GoCardless

Overview

GoCardless specializes in bank-to-bank payments, particularly direct debit schemes like SEPA (Europe), Bacs (UK), ACH (US), and BECS (Australia). Unlike card-based payment processors, GoCardless pulls funds directly from bank accounts, making it popular for recurring billing scenarios where lower transaction fees and reduced card-expiry churn are priorities. The platform also offers Instant Bank Pay for one-off payments via open banking APIs.

What This Script Does

GoCardless's client-side scripts power the payment authorization flow where customers set up direct debit mandates. The integration typically uses GoCardless.js or redirects to GoCardless-hosted authorization pages at pay.gocardless.com.

When embedded on the merchant's site, the script guides users through:

1. Entering bank account details (sort code/account number, IBAN, or routing/account number depending on the scheme)
2. Reviewing the direct debit mandate terms
3. Confirming authorization for the merchant to collect future payments

Cookies set during the authorization flow:

• gc_session — session cookie securing the mandate setup process
• gc_auth — authentication token for the authorization flow

The script communicates with api.gocardless.com and pay.gocardless.com. Data collected is limited to what is necessary for mandate setup: customer name, email, bank account details (transmitted directly to GoCardless servers), and billing address. GoCardless does not perform cross-site tracking or set marketing cookies. The client-side footprint is minimal — most processing occurs server-side via API calls.

Consent & Compliance

GoCardless is classified as essential. The scripts handle payment mandate authorization — a function that is strictly necessary for the direct debit service the user is explicitly requesting. Under GDPR and the ePrivacy Directive, these session cookies are exempt from consent requirements.

Under CCPA/CPRA, GoCardless acts as a service provider processing data solely for the business purpose of payment collection. Bank account information collected during mandate setup is not sold or shared for advertising purposes. GoCardless is FCA-regulated in the UK and authorized as a payment institution across the EU, providing additional regulatory assurance.

Should You Block This Without Consent?

No. GoCardless scripts are essential for setting up direct debit payment mandates. Blocking them would prevent customers from authorizing recurring bank payments. These are strictly necessary scripts exempt from consent under ePrivacy Directive Article 5(3).