Cloudflare RUM Beacon

Cloudflare's Real User Monitoring (RUM) beacon powers Web Analytics by collecting performance and usage data from your visitors. By default, Cloudflare injects this beacon at the edge — meaning the script is added to your pages before they reach the browser, outside the control of your website's code and your Consent Management Platform (CMP).

Because the beacon loads before your client-side CMP can execute, consent preferences cannot be applied to it while automatic injection is enabled. To bring the RUM beacon under consent management, you must disable automatic injection and load the script yourself, then manage it like any other tag or script.

Manage It Like Any Other Script

Once you disable automatic injection, the Cloudflare RUM beacon becomes an ordinary third-party script. You can manage it with ScriptControl or Google Tag Manager, the same way you manage any other Performance or Marketing tracker.

Switch to Manual Deployment

First, disable Cloudflare's automatic injection and copy the beacon snippet so you can deploy it yourself.

1. Log in to your Cloudflare Dashboard.
2. Navigate to Analytics & Logs > Web Analytics.
3. Find your domain and select Manage Site.
4. Expand Advanced Options.
5. Toggle off JS Snippet injection (or select Disable automatic setup and manually install JS Snippet).
6. Copy the JavaScript snippet provided in the dashboard. It will look similar to the following:

<!-- Cloudflare Web Analytics -->
<script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token": "YOUR_ACTUAL_TOKEN"}'></script>
<!-- End Cloudflare Web Analytics -->

Hand Control to Your CMP

With automatic injection disabled, deploy the copied snippet through one of the following methods so consent preferences are applied before the beacon loads.

Script Tag Manipulation

If you embed the snippet directly in your site's source code, use DataGrail's ScriptControl plugin to gate it behind consent. Reformat the script to use type="text/plain" and add the data-consent-id attribute for a custom service you create in DataGrail Consent.

For the full setup, follow the steps in Managing Inline Scripts.

Custom HTML via Tag Manager

If you manage your CMP through Google Tag Manager or a similar tag management system, deploy the beacon as a tag that fires only after consent is granted.

1. Create a new Custom HTML Tag.
2. Paste the raw, unaltered Cloudflare snippet into the tag.
3. Set the tag to trigger based on consent — manage it under the Performance or Marketing category in your consent management tool.

Technical Considerations

Keep the following in mind when managing the Cloudflare RUM beacon through consent.

Do not block the /cdn-cgi/rum endpoint

The RUM beacon sends data back to your own domain through a hidden proxy path (https://yourdomain.com/cdn-cgi/rum). Do not block this path in your firewall or Cloudflare WAF. Blocking it causes 404 or 503 errors for visitors who have already granted consent.

Single Page Applications (SPAs)

If your site is a single page application, the delayed script tracks the initial page load once consent is granted. Subsequent virtual page changes may require you to re-trigger the script or use a custom router binding. See Single Page Applications for related guidance.

DataGrail Privacy Inspector

Install the DataGrail Privacy Inspector Chrome extension to confirm the Cloudflare beacon does not load until consent is granted.