Functionality vendor · Stripe, Inc.
Stripe Cookies: List With Purpose and Retention
Last verified 2026-10-17 · Updated 2026-10-17
On this page
Cookies Stripe Sets on Your Site
Stripe.js sets 2 cookies on your domain, __stripe_mid and __stripe_sid, on every page that loads Stripe.js, and Stripe sets more cookies on its own domains during checkout.
| Name | Type | Category | Party | Retention | What it does |
|---|---|---|---|---|---|
__stripe_mid | Cookie | Functionality | First-party | 1 year (365 days) | The __stripe_mid cookie is a Stripe functionality cookie that helps detect payment fraud for 1 year and needs consent in the EU outside checkout. |
__stripe_sid | Cookie | Functionality | First-party | 30 minutes (1800 seconds) | The __stripe_sid cookie helps Stripe detect payment fraud within a single visit, and the cookie lasts 30 minutes. |
Scripts, Pixels, and Endpoints Stripe Loads
Stripe loads 2 known scripts, pixels, and data endpoints. Each row gives the host to look for in the Network tab of Chrome DevTools or in a cookie scanner report.
| Type | Resource | Host | What it does |
|---|---|---|---|
| Script | Stripe.js | js.stripe.com | Stripe.js loads the Stripe payment elements and writes the __stripe_mid and __stripe_sid cookies unless advancedFraudSignals is false. |
| Iframe | Stripe fraud signals frame (m-outer) | js.stripe.com | The fraud signals frame of Stripe.js collects the signals that Stripe sends with the ID from the __stripe_mid cookie. |
Does Stripe Need Consent?
Yes, the Stripe cookies need consent in the EU and the UK, and need no prior opt-in in California. The table gives the rule for each law, taken from the page of the __stripe_mid cookie.
| Law | Consent before the cookies are set | Opt-out right | Source |
|---|---|---|---|
| EU ePrivacy Directive + GDPR | Required | Withdraw at any time | Article 5(3), ePrivacy Directive |
| UK PECR | Required | Withdraw at any time | Regulation 6 and Schedule A1, PECR |
| California CCPA | No general opt-in | None while the vendor acts as a service provider | Cal. Civ. Code 1798.120 |
The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up Stripe, such as the pages that load Stripe.js and the advancedFraudSignals setting.
Read the reason for each answer in the consent rules for the __stripe_mid cookie.
How to Add Stripe to a Consent Banner
Add Stripe to a consent banner by holding back Stripe.js until the visitor accepts functionality cookies. Both TermsFeed products block Stripe in the Functionality category.
Add Stripe to TermsFeed Free Cookie Consent
TermsFeed Free Cookie Consent runs a tagged script only after the visitor accepts its category. Change type="text/javascript" to type="text/plain" and add data-cookie-consent="functionality".
<script type="text/plain" data-cookie-consent="functionality" src="https://js.stripe.com/endive/stripe.js"></script>Cookie Consent is free and needs no account. Build your free consent banner with TermsFeed Free Cookie Consent.
Add Stripe to TermsFeed Privacy Consent
Add Stripe from its template in TermsFeed Privacy Consent, and Stripe.js loads on the pages outside checkout only after the visitor accepts the Functionality vendor category. Your payment pages keep loading Stripe.js directly, because the payment form needs Stripe.js to take the payment.
The Stripe template asks for no ID and fills every field of the vendor. Pick the "Stripe" card under Functionality and click "Add Stripe". The illustration shows the template form in the TermsFeed app.
Privacy Consent detects the location of each visitor and records every answer in a consent log. Set up Stripe from its template with TermsFeed Privacy Consent.
Follow every step, the vendor settings, and the check in Chrome DevTools in how to block the __stripe_mid cookie.
Who Runs Stripe
Stripe, Inc. runs Stripe from the United States. Stripe.js loads from js.stripe.com and collects fraud signals for Stripe on every page where your site loads Stripe.js, not only on the payment page.
Read how Stripe, Inc. handles the data in the Stripe privacy policy, and sign the Stripe Data Processing Agreement before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.
Stripe Cookie FAQs
Does Stripe need consent?
Yes, the Stripe cookies need consent in the EU and the UK, and need no prior opt-in in California. Firstly, the ePrivacy Directive requires consent before a site sets the functionality cookies of Stripe. Secondly, the UK PECR requires consent before a site sets the functionality cookies of Stripe. Thirdly, the CCPA sets no general opt-in requirement for the functionality cookies of Stripe, and the table gives the opt-out right of visitors. The consent section of this page gives the table for each law.
How long do Stripe cookies last?
The cookies of Stripe last from 30 minutes (1800 seconds) to 1 year (365 days). The __stripe_sid cookie lasts the shortest time, and the __stripe_mid cookie lasts longest. The retention column of the cookie list gives the lifetime of each cookie.
How do I block Stripe cookies?
Block the Stripe cookies by holding back Stripe.js until the visitor accepts functionality cookies. Tag Stripe.js with data-cookie-consent="functionality" in TermsFeed Free Cookie Consent, or add Stripe as a vendor in TermsFeed Privacy Consent. The page of the __stripe_mid cookie gives the full steps and the settings of Stripe.
Sources for the Stripe Cookies
The facts on this page come from the documentation Stripe publishes, checked on 2026-10-17. The list gives every source, so you check each fact yourself.
- Stripe, Cookie settings
- Stripe Docs, Advanced fraud detection
- Stripe Docs, Stripe.js reference (including Stripe.js)
- TermsFeed check of Stripe.js with and without advancedFraudSignals=false in Chrome, 17 October 2026 (internal)
- Stripe privacy policy
- Stripe Data Processing Agreement