Apple Pay
Apple Pay is the contactless and online payment service of Apple, integrated with Safari and the iOS Wallet to let users pay with the card stored on their device.
What does Apple Pay do?
What is Apple Pay?
Apple Pay is the contactless and online payment service of Apple. On the web, merchants integrate Apple Pay through the Apple Pay JS API on Safari or through a payment service provider (Stripe, Adyen, Braintree, Worldline). The user authorises the payment with Face ID, Touch ID or a passcode, and the device generates a tokenised payment credential bound to the merchant. The card number is never shared with the merchant or the publisher. For European users, Apple Distribution International in Ireland is the customer facing entity.
What data and cookies does Apple Pay collect?
Apple Pay on the web requires a domain verification file hosted on the merchant (well known apple-developer-merchantid-domain-association). The Apple Pay button does not drop tracking cookies on the publisher domain. A small number of strictly necessary cookies are set on apple.com when the user is signed in to their Apple account. The merchant receives the encrypted payment token, the billing address (if requested) and the shipping address (if requested), but not the underlying card details. Transaction signals like device location and Apple risk scores are processed inside Apple infrastructure to validate the payment.
GDPR and ePrivacy implications
Apple Pay is one of the most privacy friendly payment options for European publishers. The few cookies it sets are strictly necessary for the payment and fall under the article 5(3) ePrivacy exemption. The card data is tokenised on the device and never reaches the merchant in clear. Apple processes transaction signals as an independent controller under its own Apple privacy notice. The publisher acts as a controller for the order data it receives back from Apple Pay.
Consent management with Apple Pay
You can display the Apple Pay button without a separate consent because it does not set non essential cookies. Inform users about Apple Pay in your privacy notice and identify Apple Distribution International (for EEA) and Apple Inc. (for global flows) as independent controllers. Provide a link to the Apple privacy notice and to the Apple Pay specific privacy section.
Data residency and Apple DPF
Apple Distribution International (Cork, Ireland) is the EEA customer facing entity. Apple Inc. (Cupertino, California) operates the broader Apple Pay infrastructure. Some flows can involve Apple Inc. infrastructure in the United States. Transfers rely on EU SCCs and the Apple Inc. DPF certification under the EU US Data Privacy Framework.
Practical compliance checklist
Register your domain with Apple and host the domain verification file. Sign the Apple Pay Merchant Agreement through your payment service provider. Display the button without a separate consent. Inform users in your privacy notice that Apple Pay is used. Identify Apple Distribution International and Apple Inc. as controllers. Document any data you receive back from Apple Pay (billing and shipping addresses) in your records of processing activities.
Apple Pay and the GDPR
- Legal basis
- Performance of a contract (article 6(1)(b) GDPR) for the payment processing, with a strictly necessary classification for the limited Apple cookies that the button may set. Apple Pay sets very few cookies and most data flows occur through native Wallet APIs, not through tracking cookies.
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive, TTDSG, LOPDGDD, French Data Protection Act, UK GDPR and PECR, PCI DSS, PSD2 SCA, EMVCo Payment Tokenisation
Impact assessment (DPIA)
Apple Pay is generally low risk because card data is tokenised on the device and never reaches the merchant or the publisher servers in clear. A DPIA may be appropriate when Apple Pay is paired with Apple Sign In, when the merchant runs subscriptions with stored Apple Pay tokens, or when the merchant aggregates transaction data with broader profiling.
Sample text for your banner
We use Apple Pay to let you check out with the card stored on your Apple device. Apple Pay does not share your card number with us, it generates a one time payment token signed by your device. Apple Pay sets only very limited technical cookies that are strictly necessary for the payment, so no separate consent is required for the button to display.
What Apple Pay sets and contacts
- Tracking method
- Apple Pay JavaScript SDK and Apple Pay JS API on Safari with native Wallet integration on iOS, very limited cookies and a domain verification file hosted on the merchant
- Server location
- Apple Inc. (United States) and Apple Distribution International (Ireland) on Apple infrastructure
- Cookieless mode available
- Yes
- Data transferred outside the EU
- Apple Pay is operated by Apple Inc. (United States) and Apple Distribution International (Ireland) for EEA users. Card data is tokenised on the device and never shared in clear with the merchant. Some flows can involve Apple infrastructure in the United States. Transfers rely on Apple Inc. DPF certification and EU SCCs.
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| s_vi | Strictly Necessary | 2 years | Apple visitor identifier used by the Apple Pay backend on apple.com to maintain the merchant transaction context. |
| geo | Strictly Necessary | Session | Stores the user country and region for the Apple Pay availability check. |
| dssid | Strictly Necessary | Session | Apple session identifier used during the Apple Pay authentication and confirmation step. |
| dssf | Strictly Necessary | 1 year | Apple secure flag cookie used to protect the Apple Pay session against forged requests. |
Third-party domains contacted (4)
apple.comapple-pay-gateway.apple.comapple-pay-gateway-cert.apple.comsmp-device.apple.com
Frequently asked questions about Apple Pay
Can't find your question? Write to us, we answer fast.
What cookies does Apple Pay set?
Apple Pay sets very few cookies. A small number of strictly necessary cookies on apple.com (s_vi, geo, dssid, dssf) appear when the user is signed in to an Apple account. No tracking cookies are dropped on the publisher domain.
Is consent required to display the Apple Pay button?
No. The Apple Pay button does not set non essential cookies on the publisher domain. The strictly necessary cookies set on apple.com fall under the article 5(3) ePrivacy exemption.
What is the legal basis for Apple Pay?
Performance of a contract (article 6(1)(b) GDPR) for the payment, and legitimate interest (article 6(1)(f) GDPR) for the Apple side fraud prevention.
What about US data transfers?
Apple Distribution International is in Ireland but some flows involve Apple Inc. in the US. Transfers rely on EU SCCs and the Apple Inc. DPF certification.
Do I need a DPIA for Apple Pay?
Generally no. Apple Pay is low risk because card data never reaches the merchant. A DPIA may be appropriate when Apple Pay is paired with Apple Sign In, when subscriptions use Apple Pay tokens, or when transaction data feeds broader profiling.
How do I implement Apple Pay compliantly?
Register your domain with Apple. Host the merchant ID domain association file. Sign the Apple Pay Merchant Agreement via your PSP. Display the button without separate consent. Inform users in your privacy notice.
What are the alternatives to Apple Pay?
Google Pay, Amazon Pay, PayPal Express, Shop Pay, Klarna Pay Now, GoCardless, Stripe Link, Adyen, Mollie or local methods (Bancontact, iDEAL, Sofort, Bizum).
How do I document Apple Pay in my cookie policy?
Note that Apple Pay does not set tracking cookies on your domain. Identify Apple Distribution International and Apple Inc. as controllers in the privacy notice. Link to the Apple privacy notice and Apple Pay specific section.
Omega Commerce
Omega Commerce offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Omega Commerce integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for sustainable growth.
LogoiX
LogoiX is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. LogoiX integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, LogoiX helps organizations maintain robust websites that meet user expectations and technical requirements.
%22%3E%0A%3Cpath%20fill-rule%3D%22evenodd%22%20clip-rule%3D%22evenodd%22%20d%3D%22M-0.0703125%20-0.071106C10.5964%20-0.071106%2021.263%20-0.071106%2031.9297%20-0.071106C31.9297%2010.5956%2031.9297%2021.2622%2031.9297%2031.9289C21.263%2031.9289%2010.5964%2031.9289%20-0.0703125%2031.9289C-0.0703125%2021.2622%20-0.0703125%2010.5956%20-0.0703125%20-0.071106Z%22%20fill%3D%22%237F54B3%22%2F%3E%0A%3Cpath%20fill-rule%3D%22evenodd%22%20clip-rule%3D%22evenodd%22%20d%3D%22M9.17241%2012.0178C9.0159%2012.2706%208.89738%2012.555%208.81686%2012.8711C8.69984%2014.0341%208.72354%2015.1718%208.88797%2016.2844C9.98666%2020.8698%2012.8785%2023.0268%2017.5635%2022.7556C18.6879%2022.3593%2019.8257%2022.0038%2020.9769%2021.6889C22.6862%2021.7863%2023.5869%2022.6871%2023.6791%2024.3911C23.5108%2026.3031%2022.4679%2027.0854%2020.5502%2026.7378C19.8014%2026.5569%2019.2088%2026.1538%2018.7724%2025.5289C18.4415%2024.8613%2018.5126%2024.2449%2018.9857%2023.68C19.4697%2023.4401%2019.8726%2023.5349%2020.1946%2023.9644C20.4519%2024.6549%2020.6652%2025.366%2020.8346%2026.0978C21.5551%2026.3238%2022.1478%2026.1342%2022.6124%2025.5289C22.928%2024.6077%2022.8806%2023.7069%2022.4702%2022.8267C21.5765%2021.9536%2020.6045%2021.8825%2019.5546%2022.6133C15.1894%2024.0496%2011.5154%2023.0305%208.53241%2019.5556C5.7519%2015.0495%206.24967%2010.9488%2010.0257%207.25334C13.6568%204.45969%2017.402%204.31747%2021.2613%206.82667C25.1155%2010.1434%2026.04%2014.1493%2024.0346%2018.8444C23.6319%2019.6258%2022.9919%2020.0762%2022.1146%2020.1956C20.0179%2020.4693%2018.6667%2019.5923%2018.0613%2017.5644C17.9664%2017.0429%2017.9664%2016.5215%2018.0613%2016C18.796%2014.6018%2019.7442%2013.3692%2020.9057%2012.3022C22.4523%209.44484%2021.6227%207.66706%2018.4169%206.96889C14.0276%206.31827%2010.9461%208.00123%209.17241%2012.0178Z%22%20fill%3D%22%23FBF9FC%22%2F%3E%0A%3Cpath%20fill-rule%3D%22evenodd%22%20clip-rule%3D%22evenodd%22%20d%3D%22M9.17268%2012.0178C8.91767%2013.4238%208.82285%2014.846%208.88823%2016.2844C8.72381%2015.1718%208.7001%2014.0341%208.81712%2012.8711C8.89765%2012.555%209.01616%2012.2706%209.17268%2012.0178Z%22%20fill%3D%22%239A79C2%22%2F%3E%0A%3C%2Fg%3E%0A%3Cdefs%3E%0A%3CclipPath%20id%3D%22clip0_161_1570%22%3E%0A%3Crect%20width%3D%2232%22%20height%3D%2232%22%20fill%3D%22white%22%2F%3E%0A%3C%2FclipPath%3E%0A%3C%2Fdefs%3E%0A%3C%2Fsvg%3E)
WooCommerce Multilingual
WooCommerce Multilingual is a website translation and localization platform that helps businesses reach global audiences by delivering content in multiple languages. It provides automated translation, human editing workflows, and seamless CMS integration. WooCommerce Multilingual supports dynamic content translation, multilingual SEO optimization, and locale-specific formatting. With language detection and visitor routing, WooCommerce Multilingual ensures every user receives content in their preferred language.
Avada Size Chart
Avada Size Chart is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Avada Size Chart supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Avada Size Chart remains a leading web development choice.
HelixPay
HelixPay is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. HelixPay enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, HelixPay empowers marketing teams to achieve measurable growth.
%22%2F%3E%0A%3Cdefs%3E%0A%3ClinearGradient%20id%3D%22paint0_linear_161_1451%22%20x1%3D%2222.3537%22%20y1%3D%2230.3485%22%20x2%3D%2213.3896%22%20y2%3D%225.67177%22%20gradientUnits%3D%22userSpaceOnUse%22%3E%0A%3Cstop%20stop-color%3D%22%23361AFF%22%2F%3E%0A%3Cstop%20offset%3D%221%22%20stop-color%3D%22%23FE5C69%22%2F%3E%0A%3C%2FlinearGradient%3E%0A%3C%2Fdefs%3E%0A%3C%2Fsvg%3E)
Wizpay
Wizpay is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Wizpay supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Wizpay ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.