> WooCommerce sets cookies that require GDPR consent. Learn which cookies WooCommerce uses, how to configure compliance, and which plugins to use.
>
> Canonical: https://www.flowconsent.com/en/blog/woocommerce-gdpr-compliance-guide

[Platform guides](https://www.flowconsent.com/en/blog?category=platforms)

# WooCommerce and GDPR: the complete compliance guide

Published 19 June 2026 · 3 min read

In short

WooCommerce sets cookies by default that require GDPR-compliant consent before activation. Without a proper Consent Management Platform (CMP), your store risks fines from the ICO (UK) or EDPB supervisory authorities. This guide covers which cookies need consent, how to configure compliance, and the most common mistakes to avoid.

## Which WooCommerce Cookies Require Consent?

WooCommerce sets several types of cookies on visitor browsers. Some are strictly necessary, but others require explicit consent under GDPR:

The [WooCommerce entry in our third-party services catalog](https://www.flowconsent.com/en/services/ecommerce/woocommerce) summarises its documented cookies and consent requirements.

1. woocommerce\_cart\_hash (session) - strictly necessary, no consent required
2. woocommerce\_items\_in\_cart (session) - strictly necessary, no consent required
3. \_wc\_session\_ (session) - strictly necessary, no consent required
4. woocommerce\_recently\_viewed - functional/analytics, consent required
5. \_ga, \_gid (Google Analytics) - analytics, consent required
6. \_fbp (Facebook Pixel) - marketing, consent required
7. Affiliate tracking cookies - marketing, consent required

## When Is Consent Required on WooCommerce?

Under GDPR Article 6 and the ePrivacy Directive, consent is required before setting any non-essential cookie. For WooCommerce stores, this means:

Since WooCommerce runs on WordPress, our [WordPress cookie consent guide](https://www.flowconsent.com/en/blog/wordpress-cookie-consent-gdpr-guide) covers the rest of your site.

1. Before loading Google Analytics or any tracking pixel
2. Before storing behavioral or preference data beyond the shopping cart
3. Before any third-party script that sets cookies on behalf of advertisers
4. Before affiliate or referral tracking cookies are written
5. Before any A/B testing or personalization cookies are activated

## How to Make Your WooCommerce Store GDPR-Compliant

Follow these five steps to bring your WooCommerce store into full compliance:

1. Audit all cookies: use a scanner tool to list every cookie set on your site before and after consent
2. Implement a Consent Management Platform (CMP): integrate a CMP that supports Google Consent Mode v2 and blocks non-essential scripts until consent is given
3. Configure Google Consent Mode v2: set the four consent parameters (analytics\_storage, ad\_storage, ad\_user\_data, ad\_personalization) via your CMP before the gtag snippet fires
4. Update your privacy policy and cookie notice: clearly list all cookies, their purpose, and retention period
5. Test the consent flow: verify that declining consent actually prevents cookies from being set using browser developer tools

## Common Mistakes on WooCommerce Stores

**Pre-ticked consent boxes.** GDPR Article 7(2) explicitly prohibits pre-ticked boxes. Consent must be an active, unambiguous affirmative action.

Our guide to [GDPR consent validity](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) explains the other conditions that consent must meet.

**Bundled consent for all purposes.** Visitors must be able to consent separately for analytics, marketing, and functional cookies. Bundling all into one checkbox violates the specificity requirement.

**Consent banners that do not block scripts.** Showing a banner without actually blocking the cookies underneath it provides no legal protection. The CMP must intercept script execution.

The [WooCommerce installation guide](https://www.flowconsent.com/en/doc/install-woocommerce) shows how to add the FlowConsent snippet with WPCode and take control of extension pixels.

**No renewal of consent.** EDPB guidelines recommend renewing consent at least every 12 months, or sooner if the cookie policy changes.

**Ignoring the reject-all path.** The ICO (UK) requires that rejecting cookies be as easy as accepting them. A prominent 'Reject All' button must be present on the first layer.

For inspiration, browse our [GDPR cookie banner examples and best practices](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices).

## WooCommerce GDPR Compliance Checklist

1. Scan your store for all cookies (first-party and third-party)
2. Identify which cookies are strictly necessary vs. non-essential
3. Install and configure a GDPR-compliant CMP
4. Implement Google Consent Mode v2 with all four parameters
5. Verify scripts are actually blocked when consent is declined
6. Add a visible 'Reject All' button on the first consent layer
7. Update your privacy policy with a full cookie list
8. Set consent renewal reminders (at least annually)
9. Test consent flows on mobile and desktop browsers
10. Document consent records to demonstrate compliance to regulators

## Conclusion

GDPR compliance for WooCommerce is not optional. The ICO and EDPB have issued substantial fines for cookie consent violations. A properly configured CMP protects your business and builds customer trust.

Scan your WooCommerce store for free to identify which cookies need consent: [Free WooCommerce Cookie Scan](https://www.flowconsent.com/en/scan)

[Back to the blog](https://www.flowconsent.com/en/blog)

Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fwoocommerce-gdpr-compliance-guide) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fwoocommerce-gdpr-compliance-guide)

Read next

## Keep reading.

[All articles](https://www.flowconsent.com/en/blog)

[Platform guides · 13 July 2026](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide)

### [Next.js cookie consent and GDPR: the complete compliance guide](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide)

[How to collect valid cookie consent in a Next.js app, from App Router installation and SPA navigation to Google Consent Mode v2 and server-side consent checks.](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide)

[Read the article ](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide)·

[Marketing tools · 7 April 2026](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance)

### [Meta Pixel and GDPR: the complete guide to cookies and consent](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance)

[The Meta Pixel sets advertising cookies that require prior consent in Europe. Here is how to block it until consent, handle the Conversions API and stay GDPR compliant.](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance)

[Read the article ](https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance)·

[Best practices · 2 March 2026](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide)

### [Cookie banner: the complete GDPR compliance guide (2026)](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide)

[Everything a GDPR-compliant cookie banner needs: the legal basis, what it must show, design rules against dark patterns, a step-by-step setup and a final checklist.](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide)

[Read the article](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)