Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Laybuy is a buy now pay later (BNPL) provider that lets shoppers spread a purchase over six interest free weekly payments. When a merchant adds the Laybuy widget or checkout, it sets cookies for session handling, fraud prevention and conversion attribution and runs an eligibility check. Under the GDPR and the ePrivacy Directive, its non essential cookies require prior consent, although its main data locations benefit from EU adequacy decisions.
Laybuy is a buy now pay later service, founded in New Zealand and active in markets including the United Kingdom, that lets shoppers split a purchase into six interest free weekly instalments. Merchants offer it as a payment option through a widget on product and checkout pages, and shoppers pass an eligibility check before the order is confirmed.
When the Laybuy widget loads it sets cookies for session handling, fraud prevention and conversion attribution and reads device data such as IP address and browser. To approve instalments, Laybuy processes identity, contact and order data and performs an affordability and fraud assessment. Some cookies are persistent identifiers used to recognise the device and attribute the sale.
The attribution and fraud cookies are not strictly necessary, so storing them is governed by Article 5(3) of the ePrivacy Directive and requires consent. The instalment decision can involve an affordability assessment that profiles the shopper, triggering GDPR transparency duties about any automated decision and its effects.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Block Laybuy non essential cookies until the shopper accepts them through a Consent Management Platform, while cookies strictly necessary to complete a requested payment may load. Log consent, inform shoppers about the affordability assessment, and let them refuse non essential tracking as easily as they accept it.
Laybuy processes data in the United Kingdom and New Zealand. Both jurisdictions benefit from European Commission adequacy decisions, so transfers from the EU are permitted without additional safeguards such as Standard Contractual Clauses. You should still record these transfers and confirm that no processing takes place in a non adequate country.
List the Laybuy cookies and domains in your cookie policy, classify them and gate non essential ones behind consent. Clarify the controller roles with Laybuy, sign the appropriate terms, and inform shoppers about the affordability check and their rights. Keep the transfer documentation up to date and review the integration after any change.
Websites using Laybuy must obtain user consent under GDPR regulations.
DPIA considerations
Laybuy processes identity, contact, device and order data to assess eligibility and prevent fraud, and sets cookies including persistent identifiers for attribution. Key DPIA considerations: (1) the affordability assessment can amount to profiling with significant effects; (2) fraud and device cookies create persistent identifiers; (3) data is processed in the United Kingdom and New Zealand, both covered by an adequacy decision, which lowers transfer risk; (4) the merchant and Laybuy must define their controller roles. A DPIA remains advisable because of the financial profiling involved.
Sample consent text
We offer Laybuy so you can pay in six interest free weekly instalments. The Laybuy checkout sets cookies and processes your identity, device and order data to assess eligibility and prevent fraud. You can withdraw your consent to non essential cookies at any time through our cookie settings.
Third-party domains contacted
laybuy.comapi.laybuy.comcdn.laybuy.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| laybuy_session | Functional | Session | Maintains the shopper session through the Laybuy instalment checkout. |
| _lb_attr | Attribution / Analytics | 1 year | Persistent identifier used to attribute completed orders and recognise returning devices. |
| lb_fraud | Security | 6 months | Supports device recognition and fraud prevention during the eligibility check. |
Laybuy uses cookies for user preferences — inform visitors with a consent banner.
Laybuy sets cookies for session handling, fraud prevention and conversion attribution. The attribution and fraud cookies are persistent identifiers that are not strictly necessary, so they require consent, while a narrow set needed to complete a requested payment may be treated as essential.
Yes for the non essential cookies. The attribution and tracking cookies Laybuy sets need prior consent under the GDPR and the ePrivacy Directive, so they should not load until the shopper accepts. Cookies strictly necessary to process a requested payment can rely on a different basis.
Consent under Article 6(1)(a) GDPR covers the attribution cookies, while processing needed to provide the instalment service the shopper requested can rely on contract under Article 6(1)(b). Fraud prevention may rely on legitimate interest, with care taken over any profiling that has significant effects.
Laybuy processes data in the United Kingdom and New Zealand, both of which benefit from EU adequacy decisions, so EU transfers are permitted without extra safeguards. You should still document the transfers and verify that no processing occurs in a country without adequacy.
A DPIA is advisable because the affordability assessment can amount to profiling with significant effects, even though the transfer risk is reduced by adequacy. Documenting the purposes, the logic of automated decisions and the safeguards supports Article 35 GDPR compliance.
Add Laybuy through a CMP that blocks non essential cookies until consent, keep payment essential cookies separate, and disclose everything in your notices. Define the controller relationship, sign the relevant terms and explain the affordability check to shoppers.
Other BNPL providers include Klarna, Clearpay, Scalapay and Alma, some of which are European. All involve an eligibility assessment and tracking cookies, so the compliance approach is similar; the main difference is where each provider processes data.
Describe the Laybuy cookies, their purpose and duration, list the Laybuy domains, and note that data is processed in the UK and New Zealand under adequacy decisions. Explain the affordability assessment in your privacy notice and keep both aligned with the integration.