As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of th

As a US-based company, they process (even if they don't store) the IP address. As such, the personal data of the EU users is transmitted under the control of the US Surveillance Act. No SCCs nor commercial contracts can shield this data. You might have a legitimate interest in processing the IP, but because of the aforementioned issues, you cannot provide sufficient controls nor protection of Personal Data. As such, using Cloudflare as your Data Processor, exposes You, the Data Controller, to DPA scrutiny. As always with GDPR/DPA and EU, whether it is illegal/non-compliant depends on each DPA. https://medium.com/@christhaefner/shopify-illegal-in-germany-4b7f61576aa3 https://medium.com/@christhaefner/shopify-illegal-in-germany...