Stripe Radar

Overview

Stripe Radar is Stripe's machine learning-powered fraud detection system that operates during payment flows. It collects device and behavioral signals from the customer's browser to assess transaction risk, score payment attempts for fraud probability, and trigger additional verification steps (like 3D Secure challenges) when suspicious patterns are detected. Radar is deeply integrated into Stripe's payment processing and activates automatically for all Stripe transactions.

What This Script Does

Radar's data collection is embedded within Stripe.js, the same script that handles payment form rendering and card tokenization:

• Device fingerprinting — Stripe.js collects a comprehensive set of browser and device signals including user agent, screen dimensions, installed plugins, timezone, language settings, WebGL renderer information, and canvas fingerprint data. These signals are combined into a device fingerprint used to identify the device across transactions.
• __stripe_mid — a persistent first-party cookie (merchant ID) set by Stripe.js that stores a device identifier. Typically expires after 1 year. This cookie helps Stripe recognize the device across multiple visits and transactions on the same merchant's site.
• __stripe_sid — a session-scoped cookie (session ID) that tracks the current browsing session for fraud assessment context. Expires after 30 minutes of inactivity.
• Behavioral analysis — Stripe.js monitors interaction patterns during the payment flow: typing cadence in form fields, mouse movement patterns, time spent on the checkout page, and copy-paste detection. These behavioral signals help distinguish human users from automated fraud bots.
• Network metadata — IP address, connection type, and proxy/VPN detection data are collected and transmitted to Stripe's risk scoring engine.
• Transaction velocity — Radar tracks the frequency of payment attempts from the same device, IP address, or card number to detect card testing attacks and brute-force fraud.

All collected signals are transmitted to Stripe's risk engine (via m.stripe.com and r.stripe.com endpoints) where machine learning models produce a risk score for each transaction. High-risk transactions may be automatically blocked, flagged for manual review, or routed through 3D Secure authentication.

Consent & Compliance

Stripe Radar is classified as essential. Fraud detection is a critical security function for payment processing that protects both the merchant and the customer. Under GDPR, the device fingerprinting and behavioral analysis performed by Radar can be justified under Article 6(1)(f) (legitimate interest) for fraud prevention, which is explicitly recognized as a legitimate interest in Recital 47. The processing is proportionate to the security risk and limited to the payment context.

The ePrivacy Directive's consent requirement for cookies has a narrow exemption for cookies strictly necessary for the service requested by the user. When a customer initiates a payment, fraud detection cookies (__stripe_mid, __stripe_sid) are strictly necessary to securely process that transaction. Multiple European data protection authorities have confirmed that fraud prevention cookies used during payment flows qualify for this exemption.

Under CCPA/CPRA, the device fingerprinting and behavioral data collected for fraud detection falls within the security exemption for processing reasonably necessary to protect the integrity of the service and detect security incidents.

Should You Block This Without Consent?

No. Stripe Radar is an essential fraud prevention system that protects payment transactions. Blocking it would expose both the merchant and customers to increased fraud risk, potentially leading to financial losses and regulatory issues. The device fingerprinting and behavioral analysis it performs are proportionate security measures limited to the payment processing context. Fraud detection cookies qualify for the strictly necessary exemption under the ePrivacy Directive.