Pitfall 1: Missing or vague processor disclosure in privacy policy
The mistake: Saying "we work with third parties to process payments" without naming Stripe or describing what data is shared.
Why it happens with Stripe: Stripe's infrastructure is hidden from users (they never see Stripe's domain in most flows), so founders assume they can stay vague. GDPR Articles 13/14 explicitly require naming the processor and data categories; CCPA Section 1798.100(d) requires disclosure of third parties who receive data. Regulators and auditors specifically check payment policy language because it's high-risk.
Consequence: Regulatory fines (GDPR: up to €20 million or 4% of revenue; CCPA: up to $7,500 per violation), customer complaints, and failure of privacy audits.
Pitfall 2: No Data Processing Agreement (DPA) in place
The mistake: Integrating Stripe without executing Stripe's DPA, assuming the privacy policy alone suffices.
Why it happens with Stripe: Stripe's DPA is easy to overlook because Stripe doesn't require an explicit "signature" in the traditional sense—it's accepted via Stripe's dashboard or email. Small teams confuse having Stripe's privacy link with having a DPA.
Consequence: GDPR non-compliance (Article 28 requires a written contract). Data Protection Authorities (e.g., CNIL, ICO, DPA in Austria) will flag this immediately in an audit. Fines and processing suspension.
Pitfall 3: Over-consenting for fraud-prevention cookies
The mistake: Requiring users to consent to `__stripe_mid` and `__stripe_sid` via a cookie banner, when they should be treated as strictly necessary and exempt from consent under ePrivacy Directive Article 5(3) and UK-PECR.
Why it happens with Stripe: Cookie-consent platforms default all cookies to "marketing" or "analytics," and teams don't audit Stripe's cookie list. Or teams apply blanket consent policies without mapping which Stripe cookies are necessary vs. optional.
Consequence: False consent claims (regulators check this), poor UX (unnecessary consent walls), and potential fines for misclassifying necessary cookies as optional.
