Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Amazon Webstore was a legacy e-commerce hosting platform from Amazon that let merchants run branded online stores on Amazon and AWS infrastructure. The storefront set session and functional cookies for cart and checkout, with payment and analytics handled through connected services. As a US hosted platform, it carried data transfer obligations for EU merchants.
Amazon Webstore was a hosted e-commerce platform from Amazon that allowed merchants to build branded online stores backed by Amazon and AWS infrastructure. It provided catalogue, basket, checkout, and payment features as a managed service. Amazon retired the product, so it is now mainly relevant to legacy stores and to merchants who have migrated to other platforms.
The storefront set strictly necessary session cookies to keep the basket and checkout working, along with functional cookies for preferences. It processed customer account, order, and payment data to complete purchases. Where merchants added analytics or marketing tags, additional non essential cookies and identifiers could be set on top of the core store cookies.
Strictly necessary store and basket cookies could be set without consent under the ePrivacy Directive, while analytics and marketing cookies required prior consent. Because hosting was on US based Amazon infrastructure, EU merchants also had to address international data transfers and be transparent about them in the privacy notice and records of processing.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
A consent banner was required wherever non essential analytics or marketing cookies were used. Consent had to be freely given, specific, and informed, with reject as easy as accept, and no optional tags loading before the visitor agreed. Operators of legacy or migrated stores should make sure their current setup still meets these standards.
Because Amazon Webstore ran on US based Amazon and AWS infrastructure, using it from the EU meant transferring personal data to the United States. That transfer needed a valid mechanism such as the EU US Data Privacy Framework where applicable or standard contractual clauses with a transfer impact assessment. Merchants who have migrated should confirm the transfer position of their new host.
Inventory the cookies and tags your store sets, block optional ones until consent, and confirm a valid US transfer safeguard. Keep your cookie and privacy policy current, document the legal basis and retention for each purpose, and if you are migrating away from Amazon Webstore, repeat this assessment for the replacement platform.
Websites using Amazon Webstore must obtain user consent under GDPR regulations.
DPIA considerations
For a standard storefront based on session and cart cookies, a full DPIA was usually not required, but the US hosting and any analytics or marketing layers raised the risk profile. Merchants migrating away from Amazon Webstore should reassess transfers and profiling in their new platform and document the change.
Sample consent text
We use necessary cookies to run our store and your basket. With your consent we also use analytics and marketing cookies to improve the store and show relevant offers, which may involve transferring data to the United States. You can accept, reject, or manage these at any time.
Third-party domains contacted
amazon.comamazonaws.comwebstore.amazon.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| session-id | Strictly necessary | Session | Maintains the storefront session, cart, and checkout state during a visit. |
| session-token | Strictly necessary | Session | Secures the authenticated session and basket on the Amazon hosted storefront. |
| store-prefs | Functional | 1 year | Remembers store preferences such as language and currency. |
| cookie_consent | Strictly necessary | 1 year | Stores the visitor cookie consent choices so the banner is not shown repeatedly. |
| _ga | Analytics | 2 years | Third party analytics cookie set only after consent where a merchant added web analytics. |
Amazon Webstore uses cookies for user preferences — inform visitors with a consent banner.
The storefront set strictly necessary session and basket cookies plus functional cookies for preferences. Any analytics or marketing cookies appeared only where the merchant added tags for measurement or advertising, and those required consent.
No consent was needed for strictly necessary store and basket cookies. Consent was required before analytics or marketing cookies were set, so a banner was mandatory once a merchant enabled such non essential tags.
Strictly necessary storefront cookies relied on contract performance and legitimate interest, since they were needed to run the store and basket. Analytics and marketing cookies relied on consent under Article 6(1)(a) of the GDPR.
Yes. It ran on US based Amazon and AWS infrastructure, so EU use involved transferring personal data to the United States. A valid mechanism such as the EU US Data Privacy Framework where applicable or standard contractual clauses with a transfer impact assessment was needed.
For a standard storefront on necessary cookies a full DPIA was usually not required, but US hosting and added analytics or marketing raised the risk. A DPIA was advisable where profiling was significant or sensitive data was involved.
Inventory cookies and tags, block optional ones until consent, confirm a valid US transfer safeguard, document the legal basis and retention per purpose, and if you have migrated, repeat the assessment for the new platform.
Since the platform was retired, common replacements include Shopify, BigCommerce, WooCommerce, and self-hosted European shop systems. Compare hosting location and data transfer terms, as some keep data in the EU.
List the cookies and tags your store sets with purpose and duration, state any US transfer and the safeguard relied on, reflect new integrations or a migration, and refresh the consent banner so visitors can re consent to the current set.