I'm building a website, and the only third party element in it is a PayPal button I use for payments. The PayPal button opens a pop-up window which has its own cookie consent banner. Does that mean I also need a cookie policy/cookie consent banner on my website? Other than that, I save the clients' billing information in the database, which I assume means I need at least a privacy policy, but I don't understand if I need a cookie consent banner just for that PayPal button.
1 Answer
You need a privacy notice for any website (if you're subject to GDPR). Having a PayPal button alone does not trigger such an requirement, since any website is already processing personal data such as IP addresses even if there's no third party content.
But it's good that you think about issues for including third party content. As rulings such as the Fashion ID case and the more recent Google Fonts judgement have clarified, you are responsible having a suitable legal basis when you cause visitor's personal data to be disclosed to third parties. Even just embedding/loading a button or logo can cause personal data such as IP addresses to be disclosed to the recipients. You might have a legal basis if earlier, the user already opted in to payment with PayPal (could be consent per Art 6(1)(a) GDPR, or necessity for performing the contract per Art 6(1)(b)). Loading the embedded content just because the user might want to use it is probably not compliant though. For example, the common PayPal donation button is problematic.
Thus, instead of linking a PayPal SDK, you might want to host the code + assets for the PayPal payment functionality on your own servers, or only load the PayPal content after the user unambiguously indicated that they want to use this content. I've discussed the PayPal donate button previously, as well as background on the Fashion ID case and click-to-consent wrappers for embedded content.
What the Fashion ID case made very clear though is that you're only responsible for compliance for those data processing activity where you can actually influence the “purposes and means” of processing. You have no control over what PayPal does with the data on their servers, so they are solely responsible for that. And if the PayPal button navigates to a PayPal website, you're not responsible for what cookies PayPal sets on its own website. It is thus correct that the PayPal popup has its own cookie banner – you are not responsible for the contents of the popup.
You also don't need to collect consent for cookies and similar technologies that are strictly necessary to provide a service that was explicitly requested by the user. For example, session cookies, XSRF protection cookies, and cookies containing a shopping cart are often such strictly necessary cookies. You must still be transparent about the use of such cookies, but you probably don't need a banner to announce this.
So I think that you can probably go without a cookie banner, though you should probably get consent before loading PayPal content into your page, and you will likely want to be transparent about cookies as part of your privacy notice.
