🔒Cloudflare Injects Analytics Without Consent on DNS Switch
Cloudflare's Sneaky New Analytics Feature
TL;DR
Cloudflare now adds its own analytics script when you switch nameservers, requiring users to opt-out. This move is seen as invasive by some and raises privacy concerns.
Cloudflare silently injects a JavaScript analytics snippet into your site's HTML when you switch DNS providers. To disable it, you must manually navigate to the Analytics dashboard and turn off the feature. Some see this as an invasion of privacy since users are forced to opt-out rather than opt-in. The script is located at https://static.cloudflareinsights.com/beacon.min.js/v4513226... with a specific integrity attribute for security verification. This isn't just about analytics; it's part of a broader trend where Cloudflare can track individual web requests and snoop on cleartext traffic without user consent.
Key Points
Cloudflare's injected analytics snippet is found in HTML-only JS-free site textlog.cc.
To disable the feature, users must add their site to the Analytics dashboard and turn off the script manually.
The JavaScript analytics snippet has an integrity attribute with value sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==.
Cloudflare's 1.1.1.1 DNS service is not affected by this issue, maintaining a separate opt-out mechanism.
Some users have multiple domains using CF for DNS only and aren't impacted by the analytics injection.
Why It Matters
If you're managing DNS with Cloudflare and switching providers, be prepared to manually disable unwanted analytics. This affects privacy-conscious teams who rely on clear consent for data collection practices.
Frequently Asked Questions
Why does this matter?
If you're managing DNS with Cloudflare and switching providers, be prepared to manually disable unwanted analytics. This affects privacy-conscious teams who rely on clear consent for data collection practices.
What happened?
Cloudflare now adds its own analytics script when you switch nameservers, requiring users to opt-out. This move is seen as invasive by some and raises privacy concerns.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,086 builders reading daily.