One post tagged with "privacy"

Short answer: beacon.min.js is Cloudflare's Real User Measurement script. If your domain is on a free Cloudflare plan and proxied through them (the orange cloud), Cloudflare has been injecting it into your HTML by default since September 2025 — you did not add it, it is not in your repo, and it arrives before your page reaches the browser. Paid plans are opt-in only. You turn it off in Analytics & Logs → Web Analytics → Manage Site → Advanced Options → JS Snippet injection.

Two things are worth separating here, because the thread that put this on the front page of Hacker News this week mixed them together:

1. The GDPR panic is mostly overstated. The default configuration excludes EU visitor data. Cloudflare's own words, from the thread: "we will not collect any RUM metrics from traffic that passes through our European and UK data centers."
2. The consent problem is real anyway, and it is a different problem. The beacon is injected at the edge, so it lands on the page before your consent management platform gets to run. There is nothing for your CMP to gate. That is true regardless of who the visitor is.

I run a hosting company, so treat me accordingly — I have an obvious interest in you thinking hard about what your platform does to your bytes. That is exactly why I want to be careful with the facts rather than loud about them.