Flutterwave

Overview

Flutterwave is a leading African payment technology company that enables businesses to accept payments from customers across Africa and globally. The platform supports a wide range of payment methods tailored to African markets — including mobile money (M-Pesa, MTN Mobile Money), bank transfers, USSD, and traditional card payments (Visa, Mastercard). For website operators, Flutterwave's embedded checkout scripts provide the payment processing infrastructure necessary to complete online transactions.

As a payment processor, Flutterwave occupies a critical position in the e-commerce transaction flow. Its scripts handle sensitive financial data including card numbers, bank account details, and mobile money credentials. This places Flutterwave under stringent regulatory frameworks including PCI DSS compliance requirements, and its scripts are considered essential to the core transactional function of any website that uses it for payment processing.

What This Script Does

Flutterwave's scripts provide complete payment checkout functionality on merchant websites:

• Hosted Payment Forms: Loads secure, PCI-compliant payment input forms that collect card numbers, expiration dates, CVVs, and other payment credentials. These forms are rendered within Flutterwave's secure iframe to keep sensitive payment data off the merchant's servers.
• Payment Method Selection: Presents available payment options based on the customer's location and the merchant's configuration — including card payments, bank transfers, mobile money, USSD codes, and other region-specific methods.
• Transaction Processing: Handles the payment authorization flow including 3D Secure verification, OTP validation, and redirect-based authentication flows required by certain payment methods and banks.
• Currency and Localization: Manages multi-currency display, exchange rate calculations, and localized payment experiences for customers across different African countries and international markets.
• Transaction State Management: Maintains payment session state through the checkout process, handles timeout scenarios, manages retry logic for failed transactions, and communicates transaction results back to the merchant's website via callbacks.

Consent & Compliance

Flutterwave's scripts process payment data under a clear legal basis: they are strictly necessary to fulfill the transaction that the customer has initiated. Under GDPR Article 6(1)(b), processing payment data is necessary for the performance of a contract — the customer is purchasing a product or service and payment processing is an integral part of that contract.

The ePrivacy Directive's requirements around cookies and device storage also provide an exemption for cookies strictly necessary for a service explicitly requested by the user. Payment session cookies, fraud detection mechanisms, and transaction state management all fall within this exemption.

Flutterwave maintains PCI DSS compliance for handling cardholder data, and its hosted payment form approach (using iframes) is specifically designed to reduce the merchant's PCI compliance scope by keeping sensitive payment data within Flutterwave's controlled environment.

Website operators should note that while Flutterwave's core payment scripts are essential, any additional analytics or tracking features that Flutterwave may offer separately from the payment flow should be evaluated independently for consent requirements.

Should You Block This Without Consent?

Flutterwave's scripts are essential payment processing infrastructure. Blocking them would prevent customers from completing purchases, which is the core transactional purpose of the website. Payment processing is a strictly necessary function initiated by the user, and the data collection is limited to what is required to fulfill the transaction.

No.