Sift

What is Sift?

Sift is a machine learning-based fraud prevention and trust and safety platform used by major e-commerce platforms, fintech companies, and online marketplaces. It provides real-time risk scoring for account creation, logins, payments, and other user actions. The Sift Beacon JavaScript snippet collects detailed device and behavioural signals from every page, building a continuous risk profile for each user. When integrated with a website, Sift can automatically block or flag suspicious activity based on its global network of fraud signals across thousands of client platforms.

What data does Sift collect?

Sift collects an extensive range of signals including IP address, browser type and version, operating system, screen resolution, installed fonts, device identifiers, mouse movement patterns, keystroke dynamics, scroll behaviour, click patterns, session duration, navigation history within the site, and network characteristics. It also collects user account attributes, transaction details, and behavioural velocity metrics. This combination of device fingerprinting and behavioural biometrics creates a highly granular individual profile used to generate risk scores.

GDPR and ePrivacy implications

Sift's GDPR compliance is more complex than most third-party tools because fraud prevention has specific provisions. GDPR Recital 47 acknowledges fraud prevention as a legitimate interest, which means organisations may not always need consent for the underlying risk scoring. However, the ePrivacy Directive still requires consent for cookies set on users' devices, regardless of the purpose. Furthermore, when Sift's risk scores lead to automated decisions that significantly affect users (account suspension, transaction blocking), Article 22 on automated decision-making applies, requiring additional safeguards.

Consent and legitimate interest

For cookie-based tracking, consent is required under the ePrivacy Directive before Sift sets cookies. For the broader data processing (IP, device fingerprinting, behavioural signals), legitimate interest under Article 6(1)(f) may apply if a documented balancing test demonstrates that fraud prevention overrides individual privacy interests in the specific context. This balancing test must be recorded in your Records of Processing Activities. Users must still be informed of the processing in your privacy policy and given the right to object.

Data transfers outside the EU

Sift processes all data on US infrastructure with no EU data residency option. This is a third-country transfer under GDPR Chapter V. Standard Contractual Clauses are the applicable transfer mechanism. The transfer is particularly sensitive given that Sift shares risk signals across its global network of clients, meaning individual user data may contribute to risk assessments used by other organisations. This network effect should be disclosed in your privacy policy and assessed in your DPIA.

Practical compliance steps

To use Sift compliantly: obtain consent before loading the Sift Beacon snippet; document your legitimate interest balancing test for the broader fraud detection processing; conduct a DPIA given the automated decision-making and device fingerprinting; update your privacy policy to disclose Sift as a processor, describe the fraud prevention processing, and explain the US transfer; sign a DPA with Sift; implement meaningful safeguards for automated decisions (human review option, right to object); and document all processing in your RoPA.