Stripe.js

What is Stripe.js?

Stripe.js is a JavaScript library provided by Stripe Inc. and loaded from js.stripe.com. It enables merchants to securely collect and tokenise payment card information directly in the browser, ensuring that raw card data never touches the merchant's servers. Beyond payment form handling, Stripe.js powers Stripe Radar, Stripe's machine-learning fraud detection and prevention system, by collecting device and behavioural signals that are used to score each transaction for fraud risk. Stripe.js is a foundational component of Stripe's payment infrastructure and is typically required for any site processing card payments via Stripe.

Cookies and Data Collected by Stripe.js

Stripe.js sets two named cookies: __stripe_mid, a machine identifier cookie with a duration of one year, and __stripe_sid, a session identifier cookie lasting 30 minutes. In addition to these cookies, Stripe.js collects an extensive device and behavioural fingerprint including browser type and version, installed plugins, screen resolution, time zone, mouse movement patterns, keystroke timing, and other signals. This fingerprint is used by Stripe Radar to build a fraud risk score for each transaction. Importantly, Stripe recommends loading Stripe.js on every page of a site (not just checkout pages) so that it can observe user behaviour from early in the session.

ePrivacy Directive and Consent Analysis

On payment pages, the __stripe_mid and __stripe_sid cookies and the Radar fingerprinting are strongly arguable as strictly necessary for the payment processing service that the user has explicitly requested: the ePrivacy Directive Art. 5(3) exemption applies. However, loading Stripe.js site-wide on non-payment pages (e.g. homepages, blog posts, product listings) before any purchase intent is expressed is a different matter. This broader deployment collects fingerprinting data outside the payment context, which is harder to justify as strictly necessary and is legally contested. Several EU data protection authorities have signalled that always-on fraud fingerprinting beyond the payment page context may require consent or at minimum a rigorous legitimate interest assessment.

GDPR Legal Basis and Data Transfers to the US

For payment-page-only deployment, the legal basis is legitimate interest (Art. 6(1)(f) GDPR) and performance of a contract (Art. 6(1)(b)), since fraud detection is a legitimate interest that is necessary and proportionate to protecting payment transactions. For site-wide deployment, a legitimate interest balancing test must document that the interests of Stripe and the merchant in fraud prevention outweigh user privacy interests and that the data subject would reasonably expect this processing. Data is transferred to Stripe Inc. in the United States. Stripe uses Standard Contractual Clauses (SCCs) as the transfer mechanism and provides a Data Processing Addendum. A DPA with Stripe is required under GDPR Art. 28.

Risk Assessment for European Merchants

The compliance risk for Stripe.js is rated medium. When confined to payment pages, the risk is relatively low and the strictly necessary or legitimate interest basis is defensible. The risk increases when Stripe.js is loaded site-wide, because the fraud fingerprinting then occurs on all pages including those unrelated to payment, widening the scope of personal data collection. Merchants that embed Stripe.js globally should document their legitimate interest assessment, inform users of this processing in their privacy policy, and consider whether a DPIA is warranted.

Practical Compliance Steps for European Merchants

To comply with GDPR and ePrivacy when using Stripe.js: sign a Data Processing Addendum with Stripe; disclose Stripe.js in your privacy policy including the cookies set, the fraud detection purpose, and the US data transfer via SCCs; if loading Stripe.js site-wide, document and publish a legitimate interest assessment for the broader fingerprinting; consider restricting Stripe.js to payment-related pages to minimise risk; add __stripe_mid and __stripe_sid to your cookie policy under a security or strictly necessary category (if payment-page only) or flag them for a LIA (if site-wide); and review Stripe's DPA and sub-processor list periodically.