Docs
Privacy: what the tag sends
The data PubTrust handles about your readers, field by field, and where each safeguard is enforced.
What does a beacon contain?
Every beacon carries the Site's tag key, the tag build, the page URL (its first 1,000 characters), the referrer (its first 500), the Site's sampling rate and a timestamp. A violation beacon adds, per violation: whether it was flagged or blocked, the policy, pack, layer and severity, the rule kind, the matched value and its language, the accumulated weight, the declared advertiser domain, creative ID, bidder, size and slot ID, the unwrapped landing URL, up to eight hosts the creative referenced, the decision time in milliseconds, and layer-specific detail such as which runtime signal fired. A summary beacon adds exact counts for the page view — impressions, violations, blocks and errors, with violations broken down by policy — and a small sample of clean impressions carrying only advertiser domain, creative ID, bidder, size and slot ID.
What does the tag never collect?
- No cookies. The tag neither sets nor reads any.
- No
localStorage,sessionStorageor IndexedDB. - No fingerprint and no user or device identifier of any kind.
- No keystrokes or form data. Keyboard and pointer events are observed only to timestamp genuine gestures; what was typed or clicked is never read or sent.
- No IP address in the payload. The address is seen only by the edge that receives the request, and is truncated there.
- No screenshots from a reader's browser. Creative capture, where it happens, is server-side.
How are IP addresses truncated?
At the Cloudflare edge, before an event is queued. The Worker that receives a beacon takes the connecting address from CF-Connecting-IP and, under the default policy, keeps only the network part: the last octet of an IPv4 address is zeroed, leaving a /24, and an IPv6 address is cut to its first three groups, a /48. The full address is never queued, never reaches our application servers and is never written to the database.
| Organisation IP policy | What is stored |
|---|---|
truncated (default) | IPv4 /24 or IPv6 /48. |
full (opt-in) | The full address, only after explicit acknowledgement by the organisation, and deleted after at most 30 days by the retention job regardless of plan. |
none | No IP address at all. |
What does the edge add?
Geography and network context from Cloudflare's own request properties, so nothing is trusted from the browser and no GeoIP database is shipped: country, region, city, ASN, network operator and the Cloudflare data centre that received the request, plus browser family, operating-system family and a coarse device class — desktop, mobile, tablet or connected TV — derived from the User-Agent. Beacons whose origin is not a domain registered to the Site are discarded at the edge.
How long is it kept?
Violations are kept in full for 90 days. Clean-impression detail — the sample — is kept for 30 days, while every impression is counted in aggregate rollups, which are kept indefinitely for trends and billing and contain no IP addresses. Full IP addresses, where an organisation has opted in, are deleted after at most 30 days. Raw events are stored in daily partitions, so expiry drops whole partitions rather than relying on a delete job keeping up.
The legal position — roles, lawful basis, sub-processors and your rights — is in the Privacy Policy and the sub-processor list. The product's wider security posture is on Security & Privacy.