The News, Explained
On October 22, 2026, Cloudflare announced its South Korean Information Security Management System, or ISMS, certification and explained the account-signup process for Korean users. The visible change separates consent into three required items and one optional item, with a link to the full text of each. Source
The choices needed to create an account and the choice affecting marketing are separated below. Cloudflare says the signup button becomes active only after all three required items are affirmatively checked. Leaving the optional item unchecked still allows account creation and opts the user out of marketing communications. Source
| Consent item | Status | Effect during signup |
|---|---|---|
| Terms of service | Required | Consent before account creation |
| Collection and use of personal information | Required | Consent before account creation |
| Transfer of a limited amount of personal information overseas | Required | Consent before account creation |
| Sharing a limited amount of personal information with third parties | Optional | Marketing consent; signup can proceed without it |
Creating a Cloudflare account through an outside identity provider is connected to that design. The Google, Apple and GitHub social-signup paths ordinarily authenticate users elsewhere and return without displaying Cloudflare’s consent form. The company says it does not offer those new-account paths in South Korea, directing account creation through its own form with the required consents. The announcement concerns creating a new account. Source
The Korean form uses both IP geolocation and the country selected by the user. IP geolocation estimates a country from the internet address and chooses the initial form. The country selected during signup overrides that default. Cloudflare says this separates where a connection originates from where a user resides. Reading the selected country alongside the consent items therefore explains more about the process than the display language alone. Source
The announcement date and the certificate’s validity period also differ. KISA’s public register lists Cloudflare, Inc. under ISMS-KISA-2026-136, valid from September 2, 2026, through September 1, 2029, and currently maintained. October 22 is the date of this announcement; the registered certification period starts in September. Source Source
ISMS assesses an organization’s system for managing information security. The registered scope covers infrastructure and operations for providing the Cloudflare Connectivity Cloud service, excluding physical infrastructure that was not assessed. Cloudflare describes coverage through the boundary of the organizations, platform and information flows delivering the service, rather than a list of individual product names. Reading the actual scope together with its exclusions makes that coverage more specific. Source Source
OYOPICK’s Take
We welcome a consent screen that lets people assess the requirements for account creation separately from marketing. Even with an agree-to-all option, clear consequences for each item can help users decide which messages they want while meeting the account’s requirements. We would like the explanation that signup remains available without marketing consent to appear close to that choice on screen.
Removing an outside-account signup path leaves a design task involving both convenience and meaningful consent. If Cloudflare expands its signup options, a useful approach would preserve the required choices while reducing repeated data entry. We would also like product information to connect clearly to certificate validity and scope exclusions. That could help users assess their signup choices and the basis for trusting a service with the relevant evidence for each.