Necessary

"__cf_bm" Cookie

Cloudflare

Description

Cloudflare bot management cookie.

Details

Cookie Name: __cf_bm
Category: Necessary
Service: Cloudflare
Duration: 30 minutes
Data Source: Manual

Consent Requirement

This cookie is classified as necessary and typically does not require consent. It is essential for basic website functionality.

Consent Requirements by Regulation

GDPR & ePrivacy (EU)

Exempt from prior consent under the strictly necessary exemption (ePrivacy Directive Article 5(3)), provided __cf_bm is genuinely required for the service the visitor requested. It must still be listed in your cookie policy.

UK GDPR & PECR

Exempt from consent under PECR Regulation 6(4) when strictly necessary. Disclosure in your cookie policy is still required.

CCPA/CPRA (California)

No opt-out is required for strictly necessary cookies, but __cf_bm must be disclosed in your privacy policy.

Managing __cf_bm with a Consent Banner

A consent management platform lists __cf_bm in the banner's cookie table under the necessary category. Because it is strictly necessary, it stays active without an opt-in, but disclosing it keeps your cookie policy accurate. Kukie.io's scanner detects it automatically and keeps the disclosure up to date as your site changes.

Frequently Asked Questions

Does the __cf_bm cookie require consent?

No. __cf_bm is classified as strictly necessary, so it can be set without prior consent under GDPR and PECR. It must still be listed in your cookie policy.

How long does the __cf_bm cookie last?

__cf_bm typically persists for 30 minutes. The exact lifetime can vary with the site's configuration and the version of the script that sets it.

Who sets the __cf_bm cookie?

__cf_bm is set by Cloudflare. It is categorised as necessary.

How do I block or delete the __cf_bm cookie?

Visitors can delete __cf_bm at any time through their browser's cookie settings. Site owners can keep it blocked until consent with a consent management platform: Kukie.io's auto-blocking holds necessary cookies back until the visitor opts in.