FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

Authorize.Net

PreferencesOfficial website

Authorize.Net is a US payment gateway owned by Visa that lets merchants accept cards online via Accept.js, Accept Hosted forms and the Customer Information Manager, with built in fraud detection.

Block Authorize.Net until consentScan my site
Overview

What does Authorize.Net do?

Authorize.Net is one of the oldest payment gateways on the internet. Founded in 1996 and acquired by Visa in 2010, it lets merchants accept credit and debit cards, e-checks, digital wallets, and recurring billing. European merchants typically use it when they also sell in the United States, when they integrate with US shopping carts, or when their acquiring bank routes through Visa.

What Authorize.Net does

Authorize.Net exposes a REST API plus three integration patterns: Accept.js (client side tokenisation, the merchant never sees the card number), Accept Hosted (a fully hosted payment page on accept.authorize.net), and the Customer Information Manager for stored profiles. Visa's Advanced Fraud Detection Suite enriches every transaction with rule based and machine learning scores.

Cookies and data collected

When Accept.js loads, it sets first party cookies on its own domain (ASP.NET_SessionId, .ASPXAUTH) to maintain the tokenisation context. Accept Hosted runs on accept.authorize.net and sets additional cookies for fraud and session continuity. Authorize.Net processes the card number (or its token), expiry date, CVV, billing address, IP, user agent, and the device fingerprint used by the fraud engine.

GDPR and ePrivacy implications

Cookies set strictly to render the payment form and complete the purchase are considered strictly necessary under Article 5(3) ePrivacy and do not require consent. Fraud and analytics cookies that go beyond that scope do require consent. The processing of payment data has multiple legal bases stacked: contract performance for the payment itself, legitimate interest for fraud prevention, and legal obligation for tax and PSD2 obligations.

Data transfers to the United States

Authorize.Net runs in the United States. Cardholder and fraud data crosses the Atlantic. Visa, the parent company, is certified under the EU-US Data Privacy Framework and offers Standard Contractual Clauses. A Transfer Impact Assessment should be documented.

How to deploy it compliantly

Sign the Authorize.Net DPA, document the transfer mechanism, and prefer Accept Hosted or Accept.js to keep your PCI DSS scope as low as SAQ A. Disclose Authorize.Net in your privacy notice, with the categories of data, the US transfer, retention, and rights. Restrict access to the merchant portal and enable 2FA. If you target the EU only, consider a European acquirer (Stripe, Adyen, Mollie) to avoid the transfer altogether.

Compliance

Authorize.Net and the GDPR

Authorize.Net is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Contract performance (Art. 6(1)(b) GDPR) for the payment, legitimate interest (Art. 6(1)(f)) for fraud prevention, consent (Art. 6(1)(a)) for non strictly necessary cookies
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, PSD2 / Strong Customer Authentication, PCI DSS, EU-US Data Privacy Framework

Impact assessment (DPIA)

A DPIA can be useful when Authorize.Net is used to process consumer payments at scale in the EU. Document the data flow (cardholder data, billing address, IP, device fingerprint), the US transfer mechanism, the fraud detection signals, and the retention applied by Visa.

Sample text for your banner

We use Authorize.Net (operated by Visa) to process card payments. Authorize.Net sets cookies on its domain when its hosted form or Accept.js loads, and transfers payment and fraud data to the United States. The payment form is strictly necessary for the transaction; we still inform you about the international transfer.
Cookies and trackers

What Authorize.Net sets and contacts

Tracking method
Payment gateway API and hosted payment forms (Accept.js, Accept Hosted, Accept Customer), iFrame integration, fraud detection scripts
Server location
United States (operated by Visa, subsidiary of Visa Inc)
Data transferred outside the EU
Authorize.Net is owned by Visa and operated from the United States. All cardholder data, transaction data and fraud signals are transferred to the US. Transfers rely on the EU-US Data Privacy Framework (Visa is certified) and on Standard Contractual Clauses combined with a Transfer Impact Assessment.

Cookies set (4)

NameTypeDurationPurpose
ASP.NET_SessionIdhttp_cookieSessionSession identifier set by Authorize.Net during payment processing, strictly necessary to complete the transaction.
.ASPXAUTHhttp_cookieSessionAuthentication cookie used by the Authorize.Net merchant portal and Accept Hosted iFrame.
tokenhttp_cookieSessionShort lived payment token cookie used during the Accept Hosted flow to bind the form submission to the merchant transaction.
akamai_bothttp_cookie30 minutesSet by the Akamai bot management layer in front of Authorize.Net for fraud and bot prevention.

Third-party domains contacted (5)

  • accept.authorize.net
  • api.authorize.net
  • jstest.authorize.net
  • js.authorize.net
  • secure2.authorize.net
Questions

Frequently asked questions about Authorize.Net

Can't find your question? Write to us, we answer fast.

What cookies does Authorize.Net set?

Accept.js and Accept Hosted typically set ASP.NET_SessionId and .ASPXAUTH on the Authorize.Net domain for session continuity. Additional fraud and tokenisation cookies may be set during the payment flow. These cookies are not stored on the merchant domain when using the hosted variants.

Does Authorize.Net require GDPR consent?

Cookies that are strictly necessary to render the payment form and complete the transaction are exempt from consent under Article 5(3) ePrivacy. Fraud or analytics cookies beyond that scope require consent. Inform users about the payment processor and the US transfer.

What is the legal basis for processing?

Contract performance under Article 6(1)(b) GDPR for the payment, legitimate interest under Article 6(1)(f) for fraud prevention, and legal obligation under Article 6(1)(c) for PSD2 strong customer authentication and tax retention.

Are data transferred outside the EU?

Yes. Authorize.Net is operated by Visa in the United States. Transfers rely on the EU-US Data Privacy Framework and on Standard Contractual Clauses. A Transfer Impact Assessment is recommended for European merchants.

Do I need a DPIA?

A DPIA is recommended for high volume consumer payments, especially when combined with the fraud detection suite that profiles users. Document the data flow, the AI fraud model, the retention, and the safeguards for the US transfer.

How do I implement Authorize.Net compliantly?

Use Accept Hosted or Accept.js to limit PCI scope, sign the DPA, configure Strong Customer Authentication for European cards (3D Secure 2), set retention for stored profiles, and disclose Authorize.Net in your privacy notice with the categories and the US transfer mechanism.

Are there alternatives to Authorize.Net?

For European merchants, consider Stripe, Adyen, Mollie, Worldline, Checkout.com or PayPlug. These providers offer EU acquiring, native SCA support, and clearer EU data residency. Pick based on geography, ticket size, and integration depth.

How do I update my cookie policy for Authorize.Net?

Add a payment processor section that names Authorize.Net, lists the cookies set during the payment, mentions the US transfer mechanism, the legal bases stacked for payment, fraud, and tax, and links to the Authorize.Net privacy notice.

Same category

More services: E-commerce

See the whole category

Lieferando

Lieferando is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Lieferando integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Lieferando helps organizations maintain robust websites that meet user expectations and technical requirements.

E-commerce

DRINKS

Drinks is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Drinks supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Drinks ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Colis Privé

Colis Privé is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Colis Privé supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Colis Privé ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

GoDaddy Online Store

GoDaddy Online Store is a comprehensive e-commerce platform that provides businesses with all the tools needed to build, manage, and grow an online store. From product catalog management and secure payment processing to inventory tracking and order fulfillment, GoDaddy Online Store delivers a complete commerce solution. It features responsive storefront themes, SEO-optimized product pages, and powerful marketing tools to help merchants increase visibility and drive sales across channels.

Preferences

Unipag

Unipag is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Unipag provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Unipag helps deliver the right message to the right audience at the right time.

Essential

iMagaza

iMagaza is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. iMagaza integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, iMagaza helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site