PayPal

Overview

PayPal is a global payment processing platform enabling customers to pay via PayPal accounts, Venmo, Pay Later installment plans, and credit or debit cards. The PayPal JavaScript SDK renders checkout buttons and manages the secure payment authorization flow directly on merchant sites, without the customer needing to navigate away to PayPal's website.

What This Script Does

The PayPal SDK is loaded from www.paypal.com/sdk/js with merchant-specific query parameters specifying currency, components (buttons, hosted-fields, pay-later messaging), and enabled payment methods. The SDK performs several distinct functions:

Eligibility Detection and Button Rendering On page load, the SDK contacts PayPal's servers at www.paypal.com/graphql to determine which payment methods the visitor is eligible for — PayPal, Venmo, Pay Later — based on IP-based geolocation, device type, and account history. It then renders the appropriate set of payment buttons. This eligibility check does not require the user to be logged in, and the data sent is limited to technical browser context (User-Agent, language, timezone).

Checkout Flow When the user clicks a PayPal button:

• A popup window or mini-browser opens at www.paypal.com/checkoutnow for account authentication
• The SDK exchanges an Order ID (created by the merchant's server) with PayPal's servers
• PayPal's servers confirm payment authorization and return a capture confirmation to the merchant
• Raw card data is never transmitted through the merchant's page — all card entry and authentication occurs in the PayPal-hosted window

Hosted Fields (Card Payments Without Redirect) When merchants use PayPal's Hosted Fields component, card entry fields (number, expiry, CVV) are rendered as iframes hosted at www.paypal.com. This ensures PCI scope does not extend to the merchant's server. The SDK communicates between the merchant page and the hosted iframes via postMessage.

Fraud Detection and Risk Signals The SDK collects browser signals for fraud risk assessment during the checkout flow:

• Browser fingerprint: User-Agent, screen dimensions, timezone, language, installed fonts (via canvas probe)
• Session behavior: time on page, mouse movement entropy
• Device signals: touch capability, hardware concurrency

These signals are sent to www.paypal.com and t.paypal.com for risk scoring. PayPal uses this data under its legitimate interest in fraud prevention.

Cookies set:

• ts (first-party on paypal.com, session) — checkout session token
• ts_c (first-party on paypal.com, 3 years) — persistent session continuity for returning users
• tsrce (first-party on paypal.com, session) — referencing application identifier
• enforce_policy (first-party on paypal.com, session) — fraud policy flag
• x-pp-s (first-party on paypal.com, session) — PayPal session token

Cookies are set under paypal.com (not on the merchant domain), scoped to the payment flow.

Domains contacted: www.paypal.com, t.paypal.com, c.paypal.com, www.sandbox.paypal.com (development), www.venmo.com (if Venmo component enabled)

Consent & Compliance

GDPR/ePrivacy: PayPal SDK is necessary for completing payment transactions, covered by contractual necessity under GDPR Article 6(1)(b). Fraud detection processing is justified under legitimate interest (Article 6(1)(f)). Cookies set under paypal.com during a transaction initiated by the user fall under the ePrivacy strictly necessary exemption. PayPal acts as an independent data controller for payment and fraud data processed through its own platform.

CCPA/CPRA: Payment processing data is a necessary business function exempt from opt-out requirements. PayPal's privacy policy governs its own data practices as an independent controller.

EU-US Data Transfers: PayPal Holdings Inc. participates in the EU-US Data Privacy Framework (DPF) and uses Standard Contractual Clauses for EU-US payment data flows.

Consent category: Essential (payment processing) and Functional (Venmo, Pay Later messaging, saved address prefill).

Should You Block This Without Consent?

No. PayPal provides essential payment processing infrastructure. Blocking it would prevent customers from completing purchases using PayPal, Venmo, or Pay Later. The cookies it sets are strictly necessary for the payment transaction the user initiates. Disclose PayPal as a payment processor in the site's privacy policy.