FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

Stripe

EssentialOfficial website

Stripe is a leading global payment processing platform used by millions of businesses to accept online and in-person payments. For European businesses, Stripe processes payment data within the EU, is PCI DSS certified, and provides comprehensive GDPR compliance documentation including DPAs and SCCs. The primary legal basis for payment processing is contract performance. Stripe's fraud detection (Stripe Radar) uses device fingerprinting and behavioural signals, which constitutes additional personal data processing that is justified by legitimate interest and legal obligation.

Block Stripe until consentScan my site
Overview

What does Stripe do?

What is Stripe?

Stripe is a global technology company that builds economic infrastructure for the internet. Its core product is a payment processing platform that enables businesses to accept credit cards, debit cards, bank transfers, buy-now-pay-later options, and dozens of other payment methods online and in person. Stripe also provides products for billing and subscriptions (Stripe Billing), fraud prevention (Stripe Radar), identity verification (Stripe Identity), tax automation (Stripe Tax), and marketplace payments (Stripe Connect).

Personal data processed by Stripe

Stripe processes cardholder data (card number, expiry, CVV), billing addresses, email addresses, IP addresses, device fingerprints (for Stripe Radar fraud detection), transaction history, and for Stripe Identity: government ID images and selfies. The legal basis varies by data category: contract performance for payment processing, legal obligation for AML/KYC requirements, and legitimate interest for fraud prevention.

Stripe.js cookies and fraud detection

Stripe.js sets the __stripe_mid (machine ID, 1 year) and __stripe_sid (session ID, 30 minutes) cookies for fraud prevention via Stripe Radar. These are placed on the payment page domain, not as third-party cookies. The purpose is fraud detection and security, providing a legitimate interest legal basis. Most cookie consent frameworks exempt strictly necessary fraud prevention cookies from consent requirements, but this should be verified with your DPO.

EU data processing and PCI DSS

Stripe processes European payment transactions within the EU. Stripe is certified PCI DSS Level 1, the highest level of payment card security certification. Stripe's EU entity (Stripe Payments Europe, Limited) is an authorised payment institution regulated by the Central Bank of Ireland. This EU regulatory status means Stripe is subject to both GDPR and financial services regulation for European transactions.

Practical compliance steps

Sign the Stripe Data Processing Agreement from the Stripe Dashboard. Add Stripe to your privacy policy describing payment data processing, fraud detection, and the legal bases used. Include the Stripe.js fraud prevention cookies in your cookie policy (classified as strictly necessary security cookies). For Stripe Identity deployments, conduct a DPIA for identity document processing. Implement Stripe Customer deletion for erasure requests while respecting financial record retention requirements.

Compliance

Stripe and the GDPR

Legal basis
Contract performance (Art. 6(1)(b)) for payment processing as part of the purchase transaction. Legal obligation (Art. 6(1)(c)) for fraud prevention, AML, and financial regulatory requirements. Legitimate interest (Art. 6(1)(f)) for fraud detection (Stripe Radar). Consent for any optional marketing analytics features.
Risk level
medium
Applicable regulations
GDPR, PSD2, PCI DSS, AML/KYC regulations, SCCs for US transfers of non-payment analytics data

Impact assessment (DPIA)

A DPIA is generally not required for standard Stripe payment processing. It may become relevant for large-scale e-commerce platforms processing payment data at high volume, or for marketplaces where Stripe Connect involves multiple parties sharing financial data.

Sample text for your banner

Payments on this website are processed by Stripe. When you make a payment, Stripe collects your payment card information and billing details to process your transaction. Stripe also uses device information for fraud prevention. See our privacy policy and Stripe's privacy policy for full details.
Cookies and trackers

What Stripe sets and contacts

Tracking method
JavaScript (Stripe.js), payment processing cookies, fraud detection (Stripe Radar), device fingerprinting, browser telemetry for fraud prevention
Server location
United States and European Union (Stripe has EU data processing infrastructure)
Data transferred outside the EU
Stripe is a US-based payment platform with EU data processing infrastructure. Payment data for EU merchants is processed within the EU. Some fraud prevention and analytics functions may involve US processing. Stripe provides GDPR-compliant DPAs and SCCs. Stripe is certified under various financial compliance frameworks.

Cookies set (2)

NameTypeDurationPurpose
__stripe_midpersistent1 yearStripe machine identifier for fraud prevention via Stripe Radar, strictly necessary security cookie
__stripe_sidsession30 minutesStripe session identifier for fraud detection during active payment sessions

Third-party domains contacted (3)

  • stripe.com
  • js.stripe.com
  • api.stripe.com
Questions

Frequently asked questions about Stripe

Can't find your question? Write to us, we answer fast.

Is Stripe GDPR compliant?

Yes. Stripe provides a GDPR DPA, processes EU payment data within the EU via its Irish-regulated entity, and is PCI DSS Level 1 certified. Sign the Stripe DPA from the Stripe Dashboard before processing EU personal data.

What legal basis applies to Stripe payment processing?

Contract performance (Art. 6(1)(b)) for processing the payment transaction. Legal obligation (Art. 6(1)(c)) for fraud prevention, AML, and financial regulatory record-keeping. Legitimate interest (Art. 6(1)(f)) for Stripe Radar fraud scoring. No consent is required for standard payment processing.

Do Stripe.js cookies require consent?

The __stripe_mid and __stripe_sid cookies are strictly necessary for fraud prevention (Stripe Radar). Most GDPR implementations classify these as strictly necessary security cookies exempt from consent requirements. Verify this classification with your DPO and document the justification.

Does Stripe transfer EU payment data outside the EU?

Stripe processes European payment transactions via its EU-regulated Irish entity within the EU. Some ancillary services (analytics, ML model training) may involve US processing with SCCs. The core payment processing for EU merchants stays within the EU.

How do I add Stripe to my privacy policy?

Describe: that payments are processed by Stripe, the categories of data (payment card details, billing address, device information for fraud detection), the legal bases (contract performance, legal obligation, legitimate interest for fraud prevention), and link to Stripe's privacy policy.

Do I need a DPIA for Stripe?

Generally not for standard payment processing. A DPIA becomes relevant for: Stripe Identity (processing government ID images), large-scale marketplace deployments (Stripe Connect), or platforms processing payments for sensitive goods or services.

How do I handle customer data deletion requests for Stripe?

Delete the Stripe Customer object via the Stripe API (DELETE /v1/customers/{id}). Note that Stripe must retain certain transaction records for legal and financial compliance purposes (typically 7-10 years). Communicate to data subjects that financial transaction records have a mandatory retention period.

Does using Stripe make me GDPR compliant for payments?

Stripe being GDPR-compliant as a processor does not automatically make your platform compliant. You remain the data controller and must: sign the DPA, include Stripe in your privacy policy, have a lawful basis for payment data processing, and handle customer data subject requests appropriately.

Same category

More services: E-commerce

See the whole category

Matajer

Matajer is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Matajer supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Matajer ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Open eShop

Open eShop is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Open eShop supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Open eShop ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Synctrack

Synctrack is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Synctrack integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Synctrack helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

iPaper

iPaper is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. iPaper integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, iPaper helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Touch2Success

Touch2Success is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Touch2Success integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Touch2Success helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Shopserve

Estore Shopserve is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Estore Shopserve supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Estore Shopserve ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site