Does the __cf_bm cookie need consent?

Usually not. __cf_bm is in the Essential category, and strictly necessary cookies are exempt from consent under the ePrivacy Directive and PECR. It must still be listed in your cookie policy.

How long does the __cf_bm cookie last?

__cf_bm usually lasts 30 minutes. The exact lifetime depends on the site's settings and the version of the script that sets it.

Who sets the __cf_bm cookie?

__cf_bm is set by Cloudflare. It is in the Essential category.

How do I block or delete the __cf_bm cookie?

Visitors can delete __cf_bm in their browser's cookie settings, although the website may not work properly without it. A consent banner lists it under Essential, which is always active, so it is not blocked.

Essential

__cf_bm cookie

Set by Cloudflare.

What it does

Cloudflare bot management cookie.

Cookie name: __cf_bm
Category: Essential
Provider: Cloudflare
Duration: 30 minutes
Data source: Kukie.io

Consent

Usually not needed

__cf_bm is in the Essential category. Strictly necessary cookies are exempt from consent under Article 5(3) of the ePrivacy Directive, as long as the cookie is really needed for the service the visitor asked for. It still belongs in your cookie policy.

GDPR and ePrivacy (EU): Exempt from prior consent under the strictly necessary exemption (Article 5(3) of the ePrivacy Directive), as long as __cf_bm is really needed for the service the visitor asked for. It must still be listed in your cookie policy.
UK GDPR and PECR: Exempt from consent under PECR Regulation 6(4) when strictly necessary. It must still be listed in your cookie policy.
CCPA and CPRA (California): No opt-out is needed for a strictly necessary cookie, but __cf_bm must be disclosed in your privacy policy.

Managing __cf_bm with a consent banner

A consent banner lists __cf_bm in its cookie table under Essential, the category that is always active. Because it is strictly necessary, it works without an opt-in, and listing it keeps your cookie policy accurate. Kukie.io's cookie scanner finds it when it scans your website.

Learn more about script blocking

Related cookies