Cloudflare

⚠️ Article status notice: This article has been marked as incomplete

This article needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues.

This notice will be removed once sufficient documentation has been added to establish the systemic nature of these issues. Once you believe the article is ready to have its notice removed, visit the discord and post to the #appeals channel.

Learn more ▼

This Article Requires Additional Verification

---

This article has been flagged due to verification concerns. While the topic might have merit, the claims presented lack citations that live up to our standards, or rely on sources that are questionable or unverifiable by our standards. Articles must meet the Moderator Guidelines and Mission statement; factual accuracy and systemic relevance are required for inclusion here!

Why This Article Is In Question

---

Articles in this wiki are required to:

• Provide verifiable & credible evidence to substantiate claims.
• Avoid relying on anecdotal, unsourced, or suspicious citations that lack legitimacy.
• Make sure that all claims are backed by reliable documentation or reporting from reputable sources.

Examples of issues that trigger this notice:

• A topic that heavily relies on forum posts, personal blogs, or other unverifiable sources.
• Unsupported claims with no evidence or citations to back them up.
• Citations to disreputable sources, like non-expert blogs or sites known for spreading misinformation.

How You Can Improve This Article

---

To address verification concerns:

• Replace or supplement weak citations with credible, verifiable sources.
• Make sure that claims are backed by reputable reporting or independent documentation.
• Provide additional evidence to demonstrate systemic relevance and factual accuracy. For example:
  • Avoid: Claims based entirely on personal anecdotes or hearsay without supporting documentation.
  • Include: Corporate policies, internal communications, receipts, repair logs, verifiable video evidence, or credible investigative reports.

If you believe this notice has been placed in error, or once the article has been updated to address these concerns, please visit the #appeals channel on our Discord server: Join here.

Cloudflare

Basic information
Founded	2009
Type	Public
Industry	Web Services
Official website	https://www.cloudflare.com/

Cloudflare, Inc. is an American company that offers a wide range of web services. Due to its widespread adoption, Cloudflare's services play a critical role in the modern web infrastructure.

Consumer impact summary

Overview of concerns that arise from the company's conduct regarding (if applicable):

• User Freedom
• User Privacy
• Business Model
• Market Control

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.

Anti-consumer practices

Forced ID theft and face recognition

A full day after the sale of domain names, Cloudflare sends the customer a demand to present an ID card and their face in an automated video call with the third party Stripe within 24 hours to be analyzed by a face recognition system, threatening to cancel the sale unless the customer fulfills this requirement that the customer was not informed about before the sale, thereby making the domain names available for squatters to grab. The customer can lose their domain names either by simply not checking their email for 24 hours, which is likely as the sale has already completed and the customer has no reason to check their email again, or by the customer not agreeing to the procedure, which the customer should not, as ID cards are not made for use online. The customer's bank already has a procedure for verifying online purchases by popping up the bank app that has already been verified by visiting the bank in person, showing an ID card to a real person and signing a paper by hand. Stripe could have done like everyone else and delegate the procedure to the bank instead of inventing their own.

Cloudflare claims that any images used for verification will be deleted afterwards. This is an unverifiable claim. If Stripe for any reason does not delete the images, Stripe would surely not allow employees to disclose that this has happened. Deleting the images also makes the process ineffective, as anyone could present a fake ID card good enough to look real in the low quality of a web camera and then have the evidence deleted.

In the case documented, the second response from “Trust & Safety” is an unhelpful repetition of the first response, coming near the end of the 24 hour window, ignoring any details added by the customer in response to the first one. It asks the customer to confirm that the customer prefers not to proceed with the verification so that steps can be taken, but time is already running out, and the account was suspended before “Trust & Safety” could respond. A month later, “Trust & Safety” has still not responded. The notice that the account was suspended states that the suspension does not impact, disable, or remove current services, contradicting the initial demand. In reality, the domain names belonging to the account were cancelled, and available for strangers to register with other registrars.

• 
• 
• 
• 

Password scanning of website visitors

From September to November 2024 Cloudflare was scanning the passwords users entered on websites without obtaining the users' consent