Cloudflare Turnstile now demands WebGL — and your fingerprint

What happened

A detailed write-up by hacktivis.me, climbing past 270 points on Hacker News, documents that Cloudflare's Turnstile widget — the 'privacy-first' CAPTCHA replacement Cloudflare has been pushing since 2022 — now silently requires a working WebGL context to return a successful token. Disable WebGL in `about:config` (`webgl.disabled = true`), block it via NoScript, run a browser that ships without WebGL by default, or use a hardened Tor Browser profile, and Turnstile fails. Not 'shows a challenge.' Fails. The user sits in an infinite spinner or gets a generic error, with no fallback path.

The author traces the regression by stepping through Turnstile's obfuscated JavaScript and confirms the widget calls `getContext('webgl')`, reads renderer strings, and uses the result as part of its scoring signal. WebGL renderer strings are one of the highest-entropy fingerprinting vectors in a browser — the EFF's Panopticlick data has flagged them as uniquely identifying for years, which is exactly why privacy-focused browsers expose a knob to turn them off. Cloudflare's own marketing for Turnstile, still live on their site, claims it 'preserves user privacy by avoiding the collection of personal data' and is a 'better alternative to traditional CAPTCHA solutions like reCAPTCHA.'

The HN thread surfaces corroborating reports from users of LibreWolf, Mullvad Browser, Pale Moon, and Firefox with `resistFingerprinting=true`. A Cloudflare engineer responded in the thread acknowledging WebGL is 'one of many signals' but did not commit to a non-WebGL fallback. The post-mortem subtext is that the silent shift happened sometime in the last several months — older Turnstile deployments worked without WebGL — and there was no changelog entry.

Why it matters

The whole premise of Turnstile was rhetorical jiu-jitsu against Google: reCAPTCHA was creepy, opaque, and trained Google's ML for free; Turnstile would be the polite alternative. The actual delta turns out to be that Cloudflare collects the fingerprints instead of Google, and routes the policy decision through a vendor that already terminates TLS for roughly 20% of the web. That's not a privacy win. That's a centralization of the fingerprinting surface from one ad company to one CDN.

The technical defense — 'WebGL is just one signal' — collapses under inspection. If WebGL were genuinely optional, disabling it would degrade your score, not zero it. The reported behavior is binary: no WebGL, no pass. That's a hard dependency dressed up as a soft one. And the renderer string isn't passive entropy; it leaks GPU model, driver version, and ANGLE backend, which is enough to fingerprint a residential user across sessions even with cookies cleared. Mozilla's own anti-fingerprinting docs name WebGL as a top-three surface, alongside Canvas and AudioContext.

There's a second-order cost that practitioners feel directly. Every site that drops Turnstile in front of a signup form — and there are a lot of them, because the free tier and the 'no Google' optics made it the default for indie SaaS — now silently breaks for the subset of users most likely to be technically literate and most likely to file bug reports: privacy-tooled developers, journalists, security researchers, people on alternative browsers. You can't run a customer-support queue full of 'I can't sign up' tickets from people who won't tell you why, because they're using LibreWolf and aren't about to enable WebGL to prove they're human. The failure mode is invisible to product analytics and visible only in churn.

Compare this to hCaptcha, which has its own problems but at least documents a non-JS accessibility cookie flow, or to proof-of-work challenges like Anubis (gaining traction with FOSS projects like GNOME and SourceHut) which are explicit about the trade: a few hundred milliseconds of CPU instead of a behavioral profile. Turnstile occupies a worse position than either — it pretends to be the privacy option while behaving like the fingerprinting one.

What this means for your stack

If you've shipped Turnstile, audit it. Specifically: pull a LibreWolf or hardened Firefox build, disable WebGL, and try to sign up. If the flow dead-ends, you have an accessibility regression you didn't ship and weren't notified about. The honest options are (1) accept the fingerprinting and document it in your privacy policy, (2) move to a proof-of-work challenge like Anubis or mCaptcha and eat the latency, or (3) gate only high-risk actions behind a challenge and use rate-limiting plus email confirmation for the rest. The 'just drop in Turnstile' default is no longer free of trade-offs; it has the trade-offs, you just can't see them.

For anyone running compliance-adjacent surfaces — anything touching GDPR, CCPA, or the upcoming EU AI Act's transparency requirements — 'we use Turnstile because it's privacy-preserving' is a claim you can no longer make in good faith without a footnote. The DPIA your legal team signed off on probably cited Cloudflare's marketing. That marketing is now contradicted by the implementation. Update the document or change the vendor.

There's also a supply-chain angle. Turnstile is now de facto required infrastructure for a meaningful fraction of the web, deployed by sites that have no contractual relationship with Cloudflare and no way to influence its behavior. A silent change to a hard requirement, with no version pin and no opt-out, is the exact failure mode the npm/left-pad discourse was supposed to have taught us about a decade ago. The CDN-as-runtime pattern means your auth flow can break because a vendor shipped a Tuesday update.

Looking ahead

The useful read here isn't 'Cloudflare bad' — it's that the CAPTCHA market has no honest winners, only different tax collectors, and 'privacy-preserving bot detection' is mostly a marketing category. The next 12 months will likely see real movement toward proof-of-work and attestation-based approaches (Private Access Tokens on iOS, Privacy Pass) which at least make the trade-off legible. Until then, the practitioner move is to assume any CAPTCHA you embed is a fingerprinting surface, design your funnel to tolerate users who can't or won't pass it, and stop treating Cloudflare's 'privacy-first' label as load-bearing.