Last updated: JUNE 18, 2025
1. INTRODUCTION
Turnstile, developed by Cloudflare, Inc. (Cloudflare), is a privacy-friendly security tool for websites that processes a minimum of signals (as defined below) exclusively to protect web properties from malicious activity by separating human users from bots and blocking bot traffic.
Cloudflare does not control whether a website chooses to use Turnstile; instead, we make Turnstile available to any website looking for a way to detect and block bot traffic.
2. SCOPE OF THE SUPPLEMENT
This Turnstile add-on is a complement to Cloudflare's main privacy policy. It provides additional information specific to your use of and interaction with Turnstile. This supplement also applies to personal data processed using Cloudflare’s Challenge Platform, and any reference to ”Turnstile” in this supplement applies equally to the Challenge Platform.
Cloudflare's Privacy Policy continues to apply to your use of and interaction with Turnstile, except where this Turnstile add-on provides more specific information, in which case the more specific information will apply instead.
3. INFORMATION WE COLLECT
Cloudflare Turnstile processes a variety of client-side signals (”signals”), such as the client’s IP address, TLS fingerprint, User-Agent header, and Sitekey and associated origin. Cloudflare does not have the ability to directly identify any individual based on any of the signals that Turnstile collects, including IP addresses.
4. HOW WE USE THE INFORMATION WE COLLECT
(i) Bot detection and blocking
Turnstile is a tool for protecting web property by separating human users from bots and blocking any detected bot traffic that could otherwise compromise the property's security and safety.
This is done by evaluating the signals listed above, which are specific to both the website visitor and the website visited. The purpose of collecting these signals is not to identify, profile or target individuals, but solely to detect and block bots. The signals that Turnstile collects are strictly necessary for this purpose (i.e. to detect and block bots in order to enable visitors to have a safe and secure experience when visiting websites that have implemented Turnstile).
Cloudflare is a data processor for the signals we process to provide the Turnstile service to our customers, i.e. to protect our customers’ websites. This means that we process signals for this purpose on behalf of, and under the instructions of, our website operator customers (who are the data controllers for all data processed for this purpose). If you have any questions, or wish to exercise any data protection rights, regarding Cloudflare’s processing of Turnstile data to provide our service, please contact the relevant website operator.
(ii) Improving Turnstile's ability to detect bots
Cloudflare also processes the signals described in this Privacy Notice to improve Turnstile. This is necessary to refine and improve our bot detection algorithms, to address the ever-evolving bot threat, and to maintain the security of the web property that visitors choose to visit.
Cloudflare is the data controller for the signals we process to improve Turnstile's bot detection capabilities. This Turnstile Privacy Notice (together with Cloudflare's main privacy policy) governs our processing of signals for this purpose.
5. NOTICE TO RESIDENTS IN THE EU AND THE UK
To the extent that the information described in the Turnstile Privacy Notice constitutes personal data, the following applies:
When we process this personal data as a data processor to protect our clients' websites, our clients, as data controllers, determine the legal basis for this processing, and we process this data on their instructions and on their behalf; and
When we process this personal data as a data controller, we rely on our legitimate interest in improving the effectiveness of Turnstile's bot detection capabilities to process this Turnstile data.
6. COOKIES
The signals that Turnstile collects are strictly necessary for the purpose of detecting and blocking bots, so that visitors can have a safe and secure experience when visiting websites that have implemented Turnstile.
For more information about the cookies that Cloudflare uses, see our cookie policy and our Turnstile developer documents.
CONTACT FOR INTEGRITY ISSUES
If you have any questions or concerns about this Turnstile Privacy Notice or about your personal data processed through Turnstile, please contact Cloudflare's Data Protection Officer at dpo@cloudflare.com.