FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

Craft Commerce

PreferencesOfficial website

How Craft Commerce handles cookies and personal data, and what European websites must do to use it in a GDPR and ePrivacy compliant way.

Block Craft Commerce until consentScan my site
Overview

What does Craft Commerce do?

What Craft Commerce is

Craft Commerce is a self hosted ecommerce platform. It is an ecommerce plugin for the Craft content management system that adds a basket, orders and checkout to a self hosted site. When it runs on a website it operates as a third party processor whose scripts, cookies and network requests are loaded into the browsers of your European visitors.

Data and cookies Craft Commerce collects

In a typical deployment Craft Commerce processes shopping basket contents, order and account data, session identifiers and, where analytics modules are enabled, usage statistics. Most of this information qualifies as personal data under the GDPR because it can be linked to an identifiable person, directly or through online identifiers stored on the device.

GDPR and ePrivacy implications

Any storage of or access to information on a visitor device is governed by Article 5(3) of the ePrivacy Directive, transposed into national law across the EU. The GDPR then governs the subsequent processing, so Craft Commerce must have a valid legal basis, a clear retention period and transparent information for the data subject.

Consent requirements

Because Craft Commerce sets cookies or identifiers that are not strictly necessary to deliver a service the visitor explicitly requested, prior, freely given, specific and informed consent is required before it loads. Scripts must stay blocked until the visitor accepts, and refusal must be as easy as acceptance.

International data transfers

Craft Commerce reports hosting in merchant defined servers (self hosted), which keeps the core processing inside the European Economic Area. You should still confirm the location of any subprocessors and content delivery nodes, because a single non European endpoint can still trigger a transfer.

Practical compliance steps

List Craft Commerce in your records of processing and your cookie policy, load it only through a consent management platform, document the consent you collect and review the vendor data processing agreement at least once a year. Test the site with consent refused to make sure no identifier is set before a choice is made.

Compliance

Craft Commerce and the GDPR

Craft Commerce is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Contract (Art. 6(1)(b) GDPR) for core functionality; consent (Art. 6(1)(a) GDPR) for optional cookies
Risk level
medium
Applicable regulations
GDPR; ePrivacy Directive 2002/58/EC; national rules (TTDSG, CNIL guidelines, LSSI)

Impact assessment (DPIA)

Assess the volume and sensitivity of data processed through Craft Commerce, whether visitors are profiled or tracked across sites, and any transfer outside the EEA. A formal DPIA is advisable where Craft Commerce enables large scale monitoring or combines data from several sources.

Sample text for your banner

We use Craft Commerce to power parts of this site. It may store cookies and identifiers on your device and process related data. With your consent we activate Craft Commerce. You can withdraw your consent at any time from the cookie settings.
Cookies and trackers

What Craft Commerce sets and contacts

Tracking method
First party cookies and server side sessions (self hosted)
Server location
merchant defined servers (self hosted)

Cookies set (3)

NameTypeDurationPurpose
CraftSessionIdnecessarySessionIdentifies the user session
CRAFT_CSRF_TOKENnecessarySessionProtects forms against cross site request forgery
commerce_cartnecessary1 monthLinks the visitor to their shopping cart

Third-party domains contacted (1)

  • craftcms.com
Questions

Frequently asked questions about Craft Commerce

Can't find your question? Write to us, we answer fast.

What cookies does Craft Commerce set?

Craft Commerce typically stores session identifiers and, depending on configuration, analytics or marketing cookies. The exact names and lifetimes appear in the cookie table on this page, and you should scan your own site because deployments differ.

Do I need consent to use Craft Commerce?

Yes. Craft Commerce sets cookies or identifiers that are not strictly necessary, so under Article 5(3) ePrivacy you must obtain prior consent before it loads.

What is the legal basis for Craft Commerce?

The non essential cookies rely on consent under Article 6(1)(a) GDPR combined with Article 5(3) ePrivacy. Strictly necessary processing can rely on contract under Article 6(1)(b) or legitimate interest under Article 6(1)(f).

Does Craft Commerce transfer data to the United States or other third countries?

Craft Commerce reports hosting in merchant defined servers (self hosted), so by default data stays in the EEA. Verify subprocessors and CDN nodes, since one non European endpoint can still create a transfer to a third country.

Do I need a DPIA for Craft Commerce?

A DPIA is required when processing is likely to result in a high risk, for example large scale tracking or profiling. Where Craft Commerce monitors behaviour at scale or combines data sources, run a DPIA before going live.

How do I implement Craft Commerce in a compliant way?

Load Craft Commerce only after consent through a consent management platform, keep it blocked by default, document each consent, list it in your records and cookie policy, and sign a data processing agreement with the vendor.

Are there alternatives to Craft Commerce?

Yes. Depending on your goal you can choose privacy first or cookieless tools, or self hosted options that keep data in the EEA. Whichever you pick, the same consent and transparency duties apply.

How do I update my cookie policy for Craft Commerce?

Add Craft Commerce to the cookie policy with its purpose, the cookies it sets, their duration and the recipient, note any third country transfer and the safeguard used, and refresh the entry whenever you change configuration or after a new cookie scan.

Same category

More services: E-commerce

See the whole category

Linx Commerce

Linx Commerce is a comprehensive e-commerce platform that provides businesses with all the tools needed to build, manage, and grow an online store. From product catalog management and secure payment processing to inventory tracking and order fulfillment, Linx Commerce delivers a complete commerce solution. It features responsive storefront themes, SEO-optimized product pages, and powerful marketing tools to help merchants increase visibility and drive sales across channels.

Preferences

Searchanise

Searchanise is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Searchanise offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Searchanise empowers organizations to optimize strategy and maximize return on investment.

Analytics

Nidux

Nidux is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Nidux supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Nidux ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Bottle

Bottle is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Bottle enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Bottle empowers marketing teams to achieve measurable growth.

Preferences

Mondial Relay

Mondial Relay is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Mondial Relay supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Mondial Relay ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

TradePro

TradePro is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. TradePro integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, TradePro helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site