Authorize.net

Overview

Authorize.net is a payment gateway owned by Visa that enables e-commerce websites to process credit card and electronic check transactions. It is one of the oldest and most widely used payment gateways in North America, processing billions of dollars in transactions annually. When integrated into a checkout page, Authorize.net's scripts handle the sensitive task of collecting, tokenizing, and transmitting payment card data directly to Authorize.net's servers, keeping the merchant's own backend out of scope for PCI DSS compliance.

Authorize.net supports multiple integration methods, from simple hosted payment forms (Accept Hosted) to embedded JavaScript tokenization (Accept.js), giving merchants flexibility in how payment collection appears to their customers.

What This Script Does

When Authorize.net is integrated on a checkout page, the following occurs:

• Payment form rendering: Depending on the integration method, Authorize.net either loads a hosted payment form in an iframe or provides JavaScript (Accept.js) that tokenizes card data entered into the merchant's own form fields.
• Card tokenization: The visitor's credit card number, expiration date, and CVV are captured and immediately tokenized — converted into a one-time-use payment nonce that the merchant's server can use to complete the transaction without ever handling raw card data.
• Fraud detection: Authorize.net collects device fingerprint data (browser type, screen resolution, timezone, installed plugins) to feed into its fraud detection and risk scoring systems. This helps identify potentially fraudulent transactions.
• Direct server communication: Payment data is transmitted directly from the visitor's browser to Authorize.net's PCI-compliant servers over encrypted HTTPS connections. This direct communication is a core security feature.
• Session management: The scripts may set session-related cookies or tokens to maintain the payment flow state during the checkout process.

Authorize.net scripts handle only payment-related data and do not perform marketing tracking, behavioral profiling, or cross-site identification.

Consent & Compliance

Payment processing scripts like Authorize.net fall into the "strictly necessary" category under virtually all privacy frameworks. The ePrivacy Directive explicitly exempts services that are strictly necessary to provide a service explicitly requested by the user — and completing a purchase that the visitor has initiated clearly qualifies.

The device fingerprinting for fraud detection is integral to the payment processing service and is required by payment industry regulations (PCI DSS). This fraud prevention functionality is inseparable from the payment service itself and does not require separate consent.

Authorize.net is PCI DSS Level 1 certified, the highest level of payment security certification. Its scripts are specifically designed to reduce the merchant's PCI compliance burden by ensuring raw card data never touches the merchant's servers.

Should You Block This Without Consent?

No. Authorize.net is an essential payment processing service. Blocking it would prevent customers from completing purchases. Payment processing scripts are universally recognized as strictly necessary and exempt from consent requirements.