What cookies does FastSpring set?

FastSpring's sbl.js library loads from FastSpring or CloudFront domains and sets session cookies to maintain cart contents and checkout state across page navigations. Post-purchase cookies may manage license delivery. During checkout it collects billing details as merchant of record for payment and tax processing.

How does ConsentStack handle FastSpring?

ConsentStack categorizes FastSpring as essential and functional and does not block it regardless of consent state. It detects FastSpring's Store Builder Library and treats its checkout session cookies as strictly necessary for e-commerce transactions. Blocking FastSpring would prevent purchases from completing, making it exempt from consent gating.

What tracker domains does FastSpring use?

ConsentStack has catalogued tracker domains for FastSpring including fastspring.com. These are the network destinations FastSpring's scripts contact, which a consent platform blocks until a visitor agrees.

FastSpring - Digital Commerce Privacy Controls

Q: Does FastSpring require cookie consent?

No. FastSpring is essential e-commerce infrastructure. Its cookies maintain cart state and checkout session integrity, which are strictly necessary for completing a purchase the visitor has initiated. Under GDPR and the ePrivacy Directive, these transactional cookies are exempt from consent requirements.

Back to Vendor Library

Overview

FastSpring is a full-service e-commerce platform specializing in digital product sales, SaaS subscriptions, and software licensing. The platform acts as a merchant of record, handling payment processing, tax calculation, subscription billing, and compliance obligations on behalf of software companies. FastSpring's checkout can be embedded directly into the seller's website or hosted on FastSpring's own domain.

What This Script Does

FastSpring's JavaScript library (commonly sbl.js or the Store Builder Library) loads from d1f8f9xcsvx3ha.cloudfront.net or fastspring.com domains and initializes the checkout experience on the host website. The script renders product selection interfaces, shopping cart functionality, and the checkout flow including payment form, tax calculation, and order confirmation.

The script sets cookies to maintain cart state across page navigations, preserve the customer's selected products and quantities, and manage the checkout session. Session tokens ensure transaction integrity during the payment process. These cookies are essential for completing a purchase — without them, the cart would reset on each page load.

During checkout, FastSpring collects billing information (name, email, address, payment details) as required for payment processing and tax compliance. As the merchant of record, FastSpring processes this data under its own data processing agreements and handles PCI DSS compliance for payment card data.

The script communicates with FastSpring's API endpoints to validate pricing, calculate taxes based on the customer's location, and process the transaction. Post-purchase, it may set cookies to manage license delivery and subscription access.

Consent & Compliance

FastSpring serves an essential function — enabling e-commerce transactions. The cart session cookies and checkout flow are strictly necessary for completing a purchase that the visitor has initiated. As merchant of record, FastSpring has its own legal basis for processing transaction data.

Under GDPR, the cookies required for cart management and payment processing qualify as "strictly necessary" under the ePrivacy Directive and do not require consent. The processing of billing data has a legal basis in contractual necessity. Under CCPA, transaction processing falls within the business purpose exemption.

The consent category is essential and functional.

Should You Block This Without Consent?

No. FastSpring provides essential e-commerce infrastructure — cart management, payment processing, and transaction completion. Its cookies are strictly necessary for the checkout flow to function. Blocking FastSpring without consent would prevent customers from purchasing products, breaking a core website function. No consent is required for these essential transactional cookies and data processing activities.

Is FastSpring GDPR compliant?

FastSpring typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So FastSpring can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads FastSpring, not on FastSpring itself.

Visit website