Even just transferring is not allowed without consent. And if you are the "controller" (ie. you are using Cloudflare to serve your customers) you would take the

Even just transferring is not allowed without consent. And if you are the "controller" (ie. you are using Cloudflare to serve your customers) you would take the fine, not Cloudflare. And IP and email are PII.