Worldpay

Overview

Worldpay, now part of FIS (Fidelity National Information Services), is one of the largest payment processors globally, handling transactions for merchants ranging from small businesses to major enterprises. With roots dating back to the early days of electronic payment processing, Worldpay powers checkout experiences for a significant portion of global e-commerce.

When Worldpay's scripts appear on merchant websites, they're handling the most security-sensitive part of the customer journey: the payment transaction itself.

What This Script Does

Worldpay's scripts manage secure payment processing on merchant checkout pages:

• Hosted payment fields: Renders card input fields (card number, expiry date, CVV) within secure iframes that isolate sensitive payment data from the merchant's page, significantly reducing PCI DSS compliance scope
• Card tokenization: Converts entered card details into secure tokens on Worldpay's servers, allowing the merchant to process payments without directly handling card data
• 3D Secure authentication: Manages the Strong Customer Authentication (SCA) flow required by PSD2, presenting bank verification screens (3DS2) within the checkout experience
• Payment method rendering: Displays available payment options based on merchant configuration, customer location, and card type detection
• Session cookies: Sets cookies to maintain payment session state, linking the customer's cart to the active transaction and tracking the payment through authorization and capture
• Fraud detection: Collects device fingerprinting data, behavioral signals, and transaction risk indicators to feed Worldpay's fraud screening systems
• Error handling and retry logic: Manages declined transactions, network errors, and payment method fallbacks to maximize successful payment completion

Consent & Compliance

Worldpay operates in a heavily regulated compliance environment:

• GDPR: Payment processing has a clear lawful basis under "performance of a contract" (Article 6(1)(b)) — the customer initiated a purchase. Worldpay acts as both a data processor (for merchant data) and a data controller (for its own fraud prevention and regulatory obligations).
• ePrivacy Directive: Payment session cookies and fraud prevention mechanisms are strictly necessary for the service the customer requested and are exempt from consent requirements.
• PCI DSS: Worldpay is certified PCI DSS Level 1 (the highest level). Its hosted payment fields are specifically designed to keep merchants out of PCI scope by ensuring card data never touches merchant servers.
• PSD2/SCA: Worldpay handles Strong Customer Authentication requirements for European transactions, including 3D Secure flows, exemption management, and transaction risk analysis.

Worldpay provides comprehensive DPAs and maintains certifications across major regulatory frameworks.

Should You Block This Without Consent?

Worldpay's scripts are essential infrastructure for completing purchases. They process the payment transaction that the customer explicitly initiated by proceeding to checkout. The cookies set are strictly necessary for maintaining payment session state and preventing fraud — both falling squarely within the "strictly necessary" exemption. Blocking Worldpay's scripts would completely prevent customers from completing purchases.

No.