Cloudflare, Inc. is a publicly traded (NYSE: NET) CDN, security, and network-infrastructure company that also operates the consumer-facing 1.1.1.1 public DNS resolver and WARP app. Cloudflare's own privacy policy discloses a broad CCPA-style category list for the personal information it processes across its business (identifiers, payment records, protected classification characteristics when voluntarily disclosed, commercial and employment information, network activity, and inferences), uses marketing/advertising cookies including third-party retargeting on its own websites, and self-declares that making certain personal information available to marketing partners may constitute a "sale" or "sharing" under the CCPA, with an opt-out mechanism. Separately, Cloudflare publishes an explicit privacy-by-design commitment for its 1.1.1.1 resolver: it states it has taken technical steps to prevent retaining user information, deletes public resolver logs within 25 hours, shares only anonymized query data with research partner APNIC under a limited agreement, and has retained an unnamed "top four" accounting firm to audit and publicly report on those practices. Cloudflare's own blog has published detailed self-reported incident reports for two security events: the 2017 "Cloudbleed" memory-leak bug that could return private data such as cookies and auth tokens in HTTP responses, and a 2023–2024 incident in which unrotated credentials leaked in the separate Okta breach let a threat actor access internal Atlassian/Bitbucket systems.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
COLLECTION
Cloudflare's privacy policy lists the CCPA categories of personal information it processes across its business, including identifiers, payment/customer records, protected classification characteristics when voluntarily disclosed or present in network-transmitted content, commercial information, professional/employment information, network activity information, and inferences.
Cloudflare, Inc.'s Form 10-K for fiscal year 2025, filed with the SEC, confirms its Class A Common Stock, par value $0.001 per share, is registered and trades on the New York Stock Exchange under ticker symbol NET.
Cloudflare's 1.1.1.1 privacy page states Cloudflare has agreed to provide research partner APNIC with access only to anonymized query data collected through the Public DNS Resolver, not a general third-party data sale.
Cloudflare's privacy policy self-declares that making certain personal information, such as online identifiers or browsing activity, available to its marketing/advertising partners may be considered a "sale" or "sharing" of personal information under the CCPA, and offers an opt-out.
Cloudflare's 1.1.1.1 privacy page states it has retained one of the "top four" accounting firms (unnamed on this page) to audit its resolver privacy practices and publish a public report confirming compliance.
Cloudflare's own incident report on the 2017 "Cloudbleed" bug states its edge servers were running past the end of a buffer and returning memory containing private information such as HTTP cookies, authentication tokens, and HTTP POST bodies in some HTTP responses, some of which had been cached by search engines.
Cloudflare's own incident report on a Thanksgiving 2023 security incident states that credentials leaked during the separate Okta compromise were not fully rotated, and one service token and three service accounts left unrotated allowed a threat actor to access internal systems including Atlassian.
Cloudflare's 1.1.1.1 public DNS resolver privacy page states Cloudflare has taken technical steps to ensure it cannot retain resolver users' information and that Public Resolver Logs are deleted within 25 hours.
Cloudflare's privacy policy states it uses cookies and similar technologies to serve the user advertising on third-party sites based on their browsing activities and interests.