Prevent cross-site tracking in Safari breaks Cloudflare challenges

“Prevent cross-site tracking” is a Safari privacy setting, enabled by default. When “Prevent cross-site tracking” is enabled, Cloudflare challenges require an extra step, to manually click “Verify you are human.” This extra step is not required when “Prevent cross-site tracking” is disabled, nor is it required at all in Chrome or Firefox. Here is a Cloudflare challenge demo you can try: https://sergiodemo.com/security/challenge/managed-challenge In Chrome and Firefox, as well as in Safari with “Prevent cross-site tracking” disabled, the Cloudflare demo result page (which is actually a 404) loads automatically without having to click “Verify you are a human” first. I’ve reproduced this behavior on two different Macs. I don’t use iCloud Private Relay and indeed don’t even have an iCloud+ subscription. Note also that I disabled all Safari extensions for my tests. The issue does not appear to be caused by blocking third-party cookies in Safari, because the issue does not occur in Chrome…