← All guides

Cloudflare Web Analytics: classify cookieless RUM connection

Classification

Do not equate cookieless measurement with completely local processing; Evaluate browser requests and provider processing separately.

Cloudflare Web Analytics loads a JavaScript beacon and sends performance/RUM data to Cloudflare endpoints. Cloudflare describes the product as having no personal tracking across customer websites. For “We don’t save!” It still remains an external connection and must be evaluated as such.

Check after the change

Check browser memory and network requests and also view web server, proxy, application and provider logs separately. A single product setting does not automatically cover the entire processing chain.

Basics for classification

Don't just pay attention to cookies when evaluating: Cookieless is not automatically tracking-free. If “unique visitors” are recorded, also note Unique visitors without recognition .

Reset

If the reduced configuration affects a required function, restore only the relevant setting and then recheck data flow, storage, retention and third-party connections.

Related guides

• Umami: cookieless does not mean without visitor identification
• WordPress: Classify independent analytics in a data protection-conscious manner
• WordPress: Classify Wordfence and IP-based security functions
• PostHog: Correctly classify cookieless mode

Sources and verification

This guide is based on multiple current sources. Vendor documentation is not treated as proof that every concrete installation automatically follows the same privacy characteristics.

• Source 1
• Source 2

Important: IP processing is not IP storage

An IP address has to be processed to establish and deliver a network connection. Hosting providers, firewalls or DDoS protection may also process or retain it for a limited time for security purposes. No Logging distinguishes this security layer from unnecessary persistent visitor logging by the website, application and ordinary access logs.