Cashfree

Overview

Cashfree Payments is one of India's leading payment gateways, supporting UPI, net banking, cards, wallets, and EMI options popular in the Indian market. The platform handles both payment collection (accepting payments from customers) and payouts (disbursing money to vendors, employees, or customers). Cashfree is particularly notable for its deep integration with India's Unified Payments Interface (UPI), including support for UPI AutoPay for recurring mandates.

What This Script Does

Cashfree's client-side integration loads scripts from sdk.cashfree.com to render payment forms and handle transaction authentication flows. The checkout experience varies by payment method:

• UPI payments: The script generates a QR code or deep-links to UPI apps (GPay, PhonePe, Paytm) and polls for payment confirmation
• Card payments: Renders PCI-compliant card input fields via iframes and handles 3D Secure authentication redirects
• Net banking: Redirects the user to the selected bank's login page and handles the callback
• Wallets/EMI: Manages the respective provider's authentication flow

Cookies set during payment processing:

• cfpl_session — session cookie maintaining checkout state during the payment flow
• cf_fraud — device fingerprint cookie used for fraud detection across transactions

The scripts communicate with api.cashfree.com and payments.cashfree.com. Data collected includes the payer's email, phone number (standard in Indian e-commerce), selected payment method, and device characteristics for fraud screening. Card data is handled within Cashfree's PCI DSS Level 1 certified environment and never reaches the merchant's servers.

Consent & Compliance

Cashfree is classified as essential. Its scripts are strictly necessary for processing payment transactions that the user has explicitly initiated. Under India's Digital Personal Data Protection Act (DPDPA) 2023, processing for fulfilling an obligation (completing a purchase) has a lawful basis. For sites with European visitors, ePrivacy Directive Article 5(3) exempts strictly necessary cookies from consent requirements.

Under CCPA/CPRA, Cashfree's transaction processing constitutes a business purpose. The fraud detection data collection falls under security operations exceptions in all major privacy frameworks.

Should You Block This Without Consent?

No. Cashfree scripts are essential for processing payments. Blocking them would prevent customers from completing purchases. Payment processing cookies are exempt from consent requirements as strictly necessary for a service the user has requested.