I'm using PayPal REST API to make calls using credit card numbers. So I have a form that requests credit card number to the users of the site. I could sell or use those credit card numbers that people insert.

So do I need any special permission (legal, whatever..) to have a form that request a credit card numbers?

How to feel users secure about inserting their credit card numbers on my website?

I'm living in Spain (Europe).

EDIT: I'm not speaking about storing the credit card number, I will not store the credit card numbers in a data base. I just use them for the calls to PayPal.

EDIT 2: maybe could be a good idea insert a PayPal iframe to my site? better than use PayPal REST API?


You are confusing me. You say on one hand that you are not storing the credit card number, but then you say you can sell it.

I would not do either to tell you the truth.

People do not want their information to be sold especially credit card numbers. This is a bad thing. You can use the information to complete the transaction and for partner applications, but not to sell credit card numbers on the open market. You will get into trouble eventually.

However, if that is what you are doing, make sure that you have a solid privacy policy in place written by a lawyer who is familiar with these things and force a user to click a check-box confirming that they have read the privacy policy. Then store the user information, less credit card though I would consider the last 4 digits, along with the transaction time and the fact that the check-box was checked. As well, you will have to clearly define the activities and limits of activities within your privacy policy. You will need to specifically list how and to whom you provide user information to and what that specific information is so that the user is properly informed. Also, you will have to use HTTPS.

Otherwise, you will be sued. It will just be a matter of time and you will likely lose.

| improve this answer | |
  • thanks, I meant that as an hypothetical case, if I was a "bad" person, I could sell or use the numbers to benefit my self illegally. Just that :D. What do you thing about using a Paypal iframe? – tirengarfio Nov 19 '14 at 18:21
  • @tirengarfio I did not think you were a bad person! Just curious. Some questions are an example of things that happened to the OP (person asking the question). I do not run a store so I do not know anything about PayPal from a webmasters point of view. I do automated back-end predictive analysis of hacker activities so I cannot open my site up too much. But perhaps a PayPal trap would be a good idea for the future. – closetnoc Nov 19 '14 at 18:36

If you are going to use Paypal REST API then you need to ensure you are PCI Compliant. ( Which involves alot more than a privacy policy and ssl cert)

If you use the PayPal REST APIs for accepting credit card payments, you handle card data directly and will need to ensure you are PCI compliant.



| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.