Afterpay

What is Afterpay

Afterpay is a buy now pay later (BNPL) service operated by Afterpay Pty Ltd, a wholly owned subsidiary of Block, Inc. (the parent company of Square and Cash App). In the United Kingdom and most of Europe the same service runs under the Clearpay brand. Shoppers split a purchase into four equal instalments paid every two weeks, with no interest and limited fees. Merchants integrate Afterpay through a JavaScript SDK that renders price widgets on product pages, a checkout button and a redirect flow to portal.afterpay.com or portal.clearpay.com where the consumer is identified and the credit decision is made.

What data and cookies Afterpay collects

The Afterpay widget sets first party and third party cookies for cart state, anti fraud signalling and analytics. It collects IP address, User Agent, viewed product pages, basket value, currency, merchant ID and a device fingerprint used by the fraud engine. At checkout, Afterpay collects name, address, email, phone, date of birth, payment method and, depending on the country, partial identifiers used for soft credit checks. Block, Inc. and its underwriting partners may consult external credit bureaus and fraud databases as part of the decision.

GDPR and ePrivacy implications

The Afterpay SDK loaded on product and category pages places cookies before checkout, which triggers Article 5(3) of the ePrivacy Directive. Those cookies are not strictly necessary for the user to access the merchant site, so consent is required before they are set. The processing of payment, identity and credit data during checkout itself can be based on the performance of a contract under Article 6(1)(b) GDPR, with fraud prevention typically grounded on legitimate interest under Article 6(1)(f). Automated decisions for credit scoring are subject to Article 22 GDPR safeguards.

Is consent required

Yes, for the widget, the price calculator and any analytics or marketing cookies set on category and product pages. The merchant should block the Afterpay SDK behind a consent gate and only load it once the user has accepted at least the functional or marketing category, depending on the cookies set. Inside the actual checkout, where the user has chosen Afterpay as the payment method, the strictly necessary processing of the order can proceed under contract, but transparency notices about the data shared with Block must still be provided.

Data transfers to the United States and Australia

Block, Inc. is headquartered in the United States and operates global infrastructure on AWS. The Australian entity also processes some data in Australia. Block self certified under the EU US Data Privacy Framework, which provides an adequacy decision for transfers to certified Block entities. For categories of data outside the DPF scope, Block relies on the new Standard Contractual Clauses with the related Transfer Impact Assessment. Merchants must list Block, Inc. and Afterpay Pty Ltd as recipients in their privacy policy and explain the transfer mechanism.

Practical compliance steps

Gate the Afterpay SDK behind the consent manager so the script only loads after the relevant categories are accepted. Sign a data processing or controller to controller agreement with Block, depending on the contractual setup in your country. Update the privacy policy with the categories of data shared, the transfer mechanism (DPF and SCCs) and the user rights regarding automated decisions. List the afterpay.com and clearpay.com domains and cookies in the cookie policy. Implement an opt out path that does not block the rest of the checkout when Afterpay is refused.