I've read that PayPal embeds a pixel in its button which tracks every user that visits the website. Is that true?
More generally, is it possible to embed a PayPal donation button and still be GDPR compliant?
Add a comment
|
1 Answer
You can embed a third party button, but have to take care how and why you do this.
PayPal is not providing the button solely on your behalf, but for their own purposes. They are not your data processor, but another data controller. Thus, you need a legal basis (Art 6 GDPR) for sharing visitor data with PayPal. You do have a legitimate interest to accept “donations”, but does this interest outweigh the privacy of people who are just visiting your website, without the intent to donate and without being aware of PayPal's data collection? Likely not. Common solutions:
You do not embed the button at all, but merely link to a PayPal page where the visitor can make a payment.
You show a placeholder for the embedded content, and only load the PayPal button when the user clicks on it.
Additionally, this placeholder could provide information about PayPal and their privacy policy. Then, your legal basis for embedding PayPal could be consent instead of legitimate interest (which may or may not be simpler compliance-wise).
An attractive aspect of explicit consent is that it can serve as a legal basis for international transfers, considering that US-based services are no longer covered by an adequacy decision following the Schrems II ruling in 2020.
Background: when you embed third party content on your page, you are jointly responsible for processing of personal data resulting from this. This applies to embedding buttons, scripts, iframes, and other content. There is good case-law on this through the Fashion ID case (ECJ C-40/17) that discussed the obligations of a site operator who embedded a Facebook “Like” button. They were held jointly responsible for the data collection of the button on the page (including merely disclosing the IP address for loading the button from Facebook), but not responsible for subsequent processing of this information on Facebook's servers. The site operator is the data controller even though the embedded button is actually loaded by the user's browser. The scenario is very similar to your question regarding PayPal.
Related questions:
