Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes Stripe to use transaction, identity, and device data across its network of merchants and financial partners for fraud detection and financial risk assessment purposes.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision permits Stripe to share personal and financial data across its broader merchant ecosystem for fraud prevention purposes, which implicates data minimization and purpose limitation requirements under GDPR and equivalent frameworks, and may affect individuals' transaction outcomes across multiple unrelated merchants.
Interpretive note: The specific categories of data shared within the fraud prevention network and the precise scope of cross-merchant data use are described in sections of the policy that were truncated in the provided document text.
Under this provision, transaction and identity data associated with a user's activity at one Stripe-powered merchant may be used to assess fraud risk at other Stripe-powered merchants, as part of Stripe's stated fraud prevention network.
How other platforms handle this
The right to know with whom we have shared your Personal Data, for what purposes, and what Personal Data has been shared (including whether Personal Data was disclosed to third parties for their own direct marketing purposes)
If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
Monitoring
Stripe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We provide financial infrastructure for the internet. Individuals and businesses of all sizes use our technology and services to facilitate purchases, accept payments, send payouts, and manage their online businesses.Excerpt from Stripe's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Article 6(1)(f) legitimate interests, Article 22 automated decision-making provisions (if risk scoring produces decisions with legal or similarly significant effects), and CCPA provisions regarding sharing personal information with third parties for business purposes. The CFPB may have oversight relevance given the financial services context. EU data protection authorities have issued guidance on the use of legitimate interests for fraud prevention, generally permitting it but requiring proportionality. 2. GOVERNANCE EXPOSURE: Medium. Cross-merchant data sharing for fraud prevention is a recognized industry practice, but the scope of the network and the categories of data shared require careful review to ensure compliance with purpose limitation and data minimization principles under GDPR. Where risk scoring produces automated decisions affecting transaction approvals, GDPR Article 22 safeguards may apply. 3. JURISDICTION FLAGS: EU and EEA residents may be entitled to information about automated decision-making under GDPR Article 22 if Stripe's fraud scoring produces decisions with significant effects. California residents may have rights regarding the sharing of personal information for fraud prevention purposes under CCPA. The UK Financial Conduct Authority may also have relevance for UK-based financial services operations. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Stripe should assess whether their Data Processing Agreement with Stripe addresses cross-network data sharing for fraud prevention, including whether this constitutes processing for Stripe's own independent controller purposes rather than solely as a processor on the merchant's behalf. This distinction affects liability allocation and data subject rights fulfillment obligations. 5. COMPLIANCE CONSIDERATIONS: Legal teams should review whether their organization's customer-facing privacy notices adequately disclose that transaction data may be shared within Stripe's fraud prevention network. Consent and legitimate interests legal bases should be assessed against the specific categories of data involved. Organizations in heavily regulated sectors should confirm that fraud network data sharing does not conflict with sector-specific data restrictions.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision permits Stripe to share personal and financial data across its broader merchant ecosystem for fraud prevention purposes, which implicates data minimization and purpose limitation requirements under GDPR and equivalent frameworks, and may affect individuals' transaction outcomes across multiple unrelated merchants.
Under this provision, transaction and identity data associated with a user's activity at one Stripe-powered merchant may be used to assess fraud risk at other Stripe-powered merchants, as part of Stripe's stated fraud prevention network.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.