WARP and Anonymity

Zero Trust WARP
1

Does WARP provide an anonymous browsing experience, preventing a website from tracking a user by IP address?

There appear to be contradictory statements by Cloudflare on this question. First, consider the following which imply that WARP hides the user’s original IP address…

Does WARP reveal my IP address to websites I visit?

  • No. 1.1.1.1 + WARP replaces your original IP address with a Cloudflare IP that consistently and accurately represents your approximate location. This happens regardless of whether the site is on the Cloudflare network or not.
  • Source: https://developers.cloudflare.com/warp-client/known-issues-and-faq
  • Date: Updated 1 month ago

1.1.1.1 + WARP: More features, still private

  • We just rolled out a major update to the service that powers WARP that will give you a geographically accurate browsing experience without revealing your IP address to the websites you’re visiting. Instead, websites you visit will see a Cloudflare IP address instead, making it harder for them to track you directly.
  • Source: https://blog.cloudflare.com/geoexit-improving-warp-user-experience-larger-network/
  • Date: 08/06/2022

Second, consider these apparently conflicting statements….

1.1.1.1 with WARP

  • WARP does not provide anonymity and is not designed to prevent servers you communicate with from identifying you.
  • Source: https://developers.cloudflare.com/warp-client/warp-modes/
  • Date: Updated 2 months ago

Why is my public IP address sometimes visible?

  • Cloudflare WARP Client in WARP mode was meant to ensure all your traffic is kept private between you and the origin (the site you are connecting to), but not from the origin itself. In a number of cases, if the origin site you are communicating with can’t determine who you are and where you’re from, they can’t serve locale relevant content to you. Sites inside Cloudflare network are able to see this information. If a site is showing you your IP address, chances are they are in our network. Most sites outside our network (orange clouded sites) however are unable to see this information and instead see the nearest egress colo to their server.
  • Source: https://developers.cloudflare.com/cloudflare-one/faq/teams-devices-faq
  • Date: Updated 1 day ago

So, what is the definitive answer to this question: Does WARP provide an anonymous browsing experience, preventing a website from tracking a user by IP address?

Thank you.

4

I’m also interested in exactly this matter. Searching yielded nothing, save for a variety of fanboys spouting nonsense they picked up without knowing squat.

Only cloudflare can properly (and easily) answer this.
But CF has not done so, despite questions about this going back to day 1.

While the routing and resulting subjective speed are nice, if we don’t know how privacy is handled and can’t rely on consistent behavior, it’s a useless proposition.

I’d also appreciate explicit statements regarding logging. The generic privacy policy is unclear, and searches yield similarly contradictory statements as provided above. Some people claim to have received DMCA notices stating CF forwarded their info.

I also cannot find details on ‘acceptable use’. I assume since streaming is mainstream and CF is rich beyond imagination, they don’t really care about traffic. Explicit statements would be helpful nonetheless, and prevent random blocklisting of accounts. Some posts claim CF banned them randomly.

Thank you!

5

Could it be the case that the consumer version of WARP provide an anonymous browsing experience - but, not the enterprise version?

I examined this possibility and, as far as I can determine, the conflicting statements by Cloudflare cannot be explained by a “consumer” versus “enterprise” distinction, unfortunately. For example, the parent webpage containing the statement “WARP does not provide anonymity and is not designed to prevent servers you communicate with from identifying you” says “This documentation is for the consumer version of WARP.”

Thus, my confusion remains…

6

The question of interest in this thread is elementary: Does WARP provide an anonymous browsing experience, preventing a website from tracking a user by IP address?

The problem is not that Cloudflare has failed to provide an answer. Instead, the problem is that multiple conflicting answers have been provided.

Is there a mechanism to contact a Cloudflare subject matter expert (e.g., Mari Galicer, Product Manager, Consumer Privacy) and request clarification on this fundamental facet of WARP? (Thank you.)