Dave, below is correct. If Cloudflare places cookies on your behalf, you need to ask for consent. Most likely, you can group it as essential. If you use it for analytical purposes, you need to classify it accordingly.

No need to show a cookie banner if you are not placing cookies or trackers. But now that AB 2426 has become law, it moves more in line towards GDPR in terms of transparency. E.g. you have to be transparent of using licenses etc.

What I really like about this new law is that it makes (or should make) it easier to unsubscribe. Just Google how difficult it is to unsubscribe several major SaaS players, like e.g. Semrush on SEO. Good luck being compliant to AB 2426 with that 6-10 step!