Affirm

What is Affirm

Affirm is a buy now pay later and point of sale lending platform operated by Affirm Holdings, Inc., a publicly listed company headquartered in San Francisco. Unlike short instalment products, Affirm offers loans ranging from a few weeks to several years, with disclosed interest and a hard or soft credit check depending on the offer. Merchants integrate Affirm through affirm.js, which renders the As low as monthly payment widget on product pages and opens a hosted credit application flow at checkout.

What data Affirm collects

On product pages, Affirm collects IP address, User Agent, page URL, basket value and merchant ID through the widget script, and sets analytics and fraud cookies. During the credit application, Affirm collects name, date of birth, address, phone, email, the last four digits of a social security number or a national identifier, employment data and bank verification. Affirm queries credit bureaus and fraud databases to issue the lending decision and shares the outcome with the merchant.

GDPR and ePrivacy implications

Affirm cookies set on category and product pages are not strictly necessary and require consent under Article 5(3) of the ePrivacy Directive. The credit application performed at checkout falls under Article 6(1)(b) GDPR as it is necessary to enter into a contract requested by the data subject. Automated credit scoring is subject to Article 22 GDPR safeguards: the user must be informed, can ask for human intervention and can contest the decision. Cross border transfers to the US trigger Chapter V obligations.

Is consent required

For the marketing widget and any analytics cookies dropped before checkout, yes: gate the affirm.js script behind the consent manager. Inside the checkout, when the user has actively chosen Affirm as the financing option, the application processing can run under contract. The privacy notice must still clearly describe what data goes to Affirm and that an automated decision will be taken.

Data transfers to the United States

Affirm Holdings, Inc. is a US controller and processes data on US infrastructure. Affirm self certified under the EU US Data Privacy Framework, which provides an adequacy decision for transfers to Affirm. Affirm also publishes Standard Contractual Clauses for international customers and clarifies how it handles requests for access by US authorities under FISA 702. Merchants must reference these mechanisms in their privacy policy and inform users of the international nature of the processing.

Practical compliance steps

Gate the Affirm widget behind your consent manager, document the integration in your record of processing, conduct a DPIA covering automated decisions and US transfers, and sign the appropriate agreement with Affirm (controller to controller for the lending decision, processor terms for analytics passed through the merchant). Update the privacy policy with the categories of data, the legal bases, the SCC or DPF mechanism and the user rights regarding Article 22.