Is cookie consent required for Lemon Squeezy checkout?

Generally no for the core checkout, but it depends on usage. Lemon Squeezy's overlay sets session cookies to maintain cart state, which is essential for purchases. However, its affiliate tracking features set persistent cookies for referral attribution, which require marketing consent under GDPR and ePrivacy.

What cookies does Lemon Squeezy set on buyer browsers?

Lemon Squeezy's embed script from assets.lemonsqueezy.com loads a checkout overlay iframe and sets a session cookie for cart contents and progress. This cookie expires at session end. If affiliate tracking is active, a persistent cookie attributes the purchase to a referral partner for commission payouts.

How does ConsentStack manage Lemon Squeezy scripts?

ConsentStack detects Lemon Squeezy's checkout scripts and classifies them as essential and functional. The core checkout overlay loads for transaction completion. If affiliate tracking cookies are present, ConsentStack separately gates those under marketing consent, ensuring purchases work while respecting privacy.

What tracker domains does Lemon Squeezy use?

ConsentStack has catalogued tracker domains for Lemon Squeezy including lemonsqueezy.com. These are the network destinations Lemon Squeezy's scripts contact, which a consent platform blocks until a visitor agrees.

Lemon Squeezy - Payment & Checkout Consent Controls

Back to Vendor Library

Overview

Lemon Squeezy is a merchant-of-record payment platform for indie developers and digital product creators, handling the full commerce stack including checkout, tax compliance, subscription billing, and license key delivery. Acquired by Stripe in 2024, it competes with Paddle in the merchant-of-record space. Its client-side scripts appear on websites that have embedded a Lemon Squeezy checkout overlay or buy button, enabling in-page purchases without redirecting to an external URL.

What This Script Does

Lemon Squeezy's embed script (loaded from assets.lemonsqueezy.com) initializes an overlay checkout system and performs the following:

Overlay initialization: The script injects a modal or sidebar checkout iframe loaded from lemonsqueezy.com when a purchase trigger is activated. The iframe handles all payment form rendering within Lemon Squeezy's secure origin.
Cart state cookies: A session cookie is set to maintain cart contents and checkout progress during the purchase flow. This cookie typically expires at session end and is necessary for the checkout to function.
Affiliate tracking: If the operator has enabled Lemon Squeezy's affiliate program, referral parameters in the URL are captured and persisted in a first-party cookie (similar to how Rewardful functions) with a 30-day default expiry.
Purchase session attribution: The script may set a persistent cookie to attribute the conversion to a traffic source or affiliate, surviving across browser sessions until the purchase is completed.
Post-purchase events: After a successful purchase, the script fires a JavaScript event and may trigger third-party integrations the operator has configured (such as Google Analytics or Facebook Pixel conversion events) by calling their respective APIs.

Sensitive payment data (card numbers, billing addresses) is handled entirely within the Lemon Squeezy iframe and never exposed to the host page's JavaScript context.

Consent & Compliance

GDPR and ePrivacy: The checkout overlay relies on session cookies that are necessary to provide the service requested by the user (completing a purchase), which qualifies as essential under the ePrivacy Directive — no consent is required for these. However, the affiliate tracking cookie and any post-purchase analytics or marketing pixels loaded by the script are non-essential and require prior consent. Operators should configure their consent management platform to allow the core checkout script but gate any affiliate tracking or marketing event firing behind consent.

CCPA/CPRA: As a Stripe subsidiary, Lemon Squeezy processes payment and purchase data under established financial services data handling practices. Affiliate tracking data and behavioral attribution cookies constitute personal information under CCPA. Operators must disclose this data collection and provide opt-out mechanisms for non-essential tracking.

This vendor falls in the mixed category (essential + functional). Core checkout functionality is essential; affiliate attribution and marketing event integrations are not.

Should You Block This Without Consent?

Conditional.

The core Lemon Squeezy checkout script serves an essential transaction function and may load without consent when a user actively initiates a purchase. The affiliate tracking cookies and any marketing event fires configured within the integration must be gated behind consent. Structure your consent configuration to allow the essential checkout flow while blocking non-essential tracking components.

Is Lemon Squeezy GDPR compliant?

Lemon Squeezy typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Lemon Squeezy can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Lemon Squeezy, not on Lemon Squeezy itself.

Visit website