Google Analytics is injected with Stripe.js when enabling Google Pay

Yes: it would be great if a site could use something like CSP to ensure that if they've only gotten consent for vendors A and B that vendor B doesn't go violate their contract by bringing in unconsented vendor C.

(Though in this case B and C are both Google, and in a slightly different world both Google Pay and Google Analytics could be hosted on the same domain.)

> you should have already received consent

For payment processing. Not for tracking.

Right? It's technically first-party to them.

The issue is that GA is outlawed, or soon to be outlawed, in some places. Bundling GA into Google Pay + Stripe likely puts some companies at legal risk without them knowing it

Under GDPR, you have to ensure you gather consent properly. If your tools are not equipped to deal with that, that's your problem, not the tool's author's.

Under GDPR, if you use a third-party tools, and those tools process user data (including just being loaded onto the page from a third-party server, because that requires processing IP Address), then your arrangement with that third party must describe the processing that they are going to perform. The description of processing is often a separate document from other contract stuff, called the Data Processing Agreement (DPA), but that's a convention and not a requirement.

Your responsibility is making sure that data processed under the terms of that agreement conforms to GDPR. Your primary responsibilities are the articles in Chapter 3 "Rights of the Data Subject" under GDPR, and making sure you can do that for data sent to the third-party.

Their responsibility is making sure that data is only processed how they describe it in the DPA. If they surreptitiously add Google Analytics, that's their violation.

If the contract is too vague to tell what processing is going on, then that is your violation for choosing to engage with them as a processor. In practice this might be your biggest risk.

IANAL

Under GDPR you are the data controller of you decide what data is collected and for what purposes.

I would expect this to cover you as the operator of the website (or other service). Your agreements with your tool providers probably specify that they are data processors for you.

If data was being collected and accessed without lawful basis (by eg GA embedded somewhere in your stack), this would count as a data breach. You would have to inform your data regulator (eg ICO in the UK) within 72 hours of becoming aware of it, and tell them among other things what remedial action you are taking. You could also be fined for failing to do due diligence.

(Edwin from Stripe here.) This is correct. I can only speak to how Stripe.js works but if a business chooses to accept Google Pay, we've limited it to loading in an iframe. (We don't load Google scripts on the business's domain.)

If website A embeds website B in an iframe and website B loads Google Analytics, does website A have to show a cookie consent form? Or does website B have to show a cookie consent form inside of the iframe? Does stripe display such a consent form in the iframe?