Google Pay
Google Pay is a digital wallet and online payment service that lets users pay on third party sites with card details stored in their Google account.
What does Google Pay do?
What is Google Pay?
Google Pay is the digital wallet and online payment service of Google. For European buyers, the payment leg is operated by Google Payment EMEA Limited, an Irish E-Money Institution supervised by the Central Bank of Ireland. On the web, merchants integrate Google Pay through the Google Pay JavaScript API or the Web Payments Request API, which displays a button that opens a Google sheet pre filled with the user payment methods, addresses and contact details from their Google account.
What data and cookies does Google Pay collect?
Loading the Google Pay button drops third party cookies on pay.google.com and accounts.google.com (NID, SID, HSID, SSID, APISID, SAPISID, GPS for ad targeting if the user is signed in to Google). The Google Pay API receives the merchant ID, the amount, the currency, the country, the supported card networks and the customer billing and shipping requirements. On click, Google returns an encrypted payment token bound to the merchant for the gateway to process.
GDPR and ePrivacy implications
Strictly necessary cookies for the Google Pay button to function fall under the article 5(3) ePrivacy exemption. However Google sets a number of cookies on pay.google.com and accounts.google.com that go beyond the payment itself (advertising, sign in continuity, personalisation). CNIL and other EU regulators expect merchants to either delay the button until consent or to use the rendering options that limit Google cookies before click.
Consent management with Google Pay
Render the Google Pay button on the checkout page only. Avoid loading pay.google.com scripts on browse or category pages. Wrap the button behind a CMP gate if it is displayed before consent. Use the Google Consent Mode v2 if you integrate Google Pay with Google Ads or Google Analytics, so that ad_storage and analytics_storage signals propagate correctly. Inform users in your privacy notice that Google Payment EMEA Limited and Google LLC process the payment.
Data residency and Google DPF
For EEA buyers, Google Payment EMEA Limited operates from Dublin. Card processing, tokenisation and fraud detection can involve Google entities globally including the United States. Transfers rely on EU SCCs and the Google LLC DPF certification under the EU US Data Privacy Framework. Document the transfer mechanism in your records of processing activities.
Practical compliance checklist
Sign the Google Pay merchant agreement and the Google DPA with EU SCCs. Display the button only on checkout. Avoid loading Google Pay scripts on non checkout pages. Use Consent Mode v2 to propagate the user choices. Categorise Google Pay cookies as Strictly Necessary and Google advertising cookies as Marketing. Identify Google Payment EMEA Limited and Google LLC as joint or independent controllers in your privacy notice.
Google Pay and the GDPR
Google Pay is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Performance of a contract (article 6(1)(b) GDPR) for the payment processing, combined with legitimate interest for fraud prevention. Consent (article 6(1)(a) GDPR) and article 5(3) ePrivacy for non essential Google cookies set when the button loads.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, TTDSG, LOPDGDD, French Data Protection Act, UK GDPR and PECR, PCI DSS, PSD2 SCA, Irish payment services regulation
Impact assessment (DPIA)
A DPIA is recommended whenever Google Pay is paired with other Google services on the merchant site (Google Ads conversion tracking, Google Analytics enhanced ecommerce, Google Sign In), when the merchant runs subscription billing, or when sensitive sectors are processed.
Sample text for your banner
We use Google Pay to let you check out with the card details stored in your Google account. Loading the Google Pay button sets Google cookies and shares payment data with Google Payment EMEA Limited in Ireland and Google LLC in the United States. Payment cookies are strictly necessary, additional Google cookies for advertising or analytics only load if you grant consent.
What Google Pay sets and contacts
- Tracking method
- Google Pay JavaScript API and Web Payments Request API integration, with first and third party cookies set on Google domains
- Server location
- Google LLC (United States) and Google Ireland Limited (Dublin) on Google Cloud Platform
- Data transferred outside the EU
- Google Pay is operated by Google Payment EMEA Limited (Ireland) for EEA buyers and by Google LLC in the United States. Card processing, tokenisation and fraud detection can involve Google entities globally. Transfers rely on EU SCCs and on the Google DPF certification under the EU US Data Privacy Framework.
Cookies set (8)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| NID | Strictly Necessary | 6 months | Google identifier used to remember user preferences and authentication state in Google services, including Google Pay. |
| SID | Strictly Necessary | 2 years | Google session identifier used to authenticate the user in Google Pay. |
| HSID | Strictly Necessary | 2 years | Companion to SID, used by Google for session protection against forged credentials. |
| SSID | Strictly Necessary | 2 years | Companion to SID used by Google to bind the session to a secure context. |
| APISID | Strictly Necessary | 2 years | Google API session identifier required to call Google Pay APIs while authenticated. |
| SAPISID | Strictly Necessary | 2 years | Hashed companion to APISID for secure API authentication. |
| GPS | Marketing | 30 minutes | Google identifier used for geolocation and ad personalisation when the user is signed in to Google. |
| CONSENT | Functional | 2 years | Stores the user consent state for Google services, including cookies and personalised content. |
Third-party domains contacted (5)
pay.google.compayments.google.comaccounts.google.comgoogle.comgstatic.com
Frequently asked questions about Google Pay
Can't find your question? Write to us, we answer fast.
What cookies does Google Pay set?
Google Pay sets third party cookies on pay.google.com and accounts.google.com (NID, SID, HSID, SSID, APISID, SAPISID, GPS, CONSENT). The exact set depends on whether the user is logged in to Google.
Is consent required to display the Google Pay button?
Strictly necessary cookies are exempt under article 5(3) ePrivacy. The Google advertising and personalisation cookies that load with the button are not strictly necessary and require consent in most EU jurisdictions.
What is the legal basis for Google Pay?
Performance of a contract for the payment, legitimate interest for fraud prevention, consent for Google advertising and personalisation cookies.
What about US data transfers?
Google Payment EMEA Limited is in Dublin but processing involves Google LLC in the US. Transfers rely on EU SCCs and the Google DPF certification.
Do I need a DPIA for Google Pay?
A DPIA is recommended when Google Pay is paired with Google Ads conversion or Google Analytics enhanced ecommerce, when subscription billing is in use, or when sensitive verticals are processed.
How do I implement Google Pay compliantly?
Display the button only on checkout. Block it behind a CMP if shown earlier. Use Consent Mode v2. Sign the Google Pay merchant agreement and the Google DPA with EU SCCs.
What are the alternatives to Google Pay?
Apple Pay, Amazon Pay, PayPal Express, Shop Pay, Klarna Pay Now, GoCardless, Stripe Link, Adyen, Mollie or local methods (Bancontact, iDEAL, Sofort, Bizum).
How do I document Google Pay in my cookie policy?
List the Google cookies (NID, SID, HSID, SSID, APISID, SAPISID, GPS, CONSENT) with domain, duration and purpose. Identify Google Payment EMEA Limited and Google LLC as controllers. Describe the EU and US flows and the safeguards.
Eventlink
Eventlink is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Eventlink integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Eventlink helps organizations maintain robust websites that meet user expectations and technical requirements.
Vioma
Vioma is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Vioma enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Vioma empowers marketing teams to achieve measurable growth.
Foratable
Foratable is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Foratable provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Foratable helps deliver the right message to the right audience at the right time.
%20%20--%3E%0A%3Csvg%20height%3D%22100%25%22%20width%3D%22100%25%22%20version%3D%221.1%22%20id%3D%22Primary_Art%22%20%0A%09xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20%0A%09xmlns%3Axlink%3D%22http%3A%2F%2Fwww.w3.org%2F1999%2Fxlink%22%20x%3D%220px%22%20y%3D%220px%22%20viewBox%3D%220%200%20438.7%20512%22%20style%3D%22enable-background%3Anew%200%200%20438.7%20512%3B%22%20xml%3Aspace%3D%22preserve%22%3E%0A%09%3Cstyle%20type%3D%22text%2Fcss%22%3E%0A%09.st0%7Bfill%3Aurl(%23SVGID_1_)%3B%7D%0A%09%3C%2Fstyle%3E%0A%09%3ClinearGradient%20id%3D%22SVGID_1_%22%20gradientUnits%3D%22userSpaceOnUse%22%20x1%3D%22219.3559%22%20y1%3D%22514%22%20x2%3D%22219.3559%22%20y2%3D%222%22%20gradientTransform%3D%22matrix(1%200%200%20-1%200%20514)%22%3E%0A%09%09%3Cstop%20offset%3D%220%22%20style%3D%22stop-color%3A%23550088%22%2F%3E%0A%09%09%3Cstop%20offset%3D%221%22%20style%3D%22stop-color%3A%23FF7782%22%2F%3E%0A%09%3C%2FlinearGradient%3E%0A%09%3Cpath%20class%3D%22st0%22%20d%3D%22M267.5%2C34.2c82.8%2C0%2C127%2C38.4%2C127%2C66.2c0%2C2-0.8%2C3.1-1.4%2C3.6l-0.6%2C0.5l-0.6%2C0.6l-54.7%2C55l-36.3%2C36.5l47.7%2C19.2%0A%09c40.3%2C16.3%2C56.1%2C38%2C56.1%2C77.5c0%2C17-6.6%2C32.2-19.7%2C45.2l-99.6%2C99.9l-0.4%2C0.4l-0.3%2C0.4c-23.3%2C24.7-65.9%2C38.8-116.9%2C38.8%0A%09c-86.3%2C0-134-37.2-134-63c0-3.2%2C0.6-5.3%2C1.3-5.9l0.6-0.6l0.6-0.6l58.7-58.9l0.8-0.8l0.3-0.3l31.7-33.2L86%2C294.2%0A%09c-31.6-15.5-44.4-36.6-44.4-73c0-18.8%2C7.3-35.6%2C22-50l99.5-99.9l0.3-0.3l0.3-0.3C185.8%2C47.5%2C223.6%2C34.2%2C267.5%2C34.2%20M267.5%2C0%0A%09c-54.7%2C0-100.5%2C17.9-128.4%2C47.1L39.6%2C147c-20.2%2C19.8-31.9%2C45.4-31.9%2C74.2c0%2C57.1%2C27.5%2C86%2C63.5%2C103.7l0%2C0l-58.7%2C58.9%0A%09C4.5%2C391%2C0%2C401.7%2C0%2C414.9C0%2C462.6%2C62.9%2C512%2C168%2C512c62.2%2C0%2C112.6-18.7%2C141.6-49.5l99.5-99.9c19-18.8%2C29.6-42.5%2C29.6-69.3%0A%09c0-63.6-35-92-77.4-109.2l54.7-55c7.8-7.1%2C12.5-17.2%2C12.5-28.9C428.3%2C51%2C368.1%2C0%2C267.5%2C0L267.5%2C0z%22%2F%3E%0A%3C%2Fsvg%3E)
Swell
Swell is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Swell supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Swell ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Next Basket
Next Basket is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Next Basket integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Next Basket helps organizations maintain robust websites that meet user expectations and technical requirements.
TNS Payments
TNS Payments is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. TNS Payments integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, TNS Payments helps organizations maintain robust websites that meet user expectations and technical requirements.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.