Gumroad

Overview

Gumroad is a commerce platform built for independent creators — writers, musicians, software developers, illustrators, educators, and filmmakers who sell digital products, memberships, courses, and physical goods directly to their audiences. Rather than building a full storefront, creators embed Gumroad's checkout experience on their own websites and social media, allowing buyers to purchase without leaving the page.

Gumroad handles everything involved in a digital commerce transaction: payment collection, tax calculation and remittance (including VAT/GST for digital goods in the EU, UK, Australia, and other jurisdictions), digital file delivery, license key generation, and subscription access management. It is a turnkey e-commerce backend for individual creators.

What This Script Does

Gumroad's scripts (gumroad.com/js/gumroad.js) embed product cards, purchase buttons, and overlay checkout flows on creator websites:

Product card and button rendering: The script renders styled product cards and purchase buttons that display product names, prices, and brief descriptions inline on the creator's page. These are fetched from Gumroad's product API and rendered client-side.

Overlay checkout flow: When a visitor clicks a purchase button, the script launches a full checkout overlay (an iframe or modal) that handles the complete transaction without leaving the page. The overlay displays detailed product information, collects the buyer's email address, processes payment through Gumroad's PCI-compliant hosted payment fields, applies discount codes, handles VAT collection based on buyer location, and manages transaction completion.

PCI-compliant payment collection: Card numbers are entered directly into Gumroad's hosted payment fields within the checkout overlay. Card data never passes through the creator's website server. Gumroad is responsible for PCI compliance for the payment collection step.

Digital delivery and access management: After successful payment, Gumroad's scripts manage the immediate delivery of digital products — displaying download links, sending delivery emails, and generating license keys for software products. For subscription and membership products, the scripts handle authentication tokens that verify access to gated content on subsequent visits.

Session cookies: Cookies maintain checkout state across the purchase flow (cart contents, payment step progress) and verify buyer identity for license validation and content access. These are strictly functional session-scoped cookies tied to an active purchase interaction.

Tax compliance: Gumroad calculates and collects VAT/GST on digital goods sold to buyers in the EU, UK, Australia, Canada, and other jurisdictions with digital services taxes. This calculation happens within the checkout overlay using the buyer's self-reported location.

Consent & Compliance

Gumroad scripts are essential commerce infrastructure:

• GDPR / ePrivacy: Scripts strictly necessary for a service explicitly requested by the user are exempt from prior consent requirements under the ePrivacy Directive. A buyer clicking a purchase button is explicitly requesting the checkout service. Payment processing, digital delivery, and access verification are all strictly necessary for that service. Gumroad acts as a data controller for buyer data (email, payment info) under its own privacy policy.
• EU VAT / Digital Services: Gumroad handles EU VAT compliance for digital goods sales, collecting and remitting VAT to the appropriate EU member state tax authorities on behalf of creators.
• CCPA: Buyer data (email address, purchase history) constitutes personal information under CCPA. Creators should reference Gumroad as a service provider in their privacy policies.

Should You Block This Without Consent?

No. Gumroad scripts provide essential e-commerce functionality — checkout, payment processing, and digital product delivery — that is strictly necessary for completing purchases visitors explicitly initiate. Blocking Gumroad would make purchases impossible and break the core commercial function of the page.