Klarna Checkout

What is Klarna Checkout

Klarna Checkout (KCO) is the all in one checkout solution from Klarna Bank AB, a Swedish licensed bank. It replaces the merchant's native checkout with a hosted iframe served from klarna.com. Inside the iframe the consumer chooses between immediate card payment, direct debit, Pay in 3, Pay in 30 days or instalment financing, and Klarna handles identification, payment processing, fraud checks and (for credit products) the lending decision. Merchants integrate Klarna Checkout via a snippet plus a back end REST API for order capture, refunds and order updates. Klarna also offers a separate Klarna Payments solution for merchants that prefer to keep their own checkout shell.

What data and cookies Klarna Checkout collects

At the page level, Klarna injects scripts and cookies (kp_session, klarna_eu_country, hp_session, datadome) for session management, geographic routing and fraud detection. Inside the iframe Klarna collects identity, address, contact details, payment method, basket contents, IP address, User Agent and a device fingerprint. For BNPL and instalment flows, Klarna queries internal scoring models and external credit bureaus or population registers, depending on the country. On site messaging widgets on product pages also set Klarna cookies before the user reaches checkout.

GDPR and ePrivacy implications

The Klarna On site messaging script and most analytics cookies set before the user enters checkout are not strictly necessary and require consent under Article 5(3) of the ePrivacy Directive. The core checkout cookies (kp_session, antifraude tokens) that fire only inside the active payment session are widely considered strictly necessary for the requested service. The processing of payment, identity and credit data is anchored on contract (Art. 6(1)(b) GDPR), AML obligations (Art. 6(1)(c)) and legitimate interest in fraud prevention (Art. 6(1)(f)). Automated credit scoring engages Article 22.

Is consent required

For the On site messaging widget and the analytics scripts loaded on the catalogue, yes. They should be blocked until consent is given. Inside the actual checkout, when the user has entered the Klarna iframe, the strictly necessary cookies do not require consent, but you must still inform the user about the data flows. Many European DPAs (CNIL, BfDI, datatilsynet) consider that Klarna acts as an independent controller for AML and credit checks, which the merchant must mention in the privacy policy.

Data transfers and recipients

Klarna Bank AB processes most data in Sweden and Ireland. Some products (notably US facing) involve Klarna Inc. in the United States. Subprocessors include AWS, Sift, Sentilink and Schufa (for Germany). Klarna publishes a data sharing table in its Customer Privacy Notice. EU US transfers rely on Standard Contractual Clauses and Klarna Inc.'s DPF certification where in scope. Merchants must list Klarna Bank AB and the relevant subprocessors in their privacy policy and explain how the dual controller status works in practice.

Practical compliance steps

Gate the On site messaging widget behind your consent manager, sign Klarna's data sharing terms (controller to controller for the lending decision), update the privacy policy with the Klarna recipients and the transfer mechanisms, and add the kp_session, klarna_eu_country and datadome cookies to the cookie policy. When a customer is rejected for BNPL, expose Klarna's contact for Article 22 review and ensure another payment method remains available.