Do I need consent to use Cashfree on my website?

No. Cashfree scripts are strictly necessary for processing payments the user has explicitly initiated. Session and fraud detection cookies are essential for checkout security. Under ePrivacy Directive Article 5(3) and India's DPDPA, payment processing cookies are exempt from consent requirements.

What cookies does Cashfree set?

Cashfree sets cfpl_session (session cookie maintaining checkout state during the payment flow) and cf_fraud (device fingerprint cookie for fraud detection across transactions). Scripts communicate with api.cashfree.com and payments.cashfree.com. Card data is handled within Cashfree's PCI DSS Level 1 environment.

How does ConsentStack manage Cashfree consent?

ConsentStack classifies Cashfree as essential and never blocks its scripts regardless of consent state. Payment processing and fraud detection are strictly necessary for the transaction the user has initiated. ConsentStack ensures Cashfree loads on all pages where it is present without any consent gate applied.

What tracker domains does Cashfree use?

ConsentStack has catalogued tracker domains for Cashfree including cashfree.com. These are the network destinations Cashfree's scripts contact, which a consent platform blocks until a visitor agrees.

Cashfree - Payment Gateway & Consent Classification

Back to Vendor Library

Overview

Cashfree Payments is one of India's leading payment gateways, supporting UPI, net banking, cards, wallets, and EMI options popular in the Indian market. The platform handles both payment collection (accepting payments from customers) and payouts (disbursing money to vendors, employees, or customers). Cashfree is particularly notable for its deep integration with India's Unified Payments Interface (UPI), including support for UPI AutoPay for recurring mandates.

What This Script Does

Cashfree's client-side integration loads scripts from sdk.cashfree.com to render payment forms and handle transaction authentication flows. The checkout experience varies by payment method:

UPI payments: The script generates a QR code or deep-links to UPI apps (GPay, PhonePe, Paytm) and polls for payment confirmation
Card payments: Renders PCI-compliant card input fields via iframes and handles 3D Secure authentication redirects
Net banking: Redirects the user to the selected bank's login page and handles the callback
Wallets/EMI: Manages the respective provider's authentication flow

Cookies set during payment processing:

cfpl_session — session cookie maintaining checkout state during the payment flow
cf_fraud — device fingerprint cookie used for fraud detection across transactions

The scripts communicate with api.cashfree.com and payments.cashfree.com. Data collected includes the payer's email, phone number (standard in Indian e-commerce), selected payment method, and device characteristics for fraud screening. Card data is handled within Cashfree's PCI DSS Level 1 certified environment and never reaches the merchant's servers.

Consent & Compliance

Cashfree is classified as essential. Its scripts are strictly necessary for processing payment transactions that the user has explicitly initiated. Under India's Digital Personal Data Protection Act (DPDPA) 2023, processing for fulfilling an obligation (completing a purchase) has a lawful basis. For sites with European visitors, ePrivacy Directive Article 5(3) exempts strictly necessary cookies from consent requirements.

Under CCPA/CPRA, Cashfree's transaction processing constitutes a business purpose. The fraud detection data collection falls under security operations exceptions in all major privacy frameworks.

Should You Block This Without Consent?

No. Cashfree scripts are essential for processing payments. Blocking them would prevent customers from completing purchases. Payment processing cookies are exempt from consent requirements as strictly necessary for a service the user has requested.

Is Cashfree GDPR compliant?

Cashfree's trackers are classified as essential (strictly necessary), so they are generally exempt from prior consent under the GDPR. You should still list them in your cookie policy and privacy notice so visitors know they are there.

Visit website