Stripe

Overview

Stripe is the leading payment processing infrastructure provider for online businesses. Stripe.js handles secure card tokenization, renders payment input elements in isolated iframes, manages 3D Secure and Strong Customer Authentication flows, and runs fraud detection heuristics to assess transaction risk — all in the browser on the merchant's checkout page.

What This Script Does

Script Loading Stripe.js must be loaded from js.stripe.com/v3/ (Stripe's canonical URL) to qualify for PCI-DSS compliance. Loading Stripe from a local copy or any other domain breaks PCI compliance. The script file itself is stripe.js (or stripe.esm.js for ES module imports).

Stripe Elements (Hosted Input Fields) Stripe Elements renders secure card input fields as iframes hosted on Stripe's domain (js.stripe.com). This means raw card numbers, expiry dates, and CVV codes are entered directly into Stripe-controlled iframes and never touch the merchant's JavaScript execution environment or servers. The merchant's page communicates with the Stripe iframe via postMessage.

Elements rendered:

• Card Number, Expiry, and CVV fields (separate or combined CardElement)
• PaymentElement — a smart form that shows the appropriate payment methods for the customer's location (cards, SEPA Direct Debit, iDEAL, BLIK, etc.)
• AddressElement — address collection with postal validation
• PaymentRequestButton — Apple Pay and Google Pay button

Payment Processing Flow

1. Customer enters card details in the hosted iframe
2. Stripe.js calls stripe.createToken() or stripe.createPaymentMethod() — card data is sent directly to Stripe's servers at api.stripe.com
3. Stripe returns a one-time use token or Payment Method ID
4. The merchant's JavaScript submits this token/ID to the merchant's server
5. The merchant's server charges the card via the Stripe API server-to-server

3D Secure and SCA For payments requiring 3D Secure authentication, Stripe.js opens an iframe or popup to the card's issuer bank authentication page. The SDK manages the redirect flow and confirmation via stripe.handleCardAction() or stripe.confirmPayment(). Domains involved include hooks.stripe.com and issuer bank authentication URLs.

Fraud Detection Stripe.js collects browser signals to power Stripe Radar fraud detection:

• Browser fingerprint: User-Agent, screen dimensions, timezone, language, installed plugins
• Behavioral signals: mouse movement entropy, keystroke timing on payment fields
• Device signals: touch capability, hardware concurrency, memory class
• Network signals: IP address and connection type (collected server-side) These signals are sent to q.stripe.com for risk scoring. Stripe Radar uses this data to assign a fraud risk score to each payment attempt.

Cookies set (on stripe.com domain):

• __stripe_mid (first-party on stripe.com, 1 year) — machine identifier for fraud detection
• __stripe_sid (first-party on stripe.com, 30 minutes) — session identifier for fraud detection

These cookies are set under stripe.com, not the merchant domain. On the merchant domain, Stripe.js does not set cookies — it uses the iframe isolation boundary.

Domains contacted: js.stripe.com, api.stripe.com, q.stripe.com, hooks.stripe.com, r.stripe.com (error reporting)

Consent & Compliance

GDPR/ePrivacy: Stripe.js is necessary for processing payments, covered by contractual necessity under GDPR Article 6(1)(b). Fraud detection processing is justified under legitimate interest (Article 6(1)(f)) — Stripe and the merchant both have a legitimate interest in preventing fraudulent transactions. Cookies set under stripe.com during a payment flow initiated by the user fall under the ePrivacy strictly necessary exemption for cookies needed to complete a user-requested transaction. Stripe acts as a data processor for the merchant and as an independent controller for fraud and risk data.

CCPA/CPRA: Payment data processing for transaction completion and fraud prevention is a necessary business operation exempt from opt-out requirements under CCPA.

EU-US Data Transfers: Stripe Inc. participates in the EU-US Data Privacy Framework (DPF) and offers Standard Contractual Clauses for EU payment data processing by Stripe's US entity.

PCI-DSS: Stripe.js's iframe architecture is designed to limit the merchant's PCI-DSS scope to SAQ A, the lowest level, as raw card data never enters the merchant's environment.

Consent category: Essential (payment processing) and Functional (saved payment methods, address collection).

Should You Block This Without Consent?

No. Stripe.js provides essential payment processing infrastructure. Blocking it prevents customers from completing purchases and renders the checkout page non-functional. The fraud detection data collection is a necessary security measure for payment processing under both GDPR legitimate interest and CCPA business necessity. Disclose Stripe as a payment processor in the site's privacy policy.