Cloudflare Web Analytics is a free, privacy-first, cookieless product that counts page views and visits from a lightweight JavaScript beacon, while Google Analytics 4 (GA4) is a cookie-and-event product built for attribution, audiences, and advertising. Because one declines to use any client-side identifier and the other is engineered around them, the two will never report the same "visits" or "users" for the same site. That is not a configuration error. It is the direct result of two different collection models, and knowing which one you're reading tells you which question it can honestly answer.
What each one actually collects
Cloudflare Web Analytics is real-user monitoring (RUM). It loads a small JavaScript snippet that reports to the /cdn-cgi/rum/ endpoint when a page finishes loading and again when the visitor leaves, and the company states plainly that it does not "use any client-side state (like cookies or localStorage) for analytics purposes" and considers fingerprinting "even more intrusive than cookies" (Cloudflare blog, Cloudflare Web Analytics FAQ). Without a persistent identifier, it counts a visit as a page view whose referrer is a different site, rather than by stitching requests to a returning person (Cloudflare blog). Anyone can sign up "even without changing your DNS settings," so it is not gated behind being a Cloudflare network customer (Cloudflare blog).
One distinction trips people up: this free RUM product is not the same as Cloudflare's edge/zone analytics. Edge analytics are derived from traffic Cloudflare proxies at its network and "cannot be blocked because we can measure every request that is received," whereas Web Analytics "only displays client-side analytics" from the beacon (Cloudflare Web Analytics FAQ). The free dashboard most founders mean by "Cloudflare Analytics" is the beacon-based one.
GA4 also runs a JavaScript tag, but its model is different in kind. It records discrete events — and automatically captures interactions like scrolls, outbound clicks, and site searches through enhanced measurement (Google Analytics Help). It groups events into sessions (Google Analytics Help), can use cookies plus a User-ID to recognize the same person across visits and devices (Google Analytics Help), and can activate Google signals to attach demographics and cross-device data from signed-in Google users for ads and audiences (Google Analytics Help). That identity layer is what powers attribution and remarketing — and it is exactly what Cloudflare deliberately omits.
Why the numbers diverge
Three structural gaps explain most of the disagreement, and none of them mean either tool is wrong.
Cookies versus cookieless. GA4 deduplicates returning visitors with stored identifiers, so its "users" approximates distinct people. Cloudflare, having no identifier, reports visits and page views and does not claim to resolve unique humans the same way. A site with lots of repeat visitors will show a different shape in each.
Both need JavaScript, but ad blockers hit Google harder. Each product requires the page's script to run, so neither sees a visitor with JS disabled. The asymmetry is what gets blocked: privacy extensions and tracker-blocking lists target Google's analytics and advertising endpoints far more aggressively than a generic first-party beacon, and browser controls such as Safari's Intelligent Tracking Prevention cap the lifetime of client-side cookies that GA4 leans on. Cloudflare's own pitch is that being privacy-first and free of third-party tracking makes the beacon less likely to be stripped (Cloudflare blog).
Sampling and modeling. It is a myth that Cloudflare never samples — it does, just not the way GA4 does. Cloudflare keeps unsampled beacon data for the past 7 days, then aggregates down to roughly 10%, and at query time applies dynamic sampling "between 0.0001% and 100%" depending on filters and data volume (Cloudflare Web Analytics FAQ). GA4, by contrast, controls how long it retains event-level data for exploration (Google Analytics Help) and applies privacy thresholding that can suppress or fold low-volume rows into an "(other)" bucket, especially once Google signals is on (Google Analytics Help). Two different reduction methods on two different identity models will not converge on the same integer.
Use Cloudflare for one job, GA4 for another
Reach for Cloudflare Web Analytics when the question is how much real traffic is my site getting, fast, free, and without a cookie banner debate. It installs in minutes, needs no consent UI for cookies because it sets none, and gives a clean read on page views, top pages, referrers, and countries. Reach for GA4 when the question is which channel and campaign drove this, who are these audiences, and how do touchpoints combine — attribution, conversions, audiences, and Google Ads integration are the entire reason GA4 carries its complexity.
Be honest about the ceilings of each. Cloudflare gives you no event funnels, no conversion attribution, and no cross-device user stitching, by design. GA4 gives you all of that but at the cost of consent obligations, thresholded reports, modeled gaps, and a number that shifts as policies and signals change.
Where owned events fit
Both tools live in someone else's pipeline and can be throttled by a blocker, a browser setting, or a vendor policy you don't control. The durable anchor is the events you record on your own endpoint — a real signup, a real purchase — captured first-party as the number you reconcile against. Treat Cloudflare as a low-friction traffic gauge and GA4 as your attribution lens, but keep one owned, portable source of truth so that when the two dashboards disagree, you already know which figure is yours.