Do we need to disclose Braintree in our privacy policy?

Yes. Braintree processes sensitive payment data on your behalf, making it a data processor under GDPR and CCPA. You must disclose that Braintree processes payment information, explain the categories of data collected, and reference PayPal Inc.'s privacy practices. This disclosure is legally required and builds user trust.

What specific data does Braintree collect?

Braintree collects tokenized payment card details, PayPal account information, transaction amounts, billing addresses, and device fingerprinting data for fraud prevention. Card numbers are not stored on your servers; instead, Braintree tokenizes them. Device data is used to detect suspicious transactions and prevent fraudulent activity.

Does Braintree require a cookie consent banner?

No. Braintree does not use cookies for tracking or analytics. However, if your website uses other analytics or marketing tools alongside Braintree, you'll need consent banners for those separate tools. Braintree's fraud detection operates through server-side tokenization and device fingerprinting, not cookies.

Who processes our payment data and where is it transferred?

PayPal Inc., a United States company, owns and operates Braintree as your payment processor. Payment data is transferred to PayPal's servers in the US. PayPal complies with PCI-DSS Level 1 standards and maintains Privacy Shield and Standard Contractual Clauses for international data transfers under GDPR.

Fintech

Privacy policy clauses for Braintree

Braintree is a PayPal-owned payment gateway that securely processes credit cards, PayPal accounts, and digital wallet transactions. Websites integrate Braintree to accept payments while outsourcing fraud detection and PCI compliance responsibilities to a Level 1 certified processor.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Braintree collects

Your privacy policy must disclose each of the following data types when you use Braintree.

Payment card details (tokenized)

PayPal account information

Transaction data and billing address

Device data for fraud detection

When does Braintree trigger privacy obligations?

Installation triggers immediate obligations

Adding Braintree to your site or app begins data collection the moment the JavaScript SDK loads or the mobile SDK initializes. Braintree immediately collects:

–Device fingerprinting data for fraud detection (IP, user-agent, device identifiers)
–Transaction metadata (billing address, card type, amount)

Privacy policy clauses for Braintree

What data Braintree collects

When does Braintree trigger privacy obligations?

Installation triggers immediate obligations

Regulatory thresholds

First concrete step

Where data goes

Common compliance pitfalls

Pitfall 1: Forgetting device fingerprinting in privacy disclosures

Pitfall 2: No Data Processing Agreement (DPA) signed

Pitfall 3: Misconfiguring tokenization or keeping raw card data

Legal note

Sample privacy policy clause

What regulators look for

What DPAs audit in Braintree implementations

Frequently asked questions

Do we need to disclose Braintree in our privacy policy?

What specific data does Braintree collect?

Does Braintree require a cookie consent banner?

Who processes our payment data and where is it transferred?

Don't ship without Bandit.