They could, but they'd need to take CloudFlare to court or similar to force them to disclose that information. Or drop them as a customer.