Why Cloudflare Does Public Policy
When Cloudflare talks about building a better Internet, it isn't just about technology. The company's view is that the Internet's future is shaped as much by governments, regulations, and people as by code and infrastructure. If the goal is a better Internet, the company needs to be present where those decisions are made. That means having a public policy function that reflects Cloudflare's core values and unique position in the market.
This is particularly important now, when many jurisdictions are drafting and passing laws with wide-ranging consequences for the Internet, covering everything from content moderation to stricter cybersecurity requirements. The company's belief is that there is value in helping governments understand how tech companies work, while also helping its own employees understand how lawmakers and regulatory bodies operate.
Three Values, One Approach
Cloudflare's public policy strategy is built on the same three values that guide its engineering and business decisions:
- Principled: Being thoughtful, consistent, and focused on the long-term when deciding what the right course of action is.
- Curious: Tackling big challenges and digging into the "why" and "how" behind them.
- Transparent: Communicating clearly, both internally and externally, about how and why decisions are made.
Those principles map directly onto policy work. The team prioritizes issues deliberately and sticks with a stance once it is taken. It seeks to understand the different points of view in global debates about the Internet, rather than just its own. And it tries to be public about its positions, through blog posts, comments to public consultations, and conversations with lawmakers and industry peers.
A Distinct Perspective
Cloudflare's scale gives it a broad perspective. With roughly 20 percent of websites on its network—including free tier users—its customer base spans Fortune 1000 companies, hobbyist developers, and small business sites. The company's business model relies on economies of scale and selling additional services on top of entry-level cybersecurity protection.
That model is important because it means Cloudflare's policy view is not the same as that of other cybersecurity firms or big tech companies. It is defending the interests of large enterprises and individual site owners at the same time. Because the business model is unusual, its perspective on policy often is too.
Picking Battles
Cloudflare admits it does not have the resources of the Internet giants. It has to choose its issues carefully. The filter for engagement is a two-step test:
- Does the policy have a significant impact on Cloudflare's own operations, business model, or incentive to provide strong cybersecurity?
- Is Cloudflare's perspective on that issue dramatically different from what other companies in the industry are saying?
If the issue matters but the company’s view matches the rest of the sector, it passes. Corporate tax rates, for example, may affect the business financially, but Cloudflare does not claim a unique angle on tax policy, so that is off the list. Privacy, on the other hand, is a place where Cloudflare says it has a distinct voice, given its focus on privacy by design and its work on standards that support privacy on the Internet. Its global network also offers a vantage point that yields data and insight that can be useful in educating policymakers.
How Engagement Happens
The Public Policy team is staffed with people from government, law firms, and the tech industry. The relationships and expertise they bring are what get Cloudflare a seat at the table. The company does not run a Political Action Committee and makes no political contributions.
Even with a focused agenda, no single company can track every relevant policy development. Cloudflare therefore belongs to a range of trade associations and coalitions. Some represent broad industry groups, like software firms or US-based technology companies, and cover a wide menu of issues. Others are focused on narrower policy subjects.
Beyond formal memberships, Cloudflare will also join ad-hoc coalitions of companies and civil society groups for specific advocacy goals. It periodically works with the Stronger Internet coalition, which shares information on policies about encryption, privacy, and free expression globally.
In line with its stated commitment to transparency, the company complies with all relevant advocacy rules in jurisdictions where it operates and appears in government transparency registers where they exist. Cloudflare has also published an overview of the organizations it works with on its website.
