320 points of presence. Turnstile challenges are issued and verified at the closest edge to the visitor; for EU visitors traffic stays in the European Region (Frankfurt, Paris, Amsterdam, Madrid) under the Cloudflare Regional Services configuration when activated by the customer. Overview ## What does Cloudflare Turnstile do? ## **What Cloudflare Turnstile actually does** Cloudflare Turnstile is the free CAPTCHA replacement launched by Cloudflare in 2022. Instead of asking users to identify traffic lights, Turnstile runs a series of non interactive JavaScript challenges (Private Access Tokens, browser integrity tests, behaviour signals) and returns a token that the publisher backend can verify against challenges.cloudflare.com/turnstile/v0/siteverify. The product is positioned as the privacy first alternative to Google reCAPTCHA: no Google or Cloudflare advertising cookie is set, the JavaScript widget is small, and the verification is local to the visitor browser whenever possible. ## **Cookies and storage set by Turnstile** In its default invisible mode, Turnstile does not write any cookie on the publisher domain. The widget script (challenges.cloudflare.com/turnstile/v0/api.js) only stores a transient nonce in sessionStorage to detect replay during the same page lifetime. When the visitor must complete a managed or interactive challenge, Cloudflare may set cf\_chl\_persist on .cloudflare.com (third party, 1 hour) and cf\_chl\_rc\_n on the publisher domain (first party, 1 hour) to remember the successful pass. These cookies are strictly necessary for the security service. ## **Lawful basis and the security exemption** Turnstile relies on the legitimate interest of the publisher in protecting its forms, login and APIs against bots, scraping and credential stuffing (GDPR art. 6(1)(f)). The CNIL recommendation on cookies and the EDPB guidelines 2/2023 on art. 5(3) ePrivacy both recognise an exemption from consent for cookies and storage strictly necessary to provide a security service explicitly requested by the user. Turnstile fits inside that exemption as long as the publisher does not reuse the signals for marketing or analytics. The data minimisation principle (GDPR art. 5(1)(c)) is respected because no persistent visitor identifier is created. ## **International data transfers** Cloudflare Inc. is established in the United States and adheres to the EU US Data Privacy Framework since 1 August 2023. Challenge signals are processed across the global anycast network, which includes the United States, even when the visitor connects to a European point of presence. Customers on Cloudflare Enterprise or Business with Regional Services can pin the data plane to the European Region to keep raw signals within the EU. The Cloudflare data processing addendum incorporates the EU Standard Contractual Clauses (module 2) and is auto signed by the customer when accepting the Cloudflare terms. ## **Practical compliance checklist** Limit Turnstile to genuine anti bot purposes; do not pipe the score into marketing analytics. Document Cloudflare as a processor in the GDPR art. 30 register and in the privacy notice. Activate Regional Services EU only when strict data residency is required. Review the configured action mode (managed, non interactive, invisible) to keep the user friction proportionate. Combine Turnstile with rate limiting and Web Application Firewall rules to reduce the number of challenges issued. Refresh the data processing addendum every year and verify the active DPF certification on dataprivacyframework.gov. ## **Alternatives** Privacy first alternatives include Friendly Captcha (German, GDPR designed), hCaptcha (with Privacy Pass), Altcha (open source proof of work) and MTCaptcha. Google reCAPTCHA remains the most popular but it sets behavioural cookies on doubleclick.net and is incompatible with the consent exemption for security cookies in most cases. Compliance ## Cloudflare Turnstile and the GDPR - Legal basis Legitimate interest of the publisher in protecting the site against bots and abuse (GDPR art. 6(1)(f)). Under the CNIL exemption for security cookies and the EDPB guidelines 2/2023 on the scope of ePrivacy art. 5(3), a CAPTCHA strictly necessary to deliver the service requested by the user can run without consent, provided no advertising reuse occurs. Consent must be sought if the publisher activates the Turnstile cf\_chl\_persist cookie for non security purposes. - Risk level low - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, EU US Data Privacy Framework, EDPB guidelines 2/2023 on art. 5(3) ePrivacy, CNIL recommendation on security cookies, TTDSG (Germany), LOPDGDD (Spain), LIL (France) ### Impact assessment (DPIA) A DPIA is generally not required for Turnstile because it is a security measure that processes only signals about the browser session. Document the legal basis and the data flow to Cloudflare. ### Sample text for your banner > We use Cloudflare Turnstile, a privacy first CAPTCHA replacement, to detect bots and protect our forms. Turnstile runs a non interactive JavaScript challenge in your browser; no advertising cookie is set and no behavioural profile is built. Signals such as your IP, user agent and challenge timings are processed across the Cloudflare global network, including the United States, under the EU US Data Privacy Framework and the EU Standard Contractual Clauses. Because Turnstile is strictly necessary to protect this site against fraud, it runs without your consent under the security exemption recognised by the CNIL and the EDPB. Cookies and trackers ## What Cloudflare Turnstile sets and contacts - Tracking method invisible\_browser\_challenge\_javascript - Server location Cloudflare operates an anycast network of more than 320 points of presence. Turnstile challenges are issued and verified at the closest edge to the visitor; for EU visitors traffic stays in the European Region (Frankfurt, Paris, Amsterdam, Madrid) under the Cloudflare Regional Services configuration when activated by the customer. - Cookieless mode available Yes - Data transferred outside the EU Cloudflare Inc. is established in San Francisco, California. Challenge signals (browser fingerprints, IP, timing, behaviour signals) are processed across the global Cloudflare network including the United States, even when the EU edge is preferred. Cloudflare adheres to the EU US Data Privacy Framework since 1 August 2023 and signs the EU Standard Contractual Clauses through its Data Processing Addendum. Activate Regional Services EU only for stricter data residency. ### Cookies set (3) | Name | Type | Duration | Purpose | | --------------- | ---------------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | cf\_clearance | First party (Cloudflare, optional) | 30 minutes | Set only when the protected resource also uses Cloudflare Bot Management. Confirms the visitor has passed the bot challenge for the current session. | | cf\_clearance | persistent | 30 minutes | Cloudflare Turnstile clearance cookie confirming successful human verification, no advertising or tracking purpose | | \_\_cf\_chl\_\* | First party (Cloudflare) | Few seconds | Short lived challenge cookie used to coordinate the Turnstile challenge in the browser. Removed immediately after the challenge completes. | ### Third-party domains contacted (5) - `challenges.cloudflare.com` - `challenges.cloudflare.com` - `cloudflare.com` - `cloudflare.com` - `static.cloudflareinsights.com` Questions ## Frequently asked questions about Cloudflare Turnstile Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Cloudflare Turnstile require consent? Generally no. Turnstile is designed for bot prevention under legitimate interest. It does not set persistent tracking cookies, does not profile users for advertising, and collects minimal data. Legitimate interest for security is well-supported without requiring consent. ### Is Cloudflare Turnstile really CAPTCHA-free? Yes. Turnstile does not show image puzzles or checkbox challenges to most users. It runs JavaScript challenges and browser attestation invisibly. In cases where automated checks are insufficient, Turnstile may show a simple visual confirmation, but most users experience zero-friction verification. ### What data does Cloudflare Turnstile collect? Turnstile collects: JavaScript challenge results, browser characteristics (user agent, screen resolution), timing signals, and proof-of-work challenge responses. It does not collect persistent identifiers for tracking, does not set advertising cookies, and does not share data with third-party advertising platforms. ### Does Cloudflare Turnstile transfer data outside the EU? Cloudflare operates a global network including EU data centres. For EU-only data processing, Cloudflare offers data localisation options. Standard Turnstile deployment may use Cloudflare's global network. Cloudflare provides a GDPR DPA covering Turnstile. Accept the Cloudflare DPA before using Turnstile on EU-facing websites. ### Is Cloudflare Turnstile free? Yes. Cloudflare Turnstile has a free tier with no usage limits for most use cases. There is no cost for the standard Turnstile widget. Enterprise-level features and SLA guarantees are available on Cloudflare's paid plans. ### How do I implement Cloudflare Turnstile? Add the Turnstile script tag to your page, add the Turnstile widget div with your site key, and validate the Turnstile token on your server using Cloudflare's siteverify API. Turnstile provides drop-in compatibility with existing reCAPTCHA implementations via its explicit mode. ### What is the difference between Cloudflare Turnstile and hCaptcha? Both are privacy-friendly reCAPTCHA alternatives. Key differences: Turnstile is CAPTCHA-free (no visual puzzles for most users) while hCaptcha may show image grids. Turnstile is fully free with no limits; hCaptcha has a free tier but enterprise features are paid. Turnstile is hosted by Cloudflare with EU options; hCaptcha is US-hosted requiring SCCs. For GDPR simplicity, Turnstile's CAPTCHA-free design and minimal data collection are advantages. ### How do I disclose Cloudflare Turnstile in my privacy policy? State: that forms are protected by Cloudflare Turnstile for bot prevention, that Turnstile uses browser signals and JavaScript challenges to verify humanity, that this is processed under legitimate interest for security, that Cloudflare infrastructure is used, and link to Cloudflare's privacy policy. ### What cookies does Cloudflare Turnstile set? None by default. Turnstile is cookieless and uses only short lived browser signals. The cf\_clearance cookie may appear if the protected resource is also behind Cloudflare Bot Management, but Turnstile itself does not depend on it. ### Do I need consent for Cloudflare Turnstile? No. Turnstile is a security technology necessary to provide the requested service (Recital 30 ePrivacy, Recital 49 GDPR). It can be loaded before consent like any anti abuse CAPTCHA. The CNIL and AEPD share this view. ### What is the legal basis for Turnstile? Legitimate interest (Art. 6(1)(f) GDPR) to protect a service from automated abuse, fraud, credential stuffing, scraping and spam. The interest is concrete and proportionate. ### Does Cloudflare Turnstile transfer data to the US? Cloudflare, Inc. is established in the United States. Most Turnstile challenges are evaluated at the closest edge node, often in Europe. Any transfer to the US is covered by the EU US Data Privacy Framework and EU SCCs in the Cloudflare DPA. ### Do I need a DPIA for Turnstile? A DPIA is generally not required because Turnstile is a security measure that processes only browser signals for a short time. Document the lawful basis in your records of processing. ### How do I implement Turnstile compliantly? Use it on the forms or actions where bot abuse is a real risk. Document it as a security measure. Sign the Cloudflare DPA. Verify server side. Use explicit or managed render mode to avoid surprising the user. ### What are the alternatives to Turnstile? Privacy first CAPTCHA alternatives include Friendly Captcha (Germany), Anubis (open source), MTCaptcha (Spain), Hcaptcha (Switzerland), Procaptcha (UK), Capy Puzzle Captcha (Japan), Geetest (China). For full Bot Management, consider Datadome (France) and Reblaze. ### How do I update my cookie policy for Turnstile? No mandatory cookie entry because Turnstile is cookieless. Mention Cloudflare Turnstile in the security section of your privacy policy: purpose (bot mitigation), legal basis (legitimate interest in security), processor (Cloudflare), data transfer (EU US Data Privacy Framework + SCCs). Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [VAPTCHA](https://www.flowconsent.com/en/services/security/vaptcha) [VAPTCHA is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. VAPTCHA supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, VAPTCHA ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/vaptcha) [Essential](https://www.flowconsent.com/en/services/security/vaptcha) · ### [LINE Login](https://www.flowconsent.com/en/services/security/line-login) [LINE Login is an identity and authentication platform providing secure login, single sign-on (SSO), and multi-factor authentication for websites and applications. It supports social login, passwordless authentication, and user management with enterprise-grade security. LINE Login simplifies identity implementation for developers while ensuring compliance. With adaptive authentication and anomaly detection, LINE Login protects user accounts while maintaining a frictionless experience.](https://www.flowconsent.com/en/services/security/line-login) [Essential](https://www.flowconsent.com/en/services/security/line-login) · ### [GoAnywhere](https://www.flowconsent.com/en/services/security/goanywhere) [GoAnywhere is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. GoAnywhere is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, GoAnywhere offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/security/goanywhere) [Essential](https://www.flowconsent.com/en/services/security/goanywhere) · ### [Norton Safe Web](https://www.flowconsent.com/en/services/security/norton-safe-web) [Norton Safe Web is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Norton Safe Web is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Norton Safe Web offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/security/norton-safe-web) [Essential](https://www.flowconsent.com/en/services/security/norton-safe-web) · ### [Token of Trust](https://www.flowconsent.com/en/services/security/token-of-trust) [Token of Trust is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Token of Trust integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Token of Trust helps organizations maintain robust websites that meet user expectations and technical.](https://www.flowconsent.com/en/services/security/token-of-trust) [Essential](https://www.flowconsent.com/en/services/security/token-of-trust) · ### [db-ip](https://www.flowconsent.com/en/services/security/db-ip) [db-ip is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. db-ip supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, db-ip ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/db-ip) [Essential](https://www.flowconsent.com/en/services/security/db-ip) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)