[tg180]

> Cloudflare does mostly use the browser's properties to determine if a manual check should be done

Cloudflare uses the threat score of each IP address as a signal to determine whether additional checks are necessary. A shared IP address is more likely to be associated with "issues", such as a compromised IoT device being used for DDoS attacks, one of your neighbours spamming a forum, ...

[OJFord]

How is it not a GDPR violation? Before I've even connected to the site I intended and had the opportunity to consent, an IP address that potentially uniquely identifies me (plus whatever else) is shared with a third-party data processor?

[tuckerman]

There is generally exceptions for anti-abuse/spam to some of the provisions of GDPR and the like.

That said, is there really any 3rd party here? You are connecting to cloudflare and they are the ones that have seen this IP before and judging its behavior.

[Hikikomori]

How would it work with IP/Internet at all? Doesn't matter if the site is hosted in Cloudflare, aws or random datacenter.