Privacy policy, cookie consent, and GDPR for your store

Your store collects customer data every single day. Email addresses at checkout. Phone numbers for shipping. Payment information. IP addresses from analytics. Browsing history from tracking pixels. Every piece of data you collect comes with a legal responsibility to protect it and tell customers how you use it.

This is where privacy policy, cookie consent, and GDPR come in. They are not just legal formalities. They are the rules that govern how you collect, store, and use customer information. Get them wrong and you face fines, customer distrust, and legal problems. Get them right and you build confidence in your brand.

Most store owners skip over privacy because it feels boring and complicated. It is complicated. But this article breaks down what you actually need to do.

What is GDPR and who does it affect

GDPR stands for General Data Protection Regulation. It is a European Union law that sets rules for how companies collect and use personal data. If you have a single customer in the EU, GDPR applies to you. If your store serves any customer in the EU, you must follow GDPR.

GDPR is not optional. It is not a suggestion. The European Commission has fined companies billions of euros for violating it. Microsoft paid USD 20 million. Facebook paid USD 5 billion. These are massive companies. A small e-commerce store might pay smaller fines, but the principle is the same: GDPR violations are expensive.

The core principle of GDPR is simple: customers own their data. You are borrowing it temporarily. You have to ask permission before collecting it. You have to explain what you do with it. And you have to delete it when they ask.

Key GDPR rules for e-commerce stores

You need permission before collecting data

You cannot just collect email addresses, phone numbers, or any personal information without clear consent. At checkout, you need explicit opt-in checkboxes, not pre-checked boxes. If a customer unchecks a box that says "I agree to marketing emails", you cannot sign them up for marketing. You need their active, informed agreement.

This applies to marketing lists, analytics tracking, and advertising cookies. If you use Google Analytics, you need to tell customers that you use it and give them a way to decline. If you use Facebook Pixel to retarget customers, you need consent before the pixel fires.

You have to explain what you do with data

Your privacy policy is not just a legal document. It is a communication with your customers. You have to explain in plain language (not legal jargon) what data you collect, why you collect it, how long you keep it, and who has access to it. GDPR requires that this information be "easily accessible" and "in clear and plain language".

A privacy policy that is hidden behind 5 clicks or written in legal jargon does not meet the "clear and plain" standard.

You must delete data when asked

Customers have the right to request that you delete their information. This is called the "right to be forgotten". If a customer emails you asking to delete their account and data, you have 30 days to comply. You cannot charge them for it. You cannot ignore the request. You have to delete it and confirm that it is gone.

You must report data breaches

If your customer data is compromised or stolen, you have 72 hours to report it to European authorities. You also have to notify affected customers. You cannot hide a breach or hope nobody notices. This requirement alone has made GDPR costly for many companies because it forces transparency and accountability. For security best practices at checkout, see how to keep your online store checkout secure.

Data transfers require approval

If you store customer data outside the EU, you need to use approved transfer mechanisms. This matters if your payment processor is in the US, or if you use a US-based email service, or if you back up data in an American data center. You cannot just move EU customer data anywhere. You need legal frameworks in place.

What is a privacy policy and why you need one

A privacy policy is a document that explains how your store collects, uses, and protects customer information. It is required by GDPR, by many state laws in the US, and by industry standards. Without one, you are breaking the law and customers have no way to understand how you handle their data.

Your privacy policy needs to cover:

What data you collect

List every type of data you gather. This includes obvious things like email addresses and shipping addresses, but also less obvious things like IP addresses from your website server, cookies from analytics, behavior tracking, and location data. Be specific. Do not just say "personal information". Say "email address, phone number, shipping address, purchase history, and browsing behavior". If you accept payments through a payment gateway, your privacy policy must explain what payment data is handled by your processor. See how payment gateways work to understand what data flows through your payment system.

How you collect it

Do you collect data through forms, checkout pages, or cookies? Through customer service interactions or support tickets? Through analytics tools or advertising pixels? Explain the methods. This is where you mention Google Analytics, Facebook Pixel, Stripe, or whatever tools you use to collect data.

Why you collect it

You collect email addresses to process orders and send shipping updates. You collect phone numbers for customer service. You collect analytics data to understand how visitors use your site. You use cookies to remember customers so they do not have to log in every time. Explain the business reason for each type of data collection.

How long you keep it

You do not keep data forever. You have to define retention periods. You might keep purchase history for 7 years for tax and legal reasons. You might keep email addresses for 3 years after the last purchase for marketing. You might keep support tickets for 1 year. Whatever your retention policy is, state it clearly.

Who has access to it

If you use a payment processor, they have access to payment data. If you use a shipping provider, they have access to addresses and can use that information for delivery. If you outsource customer service, your support team sees customer names and email addresses. List all the third parties who can see customer data and explain why. For details on how shipping flows work, see how to set up shipping for your online store.

How you protect it

Do you use SSL certificates to encrypt data in transit? Do you require strong passwords? Do you back up data regularly? Do you train your team on data security? Explain your security measures. If your security is weak, say so anyway, but then commit to improving it.

Customer rights

Under GDPR, customers have the right to access their data, correct it, delete it, and port it to another service. Your privacy policy has to tell them how to exercise these rights. Include an email address or contact form where customers can request data access or deletion.

Cookie consent and tracking

Cookies are small files that websites store on a customer's computer to remember them. They are used to keep you logged in, to remember items in your cart, and to track your behavior across websites.

GDPR distinguishes between necessary cookies and non-necessary cookies. Necessary cookies (like shopping cart cookies or session cookies) do not require consent. Everything else does.

Necessary cookies that don't need consent

Shopping cart cookies are necessary because without them, customers would lose their cart every time they navigate to a new page. Session cookies that keep you logged in are necessary. Security cookies that prevent fraud are necessary. You can use these cookies without asking for permission because they are required for the store to function.

Non-necessary cookies that require consent

Analytics cookies (Google Analytics, Hotjar, Mixpanel) are not necessary to run your store. They help you understand behavior, but the store works fine without them. Understanding your visitor data is useful for optimization, but customers should consent before you track them. Marketing cookies and retargeting pixels (Facebook Pixel, Google Ads conversion tracking) are definitely not necessary. These cookies track customers across the internet to show them ads. They require explicit consent before they fire. For an overview of what you can learn from analytics, see how to use analytics to understand visitor behavior.

How to implement cookie consent

You need a cookie consent banner that appears when a customer first visits your site. The banner has to explain what cookies you use and why. It should have at least three options: Accept All, Reject Non-Necessary, and Customize. Accept All should be one button. Reject should be equally easy to click (not buried under a menu). Customers should be able to say no to analytics and marketing cookies without losing the ability to shop.

Do not make consent confusing by using dark patterns like "Accept" in big blue letters and "Reject" in tiny gray text. That violates GDPR. Both options need to be equally visible and clickable.

You can use a cookie consent tool like OneTrust, Cookiebot, or Termly. These services handle the banner, tracking consent, and updating your preferences. They cost money but they save you legal risk.

Privacy for non-EU stores

GDPR is EU law, but privacy regulations exist everywhere. If your store operates in California, you are subject to CCPA (California Consumer Privacy Act). If you are in Virginia, there is VDPA. Canada has PIPEDA. Brazil has LGPD. Australia has APPs.

These laws are not identical to GDPR, but they follow similar principles: customers own their data, you have to ask permission, you have to be transparent, and you have to delete data when asked.

If you have customers in multiple regions, you cannot have one privacy policy that works everywhere. You need to follow the strictest law that applies to you. For most stores, that is GDPR because it is the most strict. If you comply with GDPR, you are probably compliant with most other privacy laws too.

Terms and conditions versus privacy policy

Your privacy policy and your terms and conditions are different documents with different purposes.

Privacy policy covers how you handle data: what you collect, why, how long you keep it, and how customers can access or delete it.

Terms and conditions cover how customers can use your store: payment terms, return policy, refund policy, liability limits, and what customers are not allowed to do. A customer could be okay with your data handling (privacy) but disagree with your no-refund policy (terms).

You need both documents. For details on writing terms and conditions, see how to write terms and conditions for your online store.

How WEMASY helps with privacy and compliance

WEMASY's website builder includes built-in SSL encryption for all data in transit. Your customer data is stored in secure servers with regular backups. WEMASY also supports adding privacy policy and cookie consent banners directly to your site without needing custom code. You can configure which cookies are necessary and which require consent, then let WEMASY manage the consent flow.

This does not remove your legal responsibility to have a clear privacy policy, but it makes implementation easier. See what is included in your WEMASY plan.

Privacy checklist for your store

Before you go live, run through this list:

Privacy policy

Do you have a privacy policy on your site? Is it publicly accessible? Does it explain what data you collect, why you collect it, how long you keep it, and who has access? Does it include contact information for data requests? Do not copy someone else's privacy policy. Generic policies do not explain your specific practices.

Cookie consent

If you use analytics or marketing cookies, do you have a cookie consent banner? Does it give customers a real choice to opt out? Is the reject button as easy to click as the accept button? Does the banner explain what each type of cookie does?

Necessary security

Do you use SSL (HTTPS) for your entire store? Do you require strong passwords? Do you have a plan for what to do if data is compromised? Do you back up customer data regularly?

Third-party tools

List every tool you use that handles customer data: payment processor, shipping provider, email service, analytics platform, marketing tool, support software. Does your privacy policy mention all of them? Have you read their privacy policies? Do they comply with GDPR or your local laws?

Data deletion process

If a customer emails asking to delete their data, do you have a process to do it? Do you know how to delete data from your store system, your payment processor, your email service, and any other tools? You need a documented process, not a guess.

Legal guidance

Have you consulted a lawyer about privacy? You do not need a lawyer for every question, but for your first store, it is worth 1-2 hours of legal time to make sure you are on the right track. Many lawyers will review a basic privacy policy for EUR 200-400.

FAQs