Meta Pay

Meta Pay sets several cookies. datr (two years) identifies the browser for Meta security purposes and fraud prevention. sb (two years) also supports security functions. fr (ninety days) is Meta's primary advertising cookie used for ad targeting and measurement. When a user is logged in to their Meta account, the c_user and xs cookies (session) identify the account and session. wd (session) records the browser window dimensions. The fr cookie is non essential advertising in nature and requires prior consent. datr and sb may be argued as security functional but should be disclosed.

Partially. The payment transaction itself is processed under Article 6(1)(b) GDPR (contract) and does not require consent, but the user must be clearly informed about data sharing with Meta before choosing Meta Pay at checkout. The non essential Meta cookies (particularly fr for advertising) require prior opt in consent under the ePrivacy Directive. You must not place advertising Meta cookies until cookie consent is given, even if the user is actively completing a payment.

Two legal bases apply. The payment processing and transaction data rely on Article 6(1)(b) GDPR as processing necessary to perform the contract (the purchase) that the user initiates. The Meta advertising cookies (fr) and any profiling or targeting beyond the payment rely on Article 6(1)(a) GDPR consent. PSD2 adds payment security requirements that must be met alongside GDPR data minimisation. Both bases must be documented and disclosed in your privacy policy.

Yes. All payment, transaction and device data are processed by Meta Platforms Inc. in the United States. The transfer is covered by the EU US Data Privacy Framework and standard contractual clauses. You must disclose this transfer in your privacy policy, ideally in a specific section about Meta Pay, and make it visible to users at checkout before they select Meta Pay as their payment method.

Yes, a DPIA is required for Meta Pay given the high risk rating. The combination of payment and financial data, device fingerprinting, Meta advertising cookies and US transfers creates significant privacy risks. The DPIA must assess what data Meta receives beyond the payment itself, whether Meta uses transaction data for advertising profiling, how PSD2 strong authentication interacts with GDPR data minimisation, and what rights users have over their data at Meta. Complete the DPIA and obtain legal sign off before going live.

Complete a DPIA before activating Meta Pay. Block non essential Meta cookies (especially fr) until advertising consent is given via your consent management platform. Add a clear disclosure near the Meta Pay button at checkout informing users that payment and device data are shared with Meta Platforms in the US. Update your privacy policy to address Article 6(1)(b) for payment and Article 6(1)(a) for Meta advertising cookies, and describe US transfers under the EU US Data Privacy Framework. Ensure your PSD2 strong authentication flow collects only data strictly necessary for security.

Yes. Payment methods that do not involve sharing transaction data with an advertising network include Stripe (US based but focused on payment only with no advertising use of transaction data), PayPal (US based, similar transfer issue but no advertising profiling of transaction data by default) and EU based options like Klarna or Adyen. If avoiding US transfers is paramount, look for EU regulated payment processors. None of these alternatives combine payment with the social login and advertising profiling that Meta Pay introduces.

Add a Meta Pay section to your cookie policy. List the main cookies: datr (security, two years, Meta), sb (security, two years, Meta), fr (advertising, ninety days, Meta), c_user and xs (account identification, session, Meta when logged in) and wd (functional, session, Meta). Categorise fr as an advertising cookie requiring consent. Categorise datr and sb as security functional. Link each to your consent categories in your consent management platform. Explain that some Meta cookies are only set when the user is logged into their Meta account.