Lemon Squeezy

Overview

Lemon Squeezy is a merchant-of-record payment platform for indie developers and digital product creators, handling the full commerce stack including checkout, tax compliance, subscription billing, and license key delivery. Acquired by Stripe in 2024, it competes with Paddle in the merchant-of-record space. Its client-side scripts appear on websites that have embedded a Lemon Squeezy checkout overlay or buy button, enabling in-page purchases without redirecting to an external URL.

What This Script Does

Lemon Squeezy's embed script (loaded from assets.lemonsqueezy.com) initializes an overlay checkout system and performs the following:

• Overlay initialization: The script injects a modal or sidebar checkout iframe loaded from lemonsqueezy.com when a purchase trigger is activated. The iframe handles all payment form rendering within Lemon Squeezy's secure origin.
• Cart state cookies: A session cookie is set to maintain cart contents and checkout progress during the purchase flow. This cookie typically expires at session end and is necessary for the checkout to function.
• Affiliate tracking: If the operator has enabled Lemon Squeezy's affiliate program, referral parameters in the URL are captured and persisted in a first-party cookie (similar to how Rewardful functions) with a 30-day default expiry.
• Purchase session attribution: The script may set a persistent cookie to attribute the conversion to a traffic source or affiliate, surviving across browser sessions until the purchase is completed.
• Post-purchase events: After a successful purchase, the script fires a JavaScript event and may trigger third-party integrations the operator has configured (such as Google Analytics or Facebook Pixel conversion events) by calling their respective APIs.

Sensitive payment data (card numbers, billing addresses) is handled entirely within the Lemon Squeezy iframe and never exposed to the host page's JavaScript context.

Consent & Compliance

GDPR and ePrivacy: The checkout overlay relies on session cookies that are necessary to provide the service requested by the user (completing a purchase), which qualifies as essential under the ePrivacy Directive — no consent is required for these. However, the affiliate tracking cookie and any post-purchase analytics or marketing pixels loaded by the script are non-essential and require prior consent. Operators should configure their consent management platform to allow the core checkout script but gate any affiliate tracking or marketing event firing behind consent.

CCPA/CPRA: As a Stripe subsidiary, Lemon Squeezy processes payment and purchase data under established financial services data handling practices. Affiliate tracking data and behavioral attribution cookies constitute personal information under CCPA. Operators must disclose this data collection and provide opt-out mechanisms for non-essential tracking.

This vendor falls in the mixed category (essential + functional). Core checkout functionality is essential; affiliate attribution and marketing event integrations are not.

Should You Block This Without Consent?

Conditional.

The core Lemon Squeezy checkout script serves an essential transaction function and may load without consent when a user actively initiates a purchase. The affiliate tracking cookies and any marketing event fires configured within the integration must be gated behind consent. Structure your consent configuration to allow the essential checkout flow while blocking non-essential tracking components.