WooCommerce GDPR compliance: plugins, cookies and the parts WordPress misses
WordPress ships real GDPR tooling that almost nobody turns on. Here is the setup, plus the plugin traps.
WooCommerce is in an odd position: WordPress core has had genuine GDPR tooling since 4.9.6, and WooCommerce adds retention settings and data exporters on top. Almost nobody configures either. Meanwhile the plugin ecosystem quietly adds processors nobody documents. Here is the practical setup.
Turn on what is already there
- 1Tools → Export Personal Data and Tools → Erase Personal Data handle subject requests, including from WooCommerce and any plugin that registers an exporter. Test both with a real order before you need them.
- 2WooCommerce → Settings → Accounts & Privacy: set retention for inactive accounts, pending, failed and cancelled orders. Leaving these blank means keeping order data forever.
- 3In the same screen, enable the privacy policy links on the checkout and registration forms and point them at a real page.
- 4Settings → Privacy: generate the policy draft, then rewrite it — the default is a skeleton, not a policy.
Consent that actually gates scripts
This is where WooCommerce stores fail hardest. Many consent plugins render a banner but never block anything; the tags are already in the head. A banner without blocking is worse than no banner, because it documents that you knew consent was required.
- Choose a consent plugin that supports script blocking, not just a notice.
- Move analytics and ad tags out of the theme header and into the consent plugin's managed slots, or into Google Tag Manager gated by consent mode.
- Verify in a private window with the Network tab: nothing third-party should load before you click.
- Check again after every plugin update — updates frequently re-register their own script tags.
Every plugin is a processor
| Plugin type | Data it sends out |
|---|---|
| Email marketing (Mailchimp, Klaviyo) | Customer email, name, order history |
| Live chat | IP address, page history, chat transcripts |
| Reviews | Reviewer name, email, IP, order verification |
| Analytics and heatmaps | Behavioural data, sometimes full session recordings |
| Shipping and tax | Full delivery address |
| Anti-spam | IP address and comment content |
Each of those belongs in your privacy policy by name, and each needs a data processing agreement. Session-recording plugins deserve special attention: recording form input without consent is one of the most-complained-about practices in Europe.
Hosting and infrastructure
- Know where your host stores backups, and for how long — erasure requests reach backups too.
- Server access logs holding IP addresses need a retention period.
- If your CDN or host is US-based, your transfer mechanism should be documented.
- Keep WordPress, WooCommerce and plugins patched; an unpatched known vulnerability is a security failing under Article 32.
Verify from the outside
The admin screens tell you what should happen. The only reliable check is loading the public storefront the way a visitor does and recording what fires, what cookies are set, and which documents are reachable. Do that after every plugin change.
See where your own store stands in 60 seconds.
mir-n loads your storefront in a real browser, records every tracker and cookie fired before consent, checks your required documents and runs WCAG tests — then hands you the fix for each finding.
Run a free auditFrequently asked
Is WooCommerce GDPR compliant by default?
No. WordPress and WooCommerce provide the tools — export, erasure, retention settings — but they are unconfigured on a fresh install, and nothing blocks third-party scripts until you add consent tooling that does.
Which WooCommerce data is personal data?
Names, billing and shipping addresses, email addresses, phone numbers, IP addresses, order history, account details and any customer notes. IP addresses count even when you never look at them.
Do I need a cookie plugin for WooCommerce?
You need something that blocks non-essential scripts until consent, and a plain notice plugin does not. Check that whatever you install actually prevents the requests rather than only displaying a banner.