Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Google Pay is a digital wallet and online payment service that lets users pay on third party sites with card details stored in their Google account.
Google Pay is the digital wallet and online payment service of Google. For European buyers, the payment leg is operated by Google Payment EMEA Limited, an Irish E-Money Institution supervised by the Central Bank of Ireland. On the web, merchants integrate Google Pay through the Google Pay JavaScript API or the Web Payments Request API, which displays a button that opens a Google sheet pre filled with the user payment methods, addresses and contact details from their Google account.
Loading the Google Pay button drops third party cookies on pay.google.com and accounts.google.com (NID, SID, HSID, SSID, APISID, SAPISID, GPS for ad targeting if the user is signed in to Google). The Google Pay API receives the merchant ID, the amount, the currency, the country, the supported card networks and the customer billing and shipping requirements. On click, Google returns an encrypted payment token bound to the merchant for the gateway to process.
Strictly necessary cookies for the Google Pay button to function fall under the article 5(3) ePrivacy exemption. However Google sets a number of cookies on pay.google.com and accounts.google.com that go beyond the payment itself (advertising, sign in continuity, personalisation). CNIL and other EU regulators expect merchants to either delay the button until consent or to use the rendering options that limit Google cookies before click.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Render the Google Pay button on the checkout page only. Avoid loading pay.google.com scripts on browse or category pages. Wrap the button behind a CMP gate if it is displayed before consent. Use the Google Consent Mode v2 if you integrate Google Pay with Google Ads or Google Analytics, so that ad_storage and analytics_storage signals propagate correctly. Inform users in your privacy notice that Google Payment EMEA Limited and Google LLC process the payment.
For EEA buyers, Google Payment EMEA Limited operates from Dublin. Card processing, tokenisation and fraud detection can involve Google entities globally including the United States. Transfers rely on EU SCCs and the Google LLC DPF certification under the EU US Data Privacy Framework. Document the transfer mechanism in your records of processing activities.
Sign the Google Pay merchant agreement and the Google DPA with EU SCCs. Display the button only on checkout. Avoid loading Google Pay scripts on non checkout pages. Use Consent Mode v2 to propagate the user choices. Categorise Google Pay cookies as Strictly Necessary and Google advertising cookies as Marketing. Identify Google Payment EMEA Limited and Google LLC as joint or independent controllers in your privacy notice.
Websites using Google Pay must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended whenever Google Pay is paired with other Google services on the merchant site (Google Ads conversion tracking, Google Analytics enhanced ecommerce, Google Sign In), when the merchant runs subscription billing, or when sensitive sectors are processed.
Sample consent text
We use Google Pay to let you check out with the card details stored in your Google account. Loading the Google Pay button sets Google cookies and shares payment data with Google Payment EMEA Limited in Ireland and Google LLC in the United States. Payment cookies are strictly necessary, additional Google cookies for advertising or analytics only load if you grant consent.
Third-party domains contacted
pay.google.compayments.google.comaccounts.google.comgoogle.comgstatic.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| NID | Strictly Necessary | 6 months | Google identifier used to remember user preferences and authentication state in Google services, including Google Pay. |
| SID | Strictly Necessary | 2 years | Google session identifier used to authenticate the user in Google Pay. |
| HSID | Strictly Necessary | 2 years | Companion to SID, used by Google for session protection against forged credentials. |
| SSID | Strictly Necessary | 2 years | Companion to SID used by Google to bind the session to a secure context. |
| APISID | Strictly Necessary | 2 years | Google API session identifier required to call Google Pay APIs while authenticated. |
| SAPISID | Strictly Necessary | 2 years | Hashed companion to APISID for secure API authentication. |
| GPS | Marketing | 30 minutes | Google identifier used for geolocation and ad personalisation when the user is signed in to Google. |
| CONSENT | Functional | 2 years | Stores the user consent state for Google services, including cookies and personalised content. |
Google Pay uses cookies for user preferences — inform visitors with a consent banner.
Google Pay sets third party cookies on pay.google.com and accounts.google.com (NID, SID, HSID, SSID, APISID, SAPISID, GPS, CONSENT). The exact set depends on whether the user is logged in to Google.
Strictly necessary cookies are exempt under article 5(3) ePrivacy. The Google advertising and personalisation cookies that load with the button are not strictly necessary and require consent in most EU jurisdictions.
Performance of a contract for the payment, legitimate interest for fraud prevention, consent for Google advertising and personalisation cookies.
Google Payment EMEA Limited is in Dublin but processing involves Google LLC in the US. Transfers rely on EU SCCs and the Google DPF certification.
A DPIA is recommended when Google Pay is paired with Google Ads conversion or Google Analytics enhanced ecommerce, when subscription billing is in use, or when sensitive verticals are processed.
Display the button only on checkout. Block it behind a CMP if shown earlier. Use Consent Mode v2. Sign the Google Pay merchant agreement and the Google DPA with EU SCCs.
Apple Pay, Amazon Pay, PayPal Express, Shop Pay, Klarna Pay Now, GoCardless, Stripe Link, Adyen, Mollie or local methods (Bancontact, iDEAL, Sofort, Bizum).
List the Google cookies (NID, SID, HSID, SSID, APISID, SAPISID, GPS, CONSENT) with domain, duration and purpose. Identify Google Payment EMEA Limited and Google LLC as controllers. Describe the EU and US flows and the safeguards.