What is the __stripe_sid cookie?
__stripe_sid is a cookie set by Stripe, the online payment processor embedded on many e-commerce and SaaS websites. It appears in the browser when a visitor interacts with a Stripe payment form (checkout, subscription, donation button) or other Stripe components loaded on the page.
It belongs to the group of Stripe cookies used for transaction security (alongside others such as __stripe_mid), and is managed directly by Stripe.js scripts rather than by the host website itself.
What data it stores
__stripe_sid stores a session identifier generated by Stripe, used to link successive requests within the same payment flow. The value is an opaque alphanumeric string, generated and interpreted only by Stripe's own systems.
Data associated with this cookie is sent to Stripe domains (such as stripe.com and related subdomains), not to or accessed by the hosting website directly.
What it is used for
Its main purpose is short-term identification of a payment session, allowing Stripe to correlate requests coming from the same user during a transaction and apply real-time fraud-prevention checks.
For site owners, this cookie is a technical requirement for the Stripe payment form to work correctly and securely; it does not provide marketing data or traffic analytics.
Does it require consent?
Under CookieFix's classification, __stripe_sid is a strictly necessary cookie, since it directly supports a payment function actively requested by the user. Under GDPR and the ePrivacy Directive, strictly necessary cookies do not require prior consent.
- It should not be placed in categories requiring an active consent toggle.
- It must still be disclosed in the cookie policy, naming the provider (Stripe) and its purpose.
- If Stripe is only used for checkout, this cookie will naturally appear only on payment pages.
How to block or delete __stripe_sid
Visitors can delete or block this cookie through their browser settings (Chrome, Firefox, Edge, Safari), under per-site cookie management. Blocking it may interrupt the payment process, since Stripe relies on it to detect fraud during a transaction.
On the site side, because it is strictly necessary, __stripe_sid should not be blocked before consent — but the Stripe script should only load on checkout pages, not sitewide. A CMP like CookieFix can handle this separation automatically, blocking non-essential scripts until consent is given while letting strictly necessary payment components run normally.
Frequently asked questions
No, it is classified as strictly necessary because it directly supports the payment process the user has actively initiated, so it falls outside the ePrivacy prior-consent requirement.
It has a short lifespan of about 30 minutes, matching a typical checkout session.
The Stripe payment form may stop working correctly, or the transaction may be flagged by fraud-prevention checks, since Stripe can no longer correlate requests from the same session.
Yes, even though it doesn't require consent, any strictly necessary cookie must still be disclosed in the cookie policy, including its provider and purpose.