Cloudflare Turnstile is a CAPTCHA alternative that website operators embed to verify that visitors are human. It runs small, non-interactive JavaScript challenges in the browser, such as proof-of-work puzzles and checks of web APIs and browser behaviour, and adjusts difficulty per request so that most visitors see no puzzle. Widgets are available in managed, non-interactive and invisible modes. Turnstile can be used without routing a site's traffic through Cloudflare's CDN. It is delivered as a hosted widget with server-side verification.
Cloudflare, Inc. is a publicly listed company headquartered in San Francisco, so the service is subject to US law, including the CLOUD Act. Turnstile collects signals such as the client IP address, TLS fingerprint and User-Agent header; Cloudflare states that it does not access page inputs or form entries and cannot directly identify individuals from these signals. The documentation does not say where data is processed, and no self-hosted variant is offered. European organisations should review the Turnstile privacy addendum before use.