Bolt

Overview

Bolt is a one-click checkout platform that accelerates the e-commerce purchase flow by maintaining a network of recognized shoppers whose payment and shipping details are stored securely across all Bolt-enabled merchants. When a returning Bolt shopper visits any merchant in the network, Bolt detects them via a persistent identity cookie, pre-fills their checkout details, and enables purchase completion with minimal friction. The platform serves direct-to-consumer brands, particularly in apparel, footwear, and consumer goods, that prioritize conversion rate optimization on their checkout pages.

Beyond checkout acceleration, Bolt also operates as a payment processor for some merchants and provides an account creation flow (Bolt Accounts) that allows first-time shoppers to save their details to the Bolt network during their initial purchase.

What This Script Does

Script loading: Bolt loads JavaScript from connect.bolt.com/track.js (for shopper recognition and analytics) and connect.bolt.com/embed.js (for the checkout widget). These scripts initialize when the page loads, not only when the visitor reaches checkout, because shopper recognition requires early detection.

Cross-merchant shopper recognition:

• _bolt_cid — Third-party persistent cookie set on the bolt.com domain, up to 1 year, stores an anonymized Bolt shopper identifier. This cookie is read on any Bolt-enabled merchant site to determine if the visitor is a recognized Bolt account holder. This is a cross-site identity mechanism by design — it is how Bolt recognizes shoppers across different merchants.
• _bolt_session — Session cookie on the bolt.com domain, maintains the active checkout session during a transaction
• First-party cookies may also be set on the merchant's domain to persist checkout state and cart recovery signals

Checkout module behavior:

• When a returning shopper is detected via _bolt_cid, the checkout widget pre-populates the visitor's saved email, shipping address, and payment method (card last four digits and type)
• The visitor authenticates via a one-time passcode (OTP) sent to their phone or email to confirm their identity before the stored payment details are used
• New shoppers are offered the option to save their details to Bolt during checkout, creating a Bolt account

Fraud detection:

• Browser fingerprinting signals (user agent, screen dimensions, timezone, language, installed fonts via canvas fingerprinting) are collected during checkout initialization for risk scoring
• Device intelligence is transmitted to Bolt's fraud scoring API at api.bolt.com

Cart recovery and analytics:

• Bolt may capture the visitor's email address from cart or checkout form fields before form submission (known as "email capture") to support abandoned cart recovery flows
• Conversion events and checkout funnel metrics are reported to the merchant via Bolt's analytics dashboard

Consent & Compliance

Bolt is categorized as essential and functional.

• Essential (payment processing): The cookies required to complete the checkout transaction that the visitor has initiated are strictly necessary and qualify for the ePrivacy exemption.
• Functional (shopper recognition): The _bolt_cid cross-merchant shopper identity cookie presents a nuanced consent question under GDPR/ePrivacy. While its purpose is to deliver a functional benefit (pre-filled checkout), it operates as a persistent cross-site identifier linking the visitor's identity across multiple unrelated merchants. EU DPA guidance on third-party persistent identifiers is relevant here — some regulators may classify this as requiring consent despite its functional framing.
• Email capture before submission: Capturing email addresses from checkout form fields before the visitor completes the form (for abandoned cart recovery) is a controversial practice under GDPR that may require consent or a robust legitimate interest assessment.
• CCPA/CPRA: The cross-merchant shopper identity network involves personal data (email, address, payment method) processed across multiple business entities. Merchants must disclose Bolt's role in their privacy policy. The cross-merchant data flow should be evaluated for "sharing" obligations under CPRA.
• EU-US Data Privacy Framework: Bolt (a US company) should be assessed for DPF participation or SCCs for EU personal data transfers.

Should You Block This Without Consent?

No. The core checkout functionality that Bolt provides is essential for completing transactions the visitor has initiated. Blocking Bolt would break the accelerated checkout experience entirely. However, EU-focused merchants should review the cross-merchant _bolt_cid cookie carefully and consult their DPA or legal counsel on whether explicit consent is required for this persistent cross-site identifier, given the strict interpretation of ePrivacy Article 5(3) by some European regulators.