Amazon Pay

What is Amazon Pay?

Amazon Pay is the merchant payment service offered by Amazon Payments Europe S.C.A., a Luxembourg licensed Electronic Money Institution supervised by the CSSF. It lets buyers check out on third party websites using their existing Amazon account, with addresses and payment methods already stored on Amazon. Amazon Pay supports one off payments, subscriptions and Pay Later in some regions, and is positioned as a checkout accelerator that competes with PayPal Smart Buttons and Shop Pay.

What data and cookies does Amazon Pay collect?

Loading the Amazon Pay button drops several third party cookies on amazon.com and payments.amazon.com (session-id, ubid-acbeu, lc-acbeu for locale, x-acbeu for the Amazon directed identifier, at-main and sess-at-main for the Amazon authentication token, ad-id for Amazon advertising). The button SDK also fingerprints the device for fraud detection (user agent, screen resolution, IP, behavioural signals). When the buyer clicks the button, the flow continues on payments.amazon.com and returns the buyer details (shipping address, billing address, payment token) to the merchant via the Amazon Pay API.

GDPR and ePrivacy implications

The strict checkout cookies that maintain the Amazon Pay session are strictly necessary for the payment requested by the user and fall under the article 5(3) ePrivacy exemption. The ad-id and Amazon advertising cookies set on amazon.com are not strictly necessary and require consent if you display the button before consent is granted. CNIL has stressed that loading a payment button is acceptable without consent only if the third party cookies set are limited to what is strictly necessary for the transaction.

Consent management with Amazon Pay

Render the Amazon Pay button on the checkout page only when needed. If you display it before consent on a product page or in a mini cart, wrap it in a CMP gate or use the Image button option (no Amazon cookies before click). When the user clicks, the Amazon Pay flow takes over on payments.amazon.com and operates under the Amazon privacy notice. Inform users in your privacy notice that Amazon Payments Europe S.C.A. and Amazon Inc. process the payment.

Data residency and Amazon DPF

Amazon Payments Europe S.C.A. operates from Luxembourg under EU banking and payment regulation. Card processing, fraud detection and reconciliation flows can involve Amazon entities in the United States. Transfers rely on EU SCCs and Amazon Inc. DPF certification under the EU US Data Privacy Framework. Document the transfer mechanism in your records of processing activities.

Practical compliance checklist

Sign the Amazon Pay merchant agreement and the EU DPA. Display the button only when needed, or use the Image button option until the buyer clicks. Categorise checkout cookies as Strictly Necessary and Amazon advertising cookies as Marketing. Identify Amazon Payments Europe S.C.A. and Amazon Inc. as joint or independent controllers as relevant. Provide a privacy notice section explaining the EU and US data flows.