Mastercard

What Mastercard does on a merchant site

Mastercard appears on European e, commerce sites in two distinct shapes. The first is the Mastercard JavaScript SDK that some Payment Service Providers (Adyen, Stripe, Worldpay) load inside the checkout page to tokenise card numbers client side. The second is the redirect to idcheck.mastercard.com that performs 3D Secure 2 strong customer authentication. Both flows process personal data and may set cookies, so they need to be mapped before any DPIA or privacy notice can be considered complete.

Cookies and signals collected

During Mastercard Identity Check, the cardholder browser receives Akamai cookies (AKA_A2, bm_sz, _abck) used for bot detection, Adobe Analytics cookies (s_cc, s_sq, AMCV_*) used to measure Mastercard pages, and an IDS cookie that remembers a frictionless authentication outcome. The Mastercard 3DS server also collects the device fingerprint (browser version, language, screen size, time zone), the user agent and the public IP address of the cardholder, plus the merchant identifier and transaction amount. Cardholder names and PANs are pseudonymised through the Mastercard token vault but are still personal data under the GDPR.

GDPR, PSD2 and ePrivacy basis

For the payment itself, the lawful basis is Article 6(1)(b) GDPR (contract performance) reinforced by Article 6(1)(c) for the PSD2 obligation of strong customer authentication. For fraud scoring, Mastercard and the merchant rely on Article 6(1)(f) GDPR (legitimate interest). The cookies set on idcheck.mastercard.com qualify as strictly necessary under Article 5(3) of the ePrivacy Directive because they are essential to deliver the authentication service explicitly requested by the user, so no banner is required for them. Any additional analytics layer placed by the merchant on its own checkout page does require consent.

Transfers to the United States

Mastercard International Inc. is established in Purchase, New York. Authentication and fraud data routinely transit Mastercard data centres in the United States and may be replicated to its global processing network. The transfer relies on Standard Contractual Clauses signed with the merchant or its acquirer, supplemented by the EU, US Data Privacy Framework where Mastercard subsidiaries are certified. European supervisory authorities expect a Transfer Impact Assessment that documents US surveillance exposure (FISA 702, EO 12333) and any supplementary measures.

Implementation checklist

Map every Mastercard touchpoint (SDK, iframe, redirect) in your processing register. Reference Mastercard International Inc. as a recipient in your privacy notice and add the United States to your list of destinations. Sign the Mastercard Data Processing Addendum through your acquirer. Document the legal basis split (contract for payment, legitimate interest for fraud). Exclude Mastercard 3DS cookies from your consent banner because they are strictly necessary, but never bundle them with analytics or marketing tags loaded from the same domain.