Actually you are breaking GDPR rules because you are transfering personal information (the users IP) to cloudflare.