Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Ecwid is an e-commerce store widget by Lightspeed that can be embedded into any website. It sets essential cart and session cookies that keep the shopping basket and checkout working, plus analytics and marketing cookies. The essential cookies are exempt from consent, while analytics and marketing cookies require it.
Ecwid is an e-commerce store widget provided by Lightspeed that merchants can embed into almost any website or platform. It turns an existing site into an online store with product catalogues, a shopping cart, and checkout. Because it runs inside the visitor browser, it sets cookies that keep the store working and that support analytics and marketing.
Ecwid sets functional cookies that remember the contents of the shopping cart and maintain the customer session through checkout. It can also set analytics cookies that measure store performance and marketing cookies that support advertising and remarketing. The store also processes order and customer data such as names, addresses, and payment references needed to fulfil purchases.
Under the GDPR and the ePrivacy Directive, the functional cart and session cookies are strictly necessary to provide the service the customer requested, so they are exempt from consent. The analytics and marketing cookies are not strictly necessary and require prior consent under ePrivacy Art. 5(3). Order processing relies on contract under GDPR Art. 6(1)(b), while the merchant remains responsible for informing customers and handling their data lawfully.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The essential cart and session cookies may load without consent because they are needed to operate the store. The analytics and marketing cookies should fire only after the visitor gives explicit, informed, and freely given consent through a consent management platform. Visitors must be able to withdraw consent as easily as they gave it, and declining must not break the ability to shop.
Ecwid may process store and customer data in the United States. Transfers of personal data outside the European Economic Area rely on Standard Contractual Clauses and supplementary safeguards. Merchants should document these transfers in their records of processing and disclose them in the store privacy notice.
To run an Ecwid store compliantly, classify the cart and session cookies as essential and gate analytics and marketing cookies behind consent. Sign a data processing agreement with Lightspeed, document international transfers, and publish a clear cookie and privacy policy. Test that the store still functions when a visitor declines non essential cookies.
Websites using Ecwid must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment should consider several factors when deploying Ecwid. (1) The scope of customer and order data processed, including names, addresses, and payment references handled during checkout. (2) The distinction between essential cart and session cookies that are exempt from consent and analytics and marketing cookies that require it. (3) The lawful bases involved, namely contract for order processing and consent for non essential cookies. (4) The international transfer of store and customer data to the United States and the adequacy of Standard Contractual Clauses. (5) Data subject rights, retention periods, the Lightspeed processor relationship, and security measures protecting transaction data.
Sample consent text
Our store uses Ecwid. Essential cookies keep your cart and checkout working. With your consent, we also use analytics and marketing cookies to improve the store and personalise offers. You can accept, reject, or manage your choices at any time.
Third-party domains contacted
ecwid.comapp.ecwid.comimages-cdn.ecwid.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ecwid_shopping_cart | Functional | 30 days | Remembers the contents of the shopping cart so items are retained between page views. |
| ecwid_session | Functional | Session | Maintains the customer session through browsing and checkout in the store. |
| ecwid_analytics | Analytics | 1 year | Measures store performance and how visitors browse products to improve the store. |
| ecwid_marketing | Marketing | 1 year | Supports advertising and remarketing campaigns and personalisation of offers. |
Ecwid uses cookies for user preferences — inform visitors with a consent banner.
Ecwid sets functional cookies that remember the shopping cart and maintain the customer session, which are essential to the store. It can also set analytics cookies to measure store performance and marketing cookies for advertising and remarketing. You should scan your store to confirm the exact cookies before publishing your cookie policy.
Consent is required only for the analytics and marketing cookies, not for the essential cart and session cookies. The cart and session cookies are strictly necessary to provide the store the customer asked for, so they are exempt under ePrivacy Art. 5(3). You must therefore gate only the non essential Ecwid cookies behind your consent banner.
Order processing relies on contract under GDPR Art. 6(1)(b), as it is necessary to fulfil the purchase the customer requested. The analytics and marketing cookies rely on consent under Art. 6(1)(a) and ePrivacy Art. 5(3). The essential cart and session cookies are covered by the strictly necessary exemption rather than needing a separate consent.
Yes, Ecwid may process store and customer data in the United States. Transfers of personal data outside the European Economic Area rely on Standard Contractual Clauses and supplementary safeguards. You should disclose these transfers in your store privacy notice and record them in your processing documentation.
A DPIA is not always mandatory for a standard store, but it is worth considering because Ecwid processes order and customer data and may transfer it internationally. Assess the volume and sensitivity of the transaction data, the legal bases, and the transfer safeguards. If processing is likely to result in a high risk to customers, a DPIA becomes required.
Classify the cart and session cookies as strictly necessary and load them by default, while blocking analytics and marketing cookies until the visitor consents. Sign a data processing agreement with Lightspeed, document international transfers, and publish a clear cookie and privacy policy. Confirm that customers can still browse and check out when they decline non essential cookies.
Yes, alternatives include other embeddable and hosted e-commerce platforms such as Shopify, WooCommerce, and Snipcart, some of which offer European hosting. Each has its own cookie behaviour and data transfer profile, so evaluate them against your compliance requirements. A platform with EU data residency can reduce your international transfer obligations.
List each Ecwid cookie with its name, category, purpose, and duration, marking the cart and session cookies as essential and the analytics and marketing cookies as consent based. Disclose that store and customer data may be transferred to the United States under Standard Contractual Clauses. Review the policy when you add new store features that may introduce further cookies.