Billgang

What is Billgang?

Billgang was a hosted ecommerce platform built for sellers of digital products: software licenses, game accounts and items, subscriptions, gift cards and downloadable files. Merchants created a storefront on Billgang, or added Billgang checkout links and embed buttons to their own website, and the platform took care of the cart, payment collection (cards through payment partners and several cryptocurrencies), automated delivery of the purchased item and order management. It was popular with small sellers in gaming and software resale communities, alongside similar services such as Sellix and Sellpass.

In August 2026 Billgang stopped working. Merchants reported being unable to withdraw balances in the weeks before, then billgang.com and its subdomains started showing a page titled "Seized by the Federal Bureau of Investigation", and the domain's nameservers now point to ns1.fbi.seized.gov and ns2.fbi.seized.gov. At the time of writing no official announcement naming Billgang has been found, and some sellers describe the shutdown as an exit scam. What matters for GDPR is simple: the platform is gone, its operator was never clearly identified, and buyer data processed through it is outside your control.

Data and cookies Billgang processed

As a checkout and storefront platform, Billgang processed buyer email addresses, IP addresses, order contents, delivered license keys or files, payment references and, for crypto payments, wallet addresses and transaction hashes. Merchant accounts held identity and payout data. On the storefront, the platform typically used a session cookie to keep the buyer logged in or the checkout state, browser local storage for the cart, and Cloudflare cookies such as __cf_bm for bot protection, since billgang.com was served through Cloudflare. Billgang never published a detailed cookie list, so names other than the Cloudflare ones are descriptive rather than documented.

GDPR and ePrivacy implications

A merchant selling to buyers in the EU is the controller of buyer data, and Billgang acted as its processor (and partly as an independent controller for payments and fraud checks). Article 28 GDPR requires a written processing agreement with sufficient guarantees; Billgang offered no verifiable DPA, no identified legal entity and no clear hosting location, which made it very difficult to meet the accountability principle. Under ePrivacy Directive art. 5(3), as transposed by the French CNIL guidelines, German TDDDG § 25 and Spanish LSSI CE art. 22.2, reading or writing data on the buyer's device needs consent unless it is strictly necessary for the service the buyer requested.

Consent requirements

Session, cart and security cookies needed to complete a purchase were exempt from consent. Analytics, advertising pixels or chat widgets that a merchant connected to a Billgang storefront were not, and needed opt in consent through a banner before loading. Today the practical issue is different: any "Buy with Billgang" button, iframe or script still present on a website now loads a seizure page or fails, which breaks the checkout and may expose visitors to a law enforcement banner. Remove those elements rather than trying to gate them behind consent.

Data transfers outside the EEA

Billgang never documented where data was stored. Its traffic went through Cloudflare, a US company certified under the EU US Data Privacy Framework, and payments relied on processors and blockchains outside the EEA. No Standard Contractual Clauses (SCC 2021/914) or transfer impact assessment as required after Schrems II could be verified for the platform itself. Since the reported seizure, buyer and merchant data should be assumed to be held outside the EEA by unknown parties or by authorities, with no contractual safeguards at all.

Practical compliance steps for merchants

First, remove every Billgang link, embed button, script and redirect from your site and from your cookie banner configuration, and update your privacy policy and cookie policy to state that Billgang is no longer used. Second, assess whether the loss of access to buyer data is a personal data breach under Article 33: list the categories of data concerned, estimate the number of buyers, and document your decision on notifying your supervisory authority within 72 hours and informing buyers if the risk is high. Third, export whatever order data you still hold locally, and answer access or erasure requests honestly, explaining that the former processor is unreachable.

When choosing a replacement, favour a provider with an identified legal entity, a signed DPA, documented hosting and an EU presence, such as Paddle or Lemon Squeezy for software sales, or a Shopify or WooCommerce store with an EU payment provider like Mollie. Check the vendor DPA and transfer mechanism before migrating, and run a DPIA if you process large volumes of buyer data.