Privacy, GDPR and what data Turnstile collects
Updated September 13, 2026
Turnstile is generally regarded as the more privacy-preserving option among CAPTCHA services, which is a common reason sites move to it from reCAPTCHA. This article sets out what is actually involved so you can make your own assessment — it is not legal advice, and your own compliance position is yours to determine.
What Cloudflare says about Turnstile
Cloudflare states that Turnstile does not look for cookies such as a login cookie, and does not use cookies to collect or store information of any kind, and that they do not harvest data for ad retargeting. Their announcement post explains the reasoning, and their GDPR pages and Data Processing Addendum cover the contractual side.
Verification does involve your server sending the visitor’s IP address to Cloudflare along with the token, so Cloudflare processes personal data on your behalf. That is worth a line in your privacy policy, naming Cloudflare as a processor.
What the plugin itself stores
By default, nothing about your visitors. The plugin stores its own settings, and that is all.
Two optional features change that:
- Analytics stores counters only — totals per form and per error code. No IP addresses, no page URLs. Safe to leave on.
- Debug logging stores the date, result, error code, visitor IP address and page URL for each verification, capped at the 50 most recent. This is personal data. Turn it on to investigate something, then turn it off and clear the log with Reset Log.
The plugin adds no tracking of its own, has no telemetry, and sends nothing to its developer.
Failsafe mode and reCAPTCHA
If you set Failsafe Type to Fallback to reCAPTCHA, then during a Cloudflare outage your forms load Google reCAPTCHA instead, with the data-collection profile that carries. It only activates during an outage, but it should still be declared in your privacy policy. Choosing Allow submissions avoids introducing Google entirely.
Practical steps
- Name Cloudflare in your privacy policy as a processor for spam protection, and link to their DPA.
- If you use the reCAPTCHA failsafe, mention Google as well.
- Keep debug logging off except while troubleshooting.
- If you take a formal view on cookie consent, note that Turnstile’s position is that it sets no cookies — but verify this against your own scan rather than taking it on trust.