Cloudflare says it will "never sell your data." Technically true -- they don't sell it. They trade it. The 1.1.1.1 address came from APNIC, the Asia-Pacific internet registry, under a research deal: Cloudflare gets the memorable IP address, APNIC gets DNS query data including every domain name resolved, query type, and resolver location. Cloudflare strips your IP address before sharing. But the entire service exists because of a data-for-infrastructure swap. "Privacy-first" has a footnote, and the footnote is a research agreement. Cloudflare told the world: no IP addresses are ever written to disk. An independent auditor found otherwise. KPMG discovered that Cloudflare's network monitoring samples 0.05% of all packets -- and those samples include the IP addresses of DNS queries. Written to disk. Cloudflare also said logs are wiped within 24 hours. Actually 25 hours. And some "anonymized" data? Kept forever. The audit passed because the overall system was privacy-respecting. But Cloudflare's specific claims -- "never" and "24 hours" -- were both wrong.
What they claim: Cloudflare markets 1.1.1.1 as "the Internet's fastest, privacy-first consumer DNS service" that "will never sell your data."
What we found: Cloudflare obtained the 1.1.1.1 IP address from APNIC under a research agreement in which Cloudflare shares DNS query data -- including query names, query types, resolver location, and other metadata -- with APNIC Labs for "non-profit operational research." The agreement has an initial five-year term with renewal. APNIC may publish aggregated analysis at any time and share research data 12 months after receipt. Cloudflare strips client IPs before sharing, but the foundation of the "privacy-first" DNS service is a data-sharing arrangement. The address itself was the price for the data.
What they claim: Cloudflare stated that "no querying IP addresses are ever written to disk" and that "all logs are wiped within 24 hours."
What we found: The KPMG privacy audit discovered that Cloudflare's Netflow/Sflow network-wide monitoring retains 0.05% of all packets passing through their network, including the IP addresses of DNS queries -- contradicting the claim that no IPs are written to disk. The audit also found that logs are actually wiped within 25 hours, not 24, and that some anonymized data is retained indefinitely with no expiration date. The audit passed overall, but the specific discrepancies between marketing claims and observed practice were documented in the public report.
What they claim: Cloudflare positions 1.1.1.1 as secure and trustworthy, supporting DNS-over-HTTPS and DNS-over-TLS to prevent query interception.
What we found: From February 2024 to August 2025, Fina CA issued 12 TLS certificates for the 1.1.1.1 IP address without Cloudflare's authorization. Security researcher Youfu Zhang reported the issue publicly on Mozilla's dev-security-policy mailing list in September 2025. An attacker with both an unauthorized certificate and its private key could have impersonated Cloudflare's resolver. Mozilla, Google, and Apple confirmed their browsers do not trust Fina's certificates, but Microsoft acknowledged the misissuance was valid in its trust store and began revocation. Separately, 1.1.1.1 was BGP-hijacked in July 2024 and July 2025, briefly routing queries through unauthorized networks.
What they claim: Cloudflare has repeatedly stated it is a neutral infrastructure provider and should not make content moderation decisions: "The power to terminate security services for sites was not a power Cloudflare should hold."
What we found: Cloudflare terminated services for the Daily Stormer (2017), 8chan (2019, after the El Paso shooting that killed 23 people), and Kiwi Farms (2022, after trans streamer Clara Sorrenti's #DropKiwiFarms campaign and at least three suicides linked to Kiwi Farms harassment). CEO Matthew Prince initially defended 8chan, saying he had a "moral obligation" to keep it online. Cloudflare defended Kiwi Farms for three days before reversing. After each termination, Cloudflare published what critics called an "apology to the internet" and reported that authoritarian regimes began citing Cloudflare's own language to demand removal of human rights websites.
What they claim: Cloudflare commits to "never sell your data" and states data retention is minimal and time-limited.
What we found: Cloudflare's privacy policy permits indefinite retention of "anonymized" DNS query data with no expiration. Research has repeatedly shown that anonymized datasets can be re-identified -- MIT researchers demonstrated that 4 data points can uniquely identify 95% of people in an anonymized dataset. DNS query patterns (which sites you visit, when, how often) are among the most fingerprint-able data types. Cloudflare also processes approximately 20% of all HTTP requests on the internet through its CDN and security services, governed by a separate, less restrictive corporate privacy policy. The DNS privacy promise applies to one product line within a company that sees a fifth of the internet.
What they claim: Cloudflare positions itself as a protector of the open internet and website operators
What we found: Cloudflare issued a September 2026 deadline requiring AI crawlers to separate search indexing from training data collection or face blocking. Cloudflare also reported more than 50% of web traffic is now non-human, and that human traffic to websites in finance, publishing, and retail dropped nearly 40% between June 2025 and April 2026. While protective of publishers, Cloudflare itself sits at the chokepoint — routing and inspecting traffic for millions of sites.
What they claim: The 1.1.1.1 app's privacy reputation is built on KPMG-audited DNS resolver commitments. The app prominently features WARP, encouraging users to enable it for "a better Internet."
What we found: When users enable WARP in the 1.1.1.1 app, all device traffic is routed through Cloudflare's network -- not just DNS queries. WARP collects installation IDs, data transfer volumes, average connection speed, and aggregate traffic by website and by region. The KPMG privacy audit covered only the DNS resolver, not WARP. The separate 1.1.1.1 Application Privacy Policy (which covers WARP) permits collection of metadata that the DNS-only policy does not. Users who trust WARP based on the DNS audit are trusting a product that was never audited.