If you run a store on WooCommerce and it gets visitors from the EU, GDPR applies to you — even if your business is based in the US, UK, Australia, or anywhere else. GDPR follows your visitors, not your headquarters.
WooCommerce powers more online stores than any other platform in the world. But because it's self-hosted WordPress, there's no platform vendor making anything compliant for you: every setting, every plugin and every tracking script is your responsibility. This guide walks through exactly what to set up, in plain language — no lawyer required.
1. Does GDPR apply to your WooCommerce store?
Yes, if any of these are true:
You sell products to customers in the EU or EEA
EU residents visit your store — even without buying anything
You use analytics, ad pixels, or email marketing plugins (nearly every store does)
You collect any personal data at all: orders, accounts, newsletter signups, contact forms, reviews
GDPR's territorial scope (Art. 3) covers any business processing EU residents' personal data, regardless of where the business is registered. A store in Texas shipping to Germany and France? GDPR applies.
The same logic holds under the UK GDPR if you serve UK customers.
One thing that makes WooCommerce different from hosted platforms: you are also the hosting's data controller. Your server logs, your backups, your database — all of it falls inside your GDPR responsibilities, not a platform vendor's.
2. Six compliance requirements for WooCommerce stores
Here is what every WooCommerce store needs for GDPR compliance in 2026. These are the most common gaps we see when scanning stores across platforms with our free compliance scanner.
Requirement
Why
Common gap
Cookie consent banner
ePrivacy Directive requires consent before non-essential cookies load
No banner at all, or an inform-only banner that doesn't block Google Analytics and ad pixels
Privacy policy
GDPR Art. 13: customers must be told what data you collect and why
A generic template that doesn't mention the store's actual plugins and processors
Data Processing Agreements (DPAs)
GDPR Art. 28: host, payment gateways and each plugin vendor processing data need one
Nobody has ever listed the processors — let alone confirmed DPAs with them
Legal basis per purpose
GDPR Art. 6: each data use needs consent, contract, or legitimate interest
"Legitimate interest" claimed for marketing cookies — invalid in most EU countries
Data subject rights process
Customers can request access, deletion or export of their data
No idea how to find and erase one customer's data across orders, Mailchimp and analytics
Outdated plugins, no HTTPS enforcement, database backups stored unencrypted on the same server
3. WooCommerce cookie consent setup
WooCommerce itself sets a handful of functional cookies (cart contents, session). Those are generally fine without consent. The problem is everything around the store: analytics, ads, marketing popups and chat widgets.
What you need
A consent management platform (CMP) that blocks scripts until opt-in — a plain notice banner is not compliant in most EU countries.
Granular categories: necessary, analytics, marketing — with "reject all" as easy as "accept all". Regulators actively test this.
Consent records: who consented, when, to what. Most CMPs log this automatically.
Google Consent Mode v2 with denied defaults (ad_storage: 'denied', analytics_storage: 'denied') if you run Google Analytics or Ads.
CMP options that work well on WordPress/WooCommerce
Complianz — WordPress-native, free tier, configures blocking per category
CookieYes — free tier; paid plans from ~$10/mo
Borlabs Cookie — one-time license, popular in the DACH region where enforcement is strictest
Cookiebot / Usercentrics — big-name CMPs with official WordPress plugins
Whichever you choose, install it site-wide (not just the shop pages), then verify with a fresh incognito window plus DevTools → Application → Cookies: no non-essential cookies should appear before you click accept. Our free cookie banner checker does this automatically.
Plugins bypass banners too. A marketing plugin that fires its own pixel on page load ignores whatever banner you show unless the CMP explicitly gates its script. After installing any new plugin, re-check what loads pre-consent — this is where compliant setups silently break.
4. Privacy policy requirements
Your privacy policy must state, in plain language:
Who you are — your business name and contact details (and EU representative if you're outside the EU)
What you collect — order data, customer accounts, form submissions, analytics data, IP addresses, server logs
Why — the legal basis for each purpose: contract fulfilment, consent, legitimate interest
Who receives it — your host, payment gateways, shipping carriers, email tools, analytics providers, every relevant plugin's cloud service
How long you keep it — actual retention periods, including WooCommerce's own customer-data retention settings
Their rights — access, correction, deletion, portability, objection, and how to exercise them
Transfers outside the EU — if your host or processors are US-based, Standard Contractual Clauses apply and should be named
WordPress ships a basic privacy policy generator (Settings → Privacy), and WooCommerce extends it with store-specific sections. That's a starting point, not an endpoint: it will not know about your specific email tool, review plugin or ad pixels. Every plugin you activate is potentially a disclosure you owe customers.
Also link the policy visibly — from your footer and next to checkout and account pages. A policy nobody can find doesn't satisfy Art. 13.
Need a proper starting point? Our compliance checklist produces an Article-13-ready document in two minutes, tailored to how your store collects data.
5. Data Processing Agreements (DPAs) — the one most store owners miss
Under GDPR Art. 28, whenever a third party processes personal data on your behalf, a written DPA must be in place. For a typical WooCommerce store this means:
Your hosting provider — they process customer data in server logs and databases. Nearly every reputable host publishes a DPA you can accept in your account.
Payment gateways — Stripe, PayPal, Mollie, Klarna and similar publish standard terms covering their processing.
Analytics & ads — Google Analytics, Meta, TikTok, Google Ads.
Plugin vendors with cloud services — review plugins, support desks, CRM connectors, translation services. If data leaves your server to their cloud, you need terms covering it.
The practical shortcut: nearly all major vendors publish a standard DPA you can accept online in minutes. You rarely need to draft anything — but you do need to confirm one exists for each processor, keep a list, and re-check it whenever you install a plugin. That list is exactly what an auditor asks for first.
For smaller vendors that don't provide one, our document pack includes an Art. 28-compliant DPA template ready to use.
6. Built-in tools worth switching on
Account erasure and export — Settings → Accounts & Privacy controls whether customers can request erasure and data export themselves, and how order data is handled when an account is deleted. Configure retention limits deliberately instead of keeping everything forever — data minimization (Art. 5) is a legal principle, not a nice-to-have.
Checkout privacy checkbox — enable the registration privacy-policy checkbox so account creation captures demonstrable consent linked to your policy.
WordPress personal-data export/erase tools — Tools → Export Personal Data / Erase Personal Data process requests across plugins that integrate with them. Check which of your plugins actually register with these tools before a request arrives — you have one month to answer.
Email order invoices vs. storing them forever — set a sensible schedule for pruning old personal data in line with your stated retention periods.
Two-factor authentication on wp-admin. A compromised admin login exposes your entire customer list: an Art. 32 problem as much as a security one.
7. Common compliance mistakes on WooCommerce
No CMP at all — Google Analytics firing from day one with no consent mechanism anywhere. The single most common finding on self-hosted stores.
An inform-only banner. It says "we use cookies" but blocks nothing. Not compliant in most EU member states.
Plugin sprawl without processor awareness. Twenty installed plugins, zero documented vendors, no DPAs confirmed. Each cloud-connected plugin is a processor.
Default privacy policy never edited. It doesn't mention your actual plugins, so it fails Art. 13 transparency. An inaccurate policy is itself a finding.
Marketing popups with pre-ticked boxes — invalid under EU law (CJEU Planet49 ruling). Use unticked checkboxes and say what subscribers will get.
No plan for data requests. When someone emails "delete my data," you need a repeatable answer within one month — across orders, email lists and analytics, not just the WP user record.
Missing legal pages for specific markets. Selling to German customers requires an Impressum (compliance checklist). Selling goods into the EU requires clear refund/withdrawal information (compliance checklist).
Unencrypted or co-located backups. Customer data in a backup file sitting on the same server, world-readable, is an Art. 32 failure waiting for a breach notification.
8. Free compliance check for your WooCommerce store
Not sure where your store stands? Run the free scanner — it checks HTTPS/HSTS security headers, cookie-consent platforms, Google Consent Mode v2, trackers loading without consent, privacy-policy links, legal pages, and more. Enter your store URL and get results in seconds:
No sign-up, no installation, and nothing is stored. Works on any WooCommerce domain because it only reads what any visitor could see.
Need documented proof — PDF reports, daily monitoring, and ready-made DPA/NIS2/accessibility documents? That's what EUComply Pro ($79/year) adds: daily re-scans, auditor-ready reports, and a 30-day history you can show clients, insurers, or auditors.