Is cPFence CAPTCHA WAF GDPR compliant?

cPFence v4+ hosted CAPTCHA is powered by Cloudflare Turnstile. Cloudflare publishes GDPR safeguards and guidance for its services. For cPFence’s general statement, see Is cPFence GDPR Compliant?.

Using CAPTCHA does not by itself establish GDPR compliance for your website. The website operator remains responsible for its own processing and privacy information.

Powered by Cloudflare Turnstile

Turnstile checks whether a visitor is human or a bot. Cloudflare’s Turnstile Privacy Addendum explains the signals it processes, including IP address, TLS fingerprint, User-Agent and the sitekey with its associated origin. It uses those signals for bot detection and to improve Turnstile.

Cloudflare describes separate roles: it acts as a processor when protecting a customer’s website and as a controller when improving its bot detection. Its addendum explains the applicable purposes and responsibilities.

Privacy information for your website

Review your website’s use of Turnstile and its privacy notice with the person responsible for data protection. Refer to Cloudflare’s current processing terms when explaining the service to visitors.

Learn more

For questions about your cPFence configuration, contact support.