__stripe_mid Cookie: What It Is, Who Sets It, and Consent Rules

What the __stripe_mid Cookie Does on Your Site

The __stripe_mid cookie is a first-party functionality cookie that Stripe.js sets on your domain to help Stripe detect fraud across the visits of the same browser. Stripe sets the __stripe_mid cookie "for fraud prevention purposes", and the cookie helps Stripe "assess the risk associated with an attempted transaction", according to the Stripe cookie settings page. Stripe.js writes an ID into the __stripe_mid cookie and sends fraud signals to the m.stripe.com endpoint of Stripe. Stripe uses the fraud signals for fraud detection, and the data is "never used for advertising", according to the Stripe documentation on advanced fraud detection.

The __stripe_mid cookie works with the __stripe_sid cookie. The __stripe_mid cookie follows the browser for 1 year (365 days), and the __stripe_sid cookie covers a single visit of 30 minutes.

Who Sets the __stripe_mid Cookie

Stripe.js sets the __stripe_mid cookie with JavaScript on the root domain of the page that loads Stripe.js. Stripe recommends that you "include this script on every page, not just the checkout page", according to the Stripe.js reference, so a shop that follows the advice sets the __stripe_mid cookie on every page.

A TermsFeed check in Chrome on 17 October 2026 found the __stripe_mid cookie with Secure and SameSite=Strict. The value held a random ID in the format of a UUID followed by 6 more hexadecimal characters. Stripe.js loaded a fraud signals frame from js.stripe.com at the same time.

Read how Stripe, Inc. handles the data in the Stripe privacy policy, and sign the Stripe Data Processing Agreement before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.

Does the __stripe_mid Cookie Need Consent?

Yes, the __stripe_mid cookie needs consent in the EU and the UK, and needs no prior opt-in in California. The table gives the rule for each law.

The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up Stripe, such as the pages that load Stripe.js and the advancedFraudSignals setting.

The ePrivacy Directive requires consent before a site sets the __stripe_mid cookie. The General Data Protection Regulation (GDPR) sets the standard for that consent: freely given, specific, informed, and unambiguous.

The UK Privacy and Electronic Communications Regulations (PECR) require consent before a site sets the __stripe_mid cookie.

The California Consumer Privacy Act (CCPA) sets no general opt-in requirement before a site sets the __stripe_mid cookie. Visitors get no right to opt out of the __stripe_mid cookie while Stripe acts as your service provider. The service provider role needs a contract that limits the use of the data to the service for your site.

Stripe lists the __stripe_mid cookie among the essential cookies of its own websites. The ePrivacy Directive exempts only storage that is strictly necessary for a service the visitor asks for, so the payment page differs from the other pages of your site. The TermsFeed Privacy Consent template therefore loads Stripe.js on the pages outside checkout only after consent.

Read how each law decides which cookies need consent in the EU ePrivacy Directive + GDPR guide, the UK PECR guide, and the California CCPA guide.

How to Block the __stripe_mid Cookie Until Visitors Accept

Block the __stripe_mid cookie by holding back Stripe.js until the visitor accepts functionality cookies. TermsFeed Free Cookie Consent and TermsFeed Privacy Consent place Stripe in the functionality category. Check whether an exemption applies to your own use of Stripe in the consent rules for the __stripe_mid cookie.

Stripe.js writes no __stripe_mid cookie while Stripe.js waits as a tagged script. Leave Stripe.js untagged on the payment page itself, because the payment form needs Stripe.js to take the payment.

<script type="text/plain" data-cookie-consent="functionality" src="https://js.stripe.com/endive/stripe.js"></script>

Stop the __stripe_mid Cookie in the Stripe.js Settings

Load Stripe.js with advancedFraudSignals set to false to stop the __stripe_mid cookie on your domain. Add ?advancedFraudSignals=false to the URL of the Stripe.js script, or call loadStripe.setLoadParameters({advancedFraudSignals: false}) from @stripe/stripe-js/pure before you load Stripe.js.

A TermsFeed check in Chrome on 17 October 2026 found no __stripe_mid and no __stripe_sid cookie after a load with advancedFraudSignals=false. Stripe "will continue to collect fraud detection risk factors on Stripe domains", according to the Stripe documentation on advanced fraud detection.

How to Verify That the __stripe_mid Cookie Waits for Consent

Verify the setup in a private window. Open Chrome DevTools, select the Application tab, and open Cookies. Click "I decline" on the consent banner and reload the page. The __stripe_mid cookie must not appear in the list until you accept functionality cookies.

How Long the __stripe_mid Cookie Lasts

The __stripe_mid cookie lasts 1 year (365 days). Safari caps the cookies that JavaScript sets at 7 days of Safari use without an interaction with your site, according to the WebKit team behind Safari.

The __stripe_mid cookie lasts 1 year (365 days), according to the Stripe cookie settings page, and a TermsFeed check in Chrome on 17 October 2026 measured the same expiry.

Cookies That Work Together With __stripe_mid

Stripe sets 1 other cookie next to the __stripe_mid cookie in its current setup.

Scripts and Requests of Stripe That Come With the __stripe_mid Cookie

The catalog lists 2 scripts, pixels, and data endpoints of Stripe, which a cookie scanner or the Network tab of Chrome DevTools shows next to the __stripe_mid cookie. Block the main script, and the requests in the table stop with the main script.

__stripe_mid Cookie FAQs

Is __stripe_mid a necessary cookie?

No, the __stripe_mid cookie is not a strictly necessary cookie on the pages outside your payment page. Firstly, Stripe.js on every page collects fraud signals from visitors who never start a payment. Secondly, Stripe offers the advancedFraudSignals setting, which stops the cookie while Stripe.js still takes payments. Thirdly, the TermsFeed Privacy Consent template for Stripe loads Stripe.js outside checkout only after the visitor accepts the Functionality vendor category.

What is the difference between __stripe_mid and __stripe_sid?

The __stripe_mid cookie identifies the browser for 1 year, and the __stripe_sid cookie identifies a single visit for 30 minutes. Stripe uses both cookies for fraud prevention, according to the Stripe cookie settings page.

Can I turn off the __stripe_mid cookie?

Yes, the advancedFraudSignals setting of Stripe.js turns off the __stripe_mid cookie. Firstly, Stripe.js writes neither Stripe cookie on your domain while advancedFraudSignals is false, set in the URL of the script or in loadStripe.setLoadParameters(). Secondly, Stripe documents the setting as an opt-out from advanced fraud signals, not from payments. Thirdly, Stripe encourages Stripe.js on every page of the shopping experience for its fraud detection, according to the Stripe documentation on advanced fraud detection. Weigh the fraud protection you give up before you turn the setting off.

Why does __stripe_mid appear on pages without a payment form?

Stripe.js sets the __stripe_mid cookie on every page that loads Stripe.js, and Stripe recommends loading Stripe.js on every page. A payment plugin that adds Stripe.js to the whole site therefore sets the __stripe_mid cookie on the home page and the blog as well as on the checkout.