Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy applies not only to individuals with Stripe accounts but also to end customers of businesses that use Stripe to process transactions, who may have no direct relationship with Stripe.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Stripe processes personal data of individuals who interact with merchant websites powered by Stripe technology, even absent a direct account relationship, which creates distinct data subject rights obligations and controller-processor role considerations under GDPR and CCPA.
Interpretive note: The full scope of Stripe's data processing for non-account-holder end customers is described across multiple sections of the policy and the Privacy Center, which was truncated in the provided document text.
Under this provision, individuals who complete purchases on third-party websites using Stripe's payment infrastructure have their transaction and identity data processed by Stripe under the terms of this policy, regardless of whether they have created a Stripe account.
How other platforms handle this
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
Monitoring
Stripe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We provide financial infrastructure for the internet. Individuals and businesses of all sizes use our technology and services to facilitate purchases, accept payments, send payouts, and manage their online businesses. This Privacy Policy describes the Personal Data that we collect, how we use and share it, and how you can reach us with privacy-related inquiries.Excerpt from Stripe's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Articles 13 and 14 regarding transparency obligations to data subjects who did not directly provide data to the controller, as well as CCPA requirements for businesses that collect personal information about California consumers. The relevant enforcement authorities include EU national data protection authorities and the California Privacy Protection Agency. The provision's scope may require evaluation under GDPR Article 14 notice requirements for data not collected directly from the data subject. 2. GOVERNANCE EXPOSURE: Medium. The processing of personal data from individuals who have no direct relationship with Stripe requires Stripe and its merchant clients to coordinate on data subject rights fulfillment, privacy notice delivery, and purpose limitation compliance. Organizations using Stripe as a processor must assess whether their own customer-facing privacy notices adequately disclose Stripe's downstream processing. 3. JURISDICTION FLAGS: EU and EEA data subjects have direct rights under GDPR Article 14 to be informed of processing by data controllers they have not directly engaged with. California residents have equivalent rights under CCPA. UK GDPR mirrors EU requirements. Organizations operating in these jurisdictions that use Stripe to process customer payments face heightened exposure if their privacy notices do not adequately reference Stripe's data handling. 4. CONTRACT AND VENDOR IMPLICATIONS: Merchant clients of Stripe should review their Data Processing Agreement with Stripe to confirm role allocation for personal data collected from end customers. Where Stripe acts as a data processor on behalf of the merchant, the merchant retains primary obligations for GDPR-compliant notice and consent. Where Stripe acts as an independent controller for fraud prevention or its own network purposes, separate notice obligations may apply. 5. COMPLIANCE CONSIDERATIONS: Compliance teams at organizations using Stripe should audit their customer-facing privacy notices to confirm adequate disclosure of Stripe's role and data practices. Data mapping exercises should identify which personal data flows through Stripe infrastructure and for what purposes. Organizations subject to GDPR should confirm that Stripe's Data Processing Agreement and Standard Contractual Clauses are current and executed.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that Stripe processes personal data of individuals who interact with merchant websites powered by Stripe technology, even absent a direct account relationship, which creates distinct data subject rights obligations and controller-processor role considerations under GDPR and CCPA.
Under this provision, individuals who complete purchases on third-party websites using Stripe's payment infrastructure have their transaction and identity data processed by Stripe under the terms of this policy, regardless of whether they have created a Stripe account.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.