PayPal Credit

What is PayPal Credit

PayPal Credit is the consumer credit and pay later product offered by PayPal. Depending on the market it appears as PayPal Credit (UK revolving credit), Pay in 3 (UK, Germany, France, Italy, Spain, Netherlands), Pay in 4 (US, Australia) or Ratenzahlung (Germany). It is displayed by the PayPal SDK at checkout, as a Smart Button or as messaging next to the price. PayPal (Europe) S.a r.l. et Cie, S.C.A. is the data controller for EU customers.

Data and cookies collected

PayPal processes name, email, billing and shipping address, IP address, device data, browser fingerprint, transaction amount, basket contents passed by the merchant, and any credit assessment inputs (income or credit reference data depending on the market). The PayPal SDK and Smart Buttons set first party cookies on paypal.com, paypalobjects.com and paypal-objects.com, including risk session cookies (tsrce, ts_c, x-pp-s, l7_az) used for fraud detection. Some pay later messaging components load additional ad and analytics cookies.

GDPR and ePrivacy implications

PayPal (Europe) is the data controller for EU customers, with the merchant acting as joint controller for some processing (e.g. transmitting checkout data). The PayPal SDK loads from paypal.com when the merchant page is rendered, even before the customer clicks. Under Art. 5(3) ePrivacy and the EDPB guidelines, the SDK loader itself can be considered to trigger third party data processing requiring consent unless it is strictly necessary for a payment that the user has already started.

Consent requirements

Pay later messaging that appears on product or category pages (not yet a checkout) generally requires consent because it loads PayPal scripts and tracks impressions for personalisation. The Smart Buttons at checkout itself can rely on contract necessity, but any cookies that are not strictly needed for completing the payment must be loaded only after consent. Disclose PayPal as data controller in the privacy notice and provide a link to PayPal's own privacy statement.

Data transfers outside the EEA

PayPal (Europe) processes data primarily in Luxembourg and other EU locations, but shares data with PayPal Holdings Inc. in the United States and other affiliates for fraud, credit modelling and regulatory compliance. PayPal is certified under the EU US Data Privacy Framework, and Standard Contractual Clauses apply where applicable. Information sharing for risk and compliance includes data being made available to PayPal Pte. Ltd. in Singapore and other group entities.

Practical compliance steps

Load the PayPal SDK only after consent if you display pay later messaging on product pages, distinguish between checkout SDK (contract necessity) and marketing messaging (consent), disclose PayPal (Europe) as a separate controller and PayPal Holdings as a recipient in the United States, reference SCCs and the EU US Data Privacy Framework, comply with Consumer Credit Directive pre contractual information requirements where applicable, and ensure the credit option is presented neutrally without dark patterns.