FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

Adyen

Essential

Adyen is a Dutch licensed bank and one of the largest enterprise payment platforms in the world, with European headquarters in Amsterdam. It processes payments for merchants such as Spotify, Uber, Booking.com, eBay and Microsoft. Adyen runs its primary infrastructure in the EU; the hosted checkout sets only strictly necessary first-party cookies for fraud prevention.

Block Adyen until consentScan my site
Overview

What does Adyen do?

What is Adyen?

Adyen is a Dutch payment platform founded in 2006 in Amsterdam. It received a banking license from the European Central Bank in 2017 and is regulated as a credit institution. Adyen offers a single platform for online, in-store and in-app payments and is widely used by enterprise merchants such as Spotify, Uber, Booking.com, eBay and Microsoft. Merchants integrate Adyen via the Drop-in component, the Components SDK, hosted payment pages or the API.

Cookies and data collected

Adyen processes payment data submitted by the customer (card number, account details, billing address, IP), risk signals required for fraud prevention and SCA, and metadata sent by the merchant. On the Adyen hosted checkout, only strictly necessary first party cookies are set: a session cookie, a CSRF token and a small risk score cookie. No advertising or behavioural cookies are deployed by Adyen itself.

GDPR and ePrivacy implications

For the cookies set on the Adyen checkout, the strict necessity exemption of Art. 5(3) ePrivacy applies, so no consent banner is required to render the Adyen payment page. Payment data is processed under contract performance (Art. 6(1)(b) GDPR) and AML / PSD2 record keeping is processed under legal obligation (Art. 6(1)(c)). The merchant must still mention Adyen as a processor in its privacy policy and sign the Adyen DPA.

Data transfers and hosting

For European merchants, Adyen processes data on EU infrastructure operated by Adyen N.V. and Adyen Issuer N.V. International merchants may use additional regional data centres; transfers in those configurations rely on Standard Contractual Clauses included in the Adyen Data Processing Addendum. Card scheme communication with Visa, Mastercard or international wallets remains under Adyen's controllership and is governed by the card scheme rules and PSD2.

Practical compliance steps

Sign the Adyen Data Processing Addendum from your Customer Area. Add Adyen to the list of processors in your privacy notice with the EU hosting and PSD2 context. Configure SCA and risk rules to comply with PSD2. Use the hosted checkout or Drop-in to limit your PCI DSS scope. Define a retention period for transaction metadata aligned with your AML and tax obligations.

Compliance

Adyen and the GDPR

Legal basis
Contract performance (Art. 6(1)(b) GDPR) for processing payment data necessary to complete a transaction. Legal obligation (Art. 6(1)(c)) for AML, PSD2 and tax record keeping. Cookies on the Adyen hosted checkout are strictly necessary and exempt from consent under Art. 5(3) ePrivacy.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive 2002/58/EC, PSD2, AMLD5, Dutch Wft, EBA RTS for SCA, PCI DSS

Impact assessment (DPIA)

A DPIA is generally not required for standard online payment use of Adyen. It may become relevant for very large merchants combining tokenisation, cross border acquiring and extensive risk profiling.

Sample text for your banner

Payments on this site are processed by Adyen (Adyen N.V., Netherlands), a licensed EU bank. Your payment data is handled under PSD2 and the GDPR. See our privacy policy for details.
Cookies and trackers

What Adyen sets and contacts

Tracking method
server side payment processing with hosted payment pages or Drop-in / Components SDK; first party session and risk cookies on the Adyen hosted checkout
Server location
European Union (Adyen N.V., Amsterdam, with primary EU data centres in the Netherlands; additional regions for global merchants)
Cookieless mode available
Yes

Cookies set (3)

NameTypeDurationPurpose
JSESSIONIDfirst_partySessionStrictly necessary session cookie used to maintain the customer session on the Adyen hosted checkout while a payment is in progress.
CSRF-TOKENfirst_partySessionCSRF protection token used to validate the payment form submission on the Adyen hosted checkout.
_dvffirst_party30 minutesStrictly necessary device fingerprint cookie used by Adyen for fraud prevention during the transaction.

Third-party domains contacted (4)

  • www.adyen.com
  • checkoutshopper-live.adyen.com
  • checkoutshopper-test.adyen.com
  • checkoutanalytics-live.adyen.com
Questions

Frequently asked questions about Adyen

Can't find your question? Write to us, we answer fast.

What cookies does Adyen set?

On the Adyen hosted checkout only strictly necessary first party cookies are set: a session cookie (JSESSIONID), a CSRF protection token (CSRF-TOKEN) and a small device fingerprint cookie (_dvf) used for fraud prevention during the transaction. Adyen does not set advertising or behavioural cookies.

Do I need consent to use Adyen on my website?

No banner is required to display the Adyen hosted checkout because the cookies in question are strictly necessary under Art. 5(3) ePrivacy. The merchant does need consent for any optional Adyen marketing component or third party tracker added on its own pages.

What is the legal basis for processing payment data through Adyen?

Contract performance (Art. 6(1)(b) GDPR) for the data necessary to complete the transaction. Legal obligation (Art. 6(1)(c)) for AML, PSD2 and tax record keeping. Strictly necessary cookies on the Adyen checkout rely on Art. 5(3) ePrivacy.

Does Adyen transfer data to third countries?

For European merchants Adyen processes data on EU infrastructure operated by Adyen N.V. and Adyen Issuer N.V. International merchants may use additional regional data centres; transfers in those configurations rely on the Standard Contractual Clauses included in the Adyen DPA.

Do I need a DPIA for Adyen?

Standard online payment use of Adyen does not normally require a DPIA. A DPIA may be relevant for very large merchants combining tokenisation, cross border acquiring and extensive risk profiling.

How do I implement Adyen compliantly?

Sign the Adyen DPA from your Customer Area. Add Adyen to the list of processors in your privacy notice with EU hosting and PSD2 context. Configure SCA and risk rules to comply with PSD2. Use the hosted checkout or Drop-in to limit your PCI DSS scope. Define a retention period for transaction metadata aligned with your AML and tax obligations.

Are there alternatives to Adyen for EU based payments?

Other EU licensed payment providers include Mollie (Netherlands), Stripe (EU entity in Ireland), PayPlug (France), Worldline (France) and Klarna (Sweden). The privacy outcome is broadly similar provided the EU entity and EU hosting are used.

How should I update my cookie policy for Adyen?

For most setups no update to the banner is needed because the Adyen hosted checkout sets only strictly necessary cookies under Art. 5(3) ePrivacy. Update your privacy notice to mention Adyen as a payment processor, the EU hosting and the legal basis. If you embed any optional Adyen Components on your own pages, add the corresponding entries.

Same category

More services: E-commerce

See the whole category

Tauros Media

Tauros Media is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Tauros Media supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Tauros Media ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Growcer

Growcer is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Growcer enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Growcer empowers marketing teams to achieve measurable growth.

Preferences

Bookster

Bookster is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Bookster enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Bookster empowers marketing teams to achieve measurable growth.

Marketing

eCShop

eCShop is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. eCShop supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, eCShop ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

StoragePug

StoragePug is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. StoragePug enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, StoragePug empowers marketing teams to achieve measurable growth.

Marketing

KKTIX

KKTIX is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. KKTIX provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, KKTIX helps deliver the right message to the right audience at the right time.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site