Cloudflare does not mandate a cookie banner: its cookies are for security and load balancing, which are exempt under Article 22.2 of Law 34/2002. Your tools are what make a banner necessary.
Cloudflare, by itself, does not require you to display a cookie banner. The cookies installed by the proxy are for security, load balancing, and traffic limitation purposes, falling under the technical exemption of Article 22.2 of Law 34/2002. A banner is required by your tools: analytics, pixels, embedded videos, maps, and remote fonts.
Cloudflare changes who serves your bytes. It does not change who is accountable to the AEPD.
Which cookies Cloudflare sets and why they are exempt
Article 22.2 of Law 34/2002 requires consent to store or retrieve data on a user's device, with a defined exception.
The AEPD's Guide on the Use of Cookies (May 2024 version) lists the exempted categories: user input cookies, session authentication cookies, user security cookies, multimedia player session cookies, load balancing session cookies, interface customization cookies, and certain social plug-in cookies.
Proxy cookies fall into these categories. These are the cookies, along with the durations documented by Cloudflare:
| Cookie | Purpose | Documented Duration |
|---|---|---|
__cf_bm | Bot detection and mitigation | Expires after 30 minutes of continuous inactivity |
cf_clearance | JavaScript-based detections and Turnstile pre-clearance | Not documented in public reference |
__cflb | Load balancer session affinity | From several seconds to 24 hours |
__cfruid | Rate limiting support | Not documented |
_cfuvid | Distinguishes users sharing an IP in rate limiting rules | Only if configured |
cf_ob_info / cf_use_ob | Always Online | 30 seconds |
Cloudflare declares them "strictly necessary to provide the services requested by our customers, unless otherwise stated."
The nuance that almost no Spanish website mentions: the exemption is granted by the purpose and the duration, not by the provider's declaration. Cloudflare may call one of its cookies "strictly necessary." You are the one who must justify this classification to the Agency, and it only holds as long as the cookie serves security or load balancing and does not contribute to any form of measurement.
Common industry practice: "I use Cloudflare, which is security, so I am exempt and will remove the banner." The proxy does not touch Google Analytics, the YouTube iframe, or the map embedded on the contact page. Those continue to write data to your visitor's browser.
Our criteria: We audit what your website writes with the banner disabled and the tools loaded. If the only things that appear are Cloudflare cookies, we remove the banner and document it. If anything else appears, the banner stays.
Where the exemption fails
Three specific scenarios, all of which we frequently encounter.
Zaraz loading third-party tools. Cloudflare's documentation is explicit: their tools "all use cookies that are not strictly necessary for the website's correct operation." This is why Zaraz includes its own consent manager. If you use Zaraz to inject analytics or pixels, you need a banner.
Any external embedding. A YouTube video, a font served from a third-party domain, or a review widget. Cloudflare serves them faster, not more legally.
Reusing security cookies for measurement. As soon as data from __cf_bm feeds an audience dashboard, it ceases to be strictly necessary.
"Cookie-less" does not mean "no obligations"
Cloudflare Web Analytics does not use cookies: "We don't use any client-side state (like cookies or localStorage) for analytics purposes," published on December 9, 2020. It counts visits based on the referer header, not by a stored identifier.
That puts it outside of Article 22.2. However, the article does not only speak of cookies: it speaks of storing and retrieving data on terminal equipment, which also covers localStorage and fingerprinting. A "cookie-less" tool that fingerprints the browser falls squarely under consent requirements. No cookies is not synonymous with no banner. No client-side state, however, is.
What you need even if you remove the banner
- An inventory of cookies and localStorage created with the browser in a clean window, not from memory
- No third-party embeddings in any template, including the blog or the contact form
- A privacy policy with the information required by Article 13 of the GDPR, which remains mandatory
- A legal notice with the details required by Article 10 of the LSSI: a banner and a legal notice are two different things
- An internal document explaining why each cookie is exempt, with a date
Removing the banner is a conclusion you document, not a checkbox you disable in Cloudflare.
Verified on 08-27-2026 against Cloudflare's public cookie documentation, the consolidated text of Law 34/2002 in the BOE, and the AEPD's Guide on the Use of Cookies (May 2024). The proxy list changes with the products you enable: review it every time you turn on a new feature.
A redundant banner annoys every visitor and protects against nothing. A missing banner is paid for once, and dearly. The provider does not decide the difference: the inventory does.
Do you want us to check what your website is actually writing before making any changes?
Frequently asked questions
Is Cloudflare a data controller or a data processor?
Toward your visitors, you are the controller; Cloudflare acts as a processor on your behalf. Signing their addendum does not transfer your obligation to inform: you still bear it in its entirety.
What if I enable Bot Fight Mode? Do I need consent for __cf_bm?
No, as long as it is limited to distinguishing bots from humans: it is a user security cookie and falls into the exempted categories listed by the AEPD. If you use it for anything else, it is no longer exempt.
Can I remove the banner and leave only the cookie policy?
Yes, if your website does not write anything outside of the technical exemption. The cookie policy can be reduced to a section within the privacy policy that lists the exempt cookies and explains why they are exempt.
Does Turnstile require me to use a banner?
Turnstile issues a pre-clearance cookie for fraud prevention purposes, not for measurement. It fits under user security, but document it: the burden of proof is yours, not Cloudflare's.
Is this sanctioned under GDPR?
Non-compliance with Article 22.2 is prosecuted under Law 34/2002, not the GDPR, even if the same Agency investigates it. The sanctioning regime changes, not the obligation.
Keep reading
- Legal obligations for a website in Spain: GDPR, cookies, and Consent Mode v2
- Kit Digital in 2026: what happened and who keeps the voucher
- Which hosting to choose in Spain: criteria, not affiliate rankings
- Checklist of 47 checks before putting a website into production
Transparency note. Some of our own data in this guide is still being measured on real projects, with a single method. We will publish it with its sample size and date range once the sample is large enough; until then, every figure you see carries its source and date of consultation.
Sources
- https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/ — official list of proxy cookies (__cf_bm, cf_clearance, __cflb, __cfruid, _cfuvid, cf_ob_info/cf_use_ob), their purposes, documented durations, and the declaration "strictly necessary to provide the services requested by our customers, unless otherwise stated"
- https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758 — consolidated text of Law 34/2002 (LSSI-CE), Article 22.2: consent and technical exception ("to the extent strictly necessary for the provision of an information society service expressly requested by the recipient")
- https://www.aepd.es/documento/guia-cookies.pdf — AEPD Guide on the Use of Cookies, May 2024 version: list of exempted categories (user input, session authentication, user security, multimedia player, session load balancing, interface customization, social plug-in) and criteria regarding analytics and third-party cookies
- https://blog.cloudflare.com/privacy-first-web-analytics/ — published December 9, 2020: "We don't use any client-side state (like cookies or localStorage) for analytics purposes" and the count method by referer header
- https://developers.cloudflare.com/zaraz/consent-management/ — Zaraz consent manager and the assertion that the tools it loads "all use cookies that are not strictly necessary for the website's correct operation"
- https://developers.cloudflare.com/turnstile/frequently-asked-questions/ — Turnstile pre-clearance and its declaration to process "only the data strictly necessary to provide this security function"
Want to see this thinking applied to a real project?