Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Avangate, now part of 2Checkout and Verifone, is an ecommerce and subscription billing platform that provides a hosted checkout, global payments, recurring billing and fraud prevention for software and digital goods vendors. When its checkout or cart is used, it sets cookies for session management, fraud prevention and conversion attribution and processes buyer and order data. Under the GDPR and the ePrivacy Directive, its non essential cookies require prior consent.
Avangate is an ecommerce, subscription billing and payments platform originally founded in the Netherlands, now operating as part of 2Checkout under Verifone. It gives software and SaaS vendors a hosted checkout, global payment processing, recurring billing, tax handling and fraud prevention. Merchants direct buyers to an Avangate or 2Checkout cart or embed its checkout in their store.
When the Avangate checkout loads it sets cookies for session management, fraud prevention and conversion attribution and reads device data such as IP address and browser. To process an order or subscription, it handles identity, contact, billing and payment data and screens transactions for fraud. Some cookies are persistent identifiers used to recognise the device and attribute the sale.
The attribution and analytics cookies are not strictly necessary, so storing them is governed by Article 5(3) of the ePrivacy Directive and requires consent. Avangate frequently acts as merchant of record, taking on the controller role for the transaction, so the roles and the lawful basis for each purpose must be defined.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Block Avangate non essential cookies until the buyer accepts them through a Consent Management Platform, while cookies strictly necessary to complete a requested purchase may load. Log consent, make refusal as easy as acceptance, and ensure no tracking identifiers are set before opt in.
Avangate processes data in the European Union, in the Netherlands and Romania, and in the United States as part of Verifone. Transfers to the US must rely on Standard Contractual Clauses or the EU US Data Privacy Framework with a Transfer Impact Assessment. Confirm where each part of the processing takes place.
List the Avangate cookies and domains in your cookie policy and gate non essential ones behind consent. Clarify whether Avangate is your processor or the merchant of record and controller, sign the appropriate terms, and document your transfer safeguards. Review the integration when 2Checkout updates its checkout.
Websites using Avangate must obtain user consent under GDPR regulations.
DPIA considerations
Avangate processes identity, contact, billing and payment data and screens transactions for fraud. Key DPIA considerations: (1) attribution and analytics cookies are persistent identifiers needing consent; (2) Avangate often acts as merchant of record, taking on the controller role for the transaction; (3) some processing occurs in the US within Verifone, requiring transfer safeguards; (4) the lawful basis for each purpose must be defined. A DPIA is advisable in case of extensive profiling or large volumes of payment data.
Sample consent text
We use Avangate (2Checkout) to process your order and payments. The Avangate checkout sets cookies and processes your identity, billing and payment data, and screens the transaction for fraud. You can withdraw your consent to non essential cookies at any time through our cookie settings.
Third-party domains contacted
avangate.comsecure.avangate.comsecure.2checkout.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| av_session | Functional | Session | Maintains the buyer session through the Avangate checkout. |
| _av_attr | Attribution / Analytics | 1 year | Persistent identifier used to attribute completed orders and recognise returning devices. |
| av_fraud | Security | 6 months | Supports device recognition and fraud screening during checkout. |
Avangate uses cookies for user preferences — inform visitors with a consent banner.
Avangate sets cookies for session management, fraud prevention and conversion attribution when its checkout loads. The attribution and analytics cookies are persistent identifiers that are not strictly necessary, so they require consent, while a narrow set needed to complete a requested purchase may be treated as essential.
Yes for the non essential cookies. The attribution and analytics cookies Avangate sets need prior consent under the GDPR and the ePrivacy Directive, so they should not load until the buyer accepts. Cookies strictly necessary to process a requested purchase can rely on a different basis.
Consent under Article 6(1)(a) GDPR covers the attribution cookies, while processing needed to complete a purchase relies on contract under Article 6(1)(b). Fraud prevention may rely on legitimate interest. As merchant of record, Avangate often acts as an independent controller, which shapes who relies on which basis.
Avangate processes data in the EU (Netherlands and Romania) and the United States as part of Verifone. US transfers must use Standard Contractual Clauses or the EU US Data Privacy Framework with a Transfer Impact Assessment, so confirm where each part of the processing occurs and document it.
A DPIA may not be mandatory for a standard checkout, but it is advisable if you combine Avangate with extensive profiling or process large volumes of payment data. Document the purposes, the controller roles, fraud screening and transfer safeguards to demonstrate accountability.
Add Avangate through a CMP that blocks non essential cookies until consent, keep purchase essential cookies separate, and confirm whether it acts as your processor or as merchant of record. Sign the relevant terms, disclose cookies and recipients, and document transfer safeguards.
Other merchant of record and billing platforms include Paddle, Cleverbridge, FastSpring and Digital River. Several of these process data largely in the EU, which can simplify transfer compliance. All set checkout and tracking cookies, so consent gating and clear roles remain the priority.
Describe the Avangate cookies, their purpose and duration, list the Avangate and 2Checkout domains, and state that data is processed in the EU and the US. Clarify the controller roles in your privacy notice and keep both aligned with the integration.