Stripe Identity

Overview

Stripe Identity is a document-based identity verification service that enables businesses to verify customer identities through government-issued ID scanning and biometric selfie matching. It is used for KYC (Know Your Customer) compliance, fraud prevention, and age verification. The verification flow loads within an embedded modal or redirect on the merchant's website, collecting sensitive biometric and document data.

What This Script Does

Stripe Identity loads a verification flow through Stripe.js or a dedicated verification session:

• Document capture — the verification modal requests access to the device camera (or file upload) to capture images of a government-issued ID (passport, driver's license, or national ID card). Both front and back images may be required. The images are transmitted directly to Stripe's servers over an encrypted connection.
• Selfie capture and liveness detection — a selfie photo or short video is captured to verify that the person presenting the ID is physically present. Stripe's liveness detection algorithms analyze the capture for signs of spoofing (photos of photos, masks, deepfakes).
• Biometric processing — Stripe extracts facial biometric data from the ID photo and selfie, performing a facial similarity comparison. This biometric data is processed and stored by Stripe according to their biometric data retention policies.
• Document data extraction — OCR and document analysis extract the name, date of birth, document number, expiration date, and other fields from the ID image. This data is returned to the merchant via API for verification decisions.

The verification flow loads scripts from js.stripe.com and communicates with Stripe's identity verification endpoints. Session tokens authenticate the verification attempt. The flow may set session-scoped cookies to maintain state during the multi-step verification process, but no persistent tracking cookies are set.

Consent & Compliance

Stripe Identity is classified as essential in contexts where identity verification is a legal or regulatory requirement (KYC for financial services, age verification for restricted products). Under GDPR, the processing of biometric data falls under Article 9 (special categories of data) and requires explicit consent under Article 9(2)(a) unless another exemption applies (such as substantial public interest under national law for anti-money laundering compliance).

The ePrivacy Directive does not pose additional cookie consent requirements, as the verification flow uses only session-scoped cookies strictly necessary for completing the verification process the user initiated.

Under CCPA/CPRA, biometric data is explicitly classified as sensitive personal information. The California Privacy Rights Act requires businesses to provide a clear "right to limit" the use of sensitive personal information, and biometric data collection requires a specific disclosure. Illinois BIPA (Biometric Information Privacy Act) imposes additional requirements including written consent before collection and specific data retention and destruction policies.

Despite being classified as essential, the sensitive nature of biometric data means businesses must still provide clear disclosure about the identity verification process before initiating it, even when it is legally required.

Should You Block This Without Consent?

No. When used for legally required identity verification (KYC, age verification), Stripe Identity is essential to the service. Blocking it would prevent compliance with legal obligations. However, the collection of biometric data requires clear disclosure and, in many jurisdictions, explicit consent for the biometric processing specifically — even though the verification service itself is essential. This consent is typically obtained through the verification flow's own disclosure screens rather than through cookie consent banners.