Is it wrong of me to automatically save a user's card info without asking them?


I am using Stripe, so the card data never touches our servers. Using Stripe alone doesn't make a site fully PCI compliant, but the site I'm working on is PCI Compliant.

Also, I should have mentioned this but the site I'm working on sells subscriptions -- and nothing else. I would imagine that, given that this is the case, a user would have to assume that we will retain their cc info when giving it to us (otherwise we couldn't charge them each month).

That being said, the use case I was wondering about was the situation where, after already having purchased a single subscription from the site, we automatically fill in that user's cc info when they go to purchase another.

  • 4
    It's typically wrong to store any personal data without notifying the user. At times, it may be illegal.
    – DA01
    Commented Jan 13, 2014 at 17:12
  • The Golden Rule: "Do unto others as you would have them do unto you". Old fashioned perhaps but still valid. Violating this will increase the change of loosing a customer.
    – zaph
    Commented Jan 13, 2014 at 20:05
  • I would highly recommend getting audited as a PCI compliant site. It allows you to be sure you are and get certified as such. Then you can put the cute logo on your site as well which is good for users. Its a sign of trust.
    – Shawn
    Commented Jan 14, 2014 at 16:43
  • Your site does not necessarily have to save credit card information in order to provide recurring payments. Many payment gateways offer recurring payments as a feature, so your application only receives a token representing the card number stored on the gateway.
    – notatoad
    Commented Jan 15, 2014 at 2:16
  • @notatoad, as noted above, the card data never touches our servers. Our payment processor, Stripe, provides us with tokens which allow us to charge the cards we've stored, and view things like the last four digits of the card number and the expiration date.
    – Peter Berg
    Commented Jan 15, 2014 at 15:13

5 Answers 5


You should never save credit card information, client or server, unless you are PCI compliant. PCI stands for Payment Card Industry. You can view their website here. The standard of which we are all held to when handling credit cards is the Payment Card Industry Data Security Standard (PCI DSS).

You can get around having to be PCI compliant if you use a 3rd party, who is PCI compliant, to handle all your credit card processing and storing. I have used CyberSource and it ended up being a rather neat solution:

I just created an iframe whose source was set to a page on my network that was just a credit card form. When submitted, instead of posting to my network, it posted to CyberSource. When CyberSource processed the submission, it returned back to a specific page within my network that handled the result to update the user. In doing it this way, the credit card data never entered my network and thus I was PCI compliant.

Just as a side note for client-side, use the autocomplete="off" attribute on all sensitive fields.

Edit per your update

Since you have now stated the site you are working on is PCI compliant, the question then changes to a multi-part question of should you:

  1. Inform your users via a message prior to them signing up for the subscription?
  2. Give your users the option of having their info saved or auto-filled?
  3. Not tell the users anything based on the implication of what a subscription is by definition?

My experience has been such that #2 is what a lot of users prefer. I've come across many cases where parents or friends have used their credit cards to help someone out and don't exactly want their information retained where it could be used again by that someone.

Now, in a subscription, reoccurring payments are implied and from that, saving card information is implied, either by the website or the processor. That might be where you would probably be best off at least doing #1 to inform the user what you are going to do with their information.

  • 5
    +1 but bear in mind that the autocomplete attribute has nothing to do with storing the credit card details on your servers.
    – Racheet
    Commented Jan 13, 2014 at 15:32
  • What about save credit card number on client-side cache ? Is-it legal ? (I wouldn't do that for sure but it's only for information)
    – Alex
    Commented Jan 13, 2014 at 15:33
  • If it's only for information, can't you just store the last 4 digits? Commented Jan 13, 2014 at 15:39
  • @Racheet - Yes, that's true, I added it in, as it was something that was mandated to use during our PCI compliance application. Commented Jan 13, 2014 at 15:43
  • @Alex - It's not that it's legal or illegal, I just don't think you would be PCI compliant, and I think they could fine you if they wanted to. Someone correct me if I'm wrong. Commented Jan 13, 2014 at 15:46

You might not ask, but it's important to inform

Otherwise, you might run into some legal issues if that saved data was ever compromised. First, there's the problem that the data was compromised. Second, there's the issue that the user wasn't given proper notice that the data was being saved. You could add this to your terms and conditions page, but putting it in a more prominent place (i.e. the payment page) makes it obvious.

It's happening every day. If it were me, I wouldn't save anything. Overall you have to weigh the convenience factor (for the user) vs how much effort it will take to secure the data. PCI compliance is a big deal.

  • If you Inform after the fact you are just going to raise the question to the user why you did not tell him before thereby providing an option to op-out.
    – zaph
    Commented Jan 13, 2014 at 20:04
  • @Zaph But if you have a notice on the page where they're inputting their details (near the top - before they put anything in), then you should be in the clear. If they don't agree to your policies, they don't have to fill out the form.
    – Mike
    Commented Jan 14, 2014 at 3:33
  • @Mike I agree that would be sufficient.
    – zaph
    Commented Jan 14, 2014 at 4:08
  • @Mike that's EXACTLY how i pictured it. Don't like the terms, don't complete the form.
    – Xavier J
    Commented Jan 14, 2014 at 15:19

Yes it is wrong to save a users CC info without asking. Just ask yourself the simple question, how would you feel if a site retained your CC info without telling you.

If you don't ask you are taking advantage of the user and if the user finds out that you are doing something behind his back you may well loose him.

There there is the question of what you will use the CC info for?


Because it is a subscription site, I think it would be ok to save the information, but you need to handle it gracefully as well when you give the users the option to use the stored cc info. Something like "Your already have a recurring payment with us your subscription to XYZ - would you like us to charge this subscription to the same card?"


We're using a payment provider. We never see the credit card info, we pass information on amount and ordernumber to the payment provider, and get a transaction number back if the customer enters valid information.

This transaction number we then, at shipment time, pass to the payment provider, and the money is transferred to our account. (In our country it is not allowed to transfer the money before the goods is about to ship.)

For normal transactions, the transaction number can only release up to the amount the customer authorized. We can request less, if an item is out of stock.

For a subscription, we would get a token, which can be used when we want a payment. This token is unique to us, can not be used by others, so it need not be stored super-safely as a credit card number. It also means that if a site made a subscription, and refused to cancel it, the customer could get the payment provider to cancel the token, without having to cancel the card.

If your payment provider works the same way, you never should need to store the credit card number, you never even have the possibility.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.