# Cloudflare Web Analytics privacy rating

Free web analytics from Cloudflare that reports page views, visits and Core Web Vitals using a JavaScript beacon or Cloudflare's proxy, without cookies.

## Summary

Cloudflare Web Analytics scores 61 out of 100 (grade C) on the website analytics criteria. It meets 6 of 11 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, no cookies and no personal data. It partly meets independent audit and security headers. It does not meet open source, no trackers or telemetry and self-hostable. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade B+.

- Website: https://www.cloudflare.com/web-analytics/
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: Cloudflare Web Analytics (cookieless analytics), Google Tag Manager
- Category: [Website analytics](https://privacyratings.com/web-analytics/)
- Also rated: [Cloudflare Email Routing](https://privacyratings.com/email-forwarding/cloudflare-email-routing/) (Email forwarding and aliases), [1.1.1.1](https://privacyratings.com/mobile-security-apps/1-1-1-1/) (Mobile security apps), [Cloudflare](https://privacyratings.com/dns-resolvers/cloudflare/) (DNS resolvers), [Cloudflare DNS](https://privacyratings.com/dns-hosting/cloudflare-dns/) (DNS hosting), [Cloudflare Registrar](https://privacyratings.com/domain-registrars/cloudflare-registrar/) (Domain registrars), [Cloudflare Workers](https://privacyratings.com/app-hosting/cloudflare-workers/) (App hosting platforms), [Cloudflare Mesh](https://privacyratings.com/mesh-vpns/cloudflare-mesh/) (Mesh VPNs and private networks)
- Grade: C (61/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The Cloudflare website loads Google Tag Manager and uses cookies for interest-based advertising. | https://www.cloudflare.com/privacypolicy/ |
| No ads or data sales | Yes | Funded by paid Cloudflare plans. The product page states visitor data is not used to retarget visitors with ads. | https://www.cloudflare.com/web-analytics/ |
| Independent audit | Partial | SOC 2, ISO 27001 and PCI reports exist but are only available to account administrators in the dashboard. | https://developers.cloudflare.com/fundamentals/reference/policies-compliances/compliance-docs/ |
| Transparency report | Yes | Semi-annual reports with counts of legal requests and responses. | https://www.cloudflare.com/transparency/ |
| Tells users about requests | Yes | The transparency report states customers are notified of legal requests unless legally prohibited. | https://cf-assets.www.cloudflare.com/slt3lc6tev37/zItVXCvbb4LZpYG4Uh10R/7b27bba39755f0a4344acb946977704d/2H_2025_Cloudflare_s_Transparency_Report_Legal-v2.pdf |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=dash.cloudflare.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=dash.cloudflare.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| No cookies | Yes | No client-side state such as cookies or localStorage is used, and visitors are not fingerprinted. | https://www.cloudflare.com/web-analytics/ |
| No personal data | Yes | The documentation states Web Analytics does not collect or use visitors' personal data. | https://developers.cloudflare.com/web-analytics/about/ |
| Self-hostable | No | Hosted only. |  |

Source: https://privacyratings.com/web-analytics/cloudflare-web-analytics/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/web-analytics/cloudflare-web-analytics.md