What is the cf_clearance cookie?
Stores proof that a Cloudflare security challenge (CAPTCHA/JS) was passed, so the visitor is not re-challenged. Security/necessary.
Strictly necessary No consent needed
| Cookie name | cf_clearance |
|---|---|
| Set by | Cloudflare |
| Category | Strictly necessary |
| Typical duration | 1 year |
| Domain | first-party |
| Consent required? | No — strictly necessary |
Does cf_clearance need consent?
No. cf_clearance is treated as strictly necessary — it exists so the site can function securely (sessions, security or fraud prevention), not to track you across the web. Strictly necessary cookies are exempt from the consent requirement under ePrivacy, so a site may set cf_clearance without asking first. It should still be listed in the site's cookie policy.
Is cf_clearance a tracking cookie?
Required for the site to work — sessions, security, load balancing, cart state. Exempt from consent under ePrivacy.
How to see and remove cf_clearance
- See it: open your browser's developer tools → Application (Chrome/Edge) or Storage (Firefox) → Cookies, and look for
cf_clearance. - Remove it: clear cookies for the site, or use your browser's "Clear browsing data" for cookies. It will reappear if you keep using the site and consent is in place.
- Stop it being set: decline non-essential cookies on the site's banner. On a compliant site, clicking "Reject all" prevents non-essential cookies (this one is necessary, so it may still appear).
Want to know which cookies your site sets — and whether any fire before consent? Scan it free and get the full list, categorised, with the ones that load too early flagged.
Fixing pre-consent cookies
If a scan shows tracking cookies loading before the visitor consents, the fix is a consent management platform (CMP) that blocks non-essential tags until the visitor agrees. Cookies.ie is our GDPR / ePrivacy CMP — EU-hosted, with a real one-click "Reject all" and consent logging. See the fix guide for pre-consent trackers.
Related cookies
__cf_bm— Cloudflare__stripe_mid— StripePHPSESSID— PHP (generic)JSESSIONID— Java / Jakarta (generic)
Cookie purposes and durations reflect vendor documentation and common consent databases as of 2026-06-25; a specific site may configure cf_clearance differently. This is general information, not legal advice.