Does CyberSource require consent to load?

No. CyberSource handles payment transactions explicitly initiated by the customer. Both the hosted payment form and fraud screening fall under the strictly necessary exemption — blocking them would prevent customers from completing purchases.

What data does CyberSource collect during checkout?

CyberSource captures card data within PCI-compliant iframes, tokenizes payment credentials, and collects device fingerprints including browser characteristics, screen resolution, timezone, and behavioral signals for fraud risk scoring via Decision Manager.

How does ConsentStack categorize CyberSource?

ConsentStack marks CyberSource as essential. It loads unconditionally regardless of visitor consent state, as it is required infrastructure for completing customer-initiated payment transactions and cannot be deferred without breaking checkout.

What tracker domains does CyberSource use?

ConsentStack has catalogued tracker domains for CyberSource including cybersource.com. These are the network destinations CyberSource's scripts contact, which a consent platform blocks until a visitor agrees.

CyberSource - Payment Security & Cookie Consent

Back to Vendor Library

Overview

CyberSource, a Visa subsidiary, is one of the world's largest payment management platforms, processing transactions for businesses of every size across virtually every payment method and geography. When CyberSource's scripts appear on merchant websites, they serve two critical functions: rendering secure payment forms that keep card data off the merchant's servers, and running device fingerprinting for fraud detection.

The dual nature of CyberSource's scripts — essential payment processing combined with sophisticated fraud screening — makes it a foundational component of enterprise e-commerce infrastructure.

What This Script Does

CyberSource's scripts handle payment processing and fraud prevention on checkout pages:

Hosted payment form components: Renders card input fields (card number, expiry, CVV) within PCI-compliant iframes, ensuring sensitive payment data is captured directly by CyberSource's servers and never touches the merchant's infrastructure
Card tokenization: Converts entered payment credentials into secure tokens that merchants can use for processing without handling raw card data
Device fingerprinting: Collects browser characteristics, device attributes, and behavioral signals — including screen resolution, installed plugins, timezone, language settings, and mouse/keyboard interaction patterns — to build a device profile for fraud risk assessment
3D Secure authentication: Manages Strong Customer Authentication flows (3DS2) required by PSD2 for European transactions, presenting bank verification screens within the checkout experience
Transaction risk scoring: Feeds collected device and behavioral data into CyberSource's Decision Manager fraud screening engine, which returns risk scores and recommended actions
Session management: Sets cookies to maintain payment session state and link fraud screening data to the active transaction

Consent & Compliance

CyberSource operates within a well-defined compliance framework:

GDPR: Payment processing falls under "performance of a contract" (Article 6(1)(b)). Fraud prevention has additional lawful bases including legitimate interest and legal obligation. CyberSource/Visa acts as both a data processor and, for fraud prevention, a data controller.
ePrivacy Directive: Payment session cookies and fraud detection mechanisms are strictly necessary for the service the customer requested (completing a purchase) and for preventing fraud, exempting them from consent requirements.
PCI DSS: CyberSource is PCI DSS Level 1 certified. The hosted payment fields are specifically engineered to keep merchants out of PCI scope.
PSD2/SCA: CyberSource handles Strong Customer Authentication requirements and manages transaction risk analysis for exemption processing.

Should You Block This Without Consent?

CyberSource's scripts are essential payment infrastructure. The hosted payment forms process transactions that customers explicitly initiated, and the fraud screening protects both the merchant and the customer from fraudulent activity. Both functions fall under the strictly necessary exemption — blocking these scripts would prevent customers from completing purchases and remove fraud protection from the checkout process.

No.

Is CyberSource GDPR compliant?

CyberSource typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So CyberSource can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads CyberSource, not on CyberSource itself.

Visit website