> How the Ecwid store widget by Lightspeed sets cart, session, analytics, and marketing cookies, which need consent under GDPR and ePrivacy, and how to comply.
>
> Canonical: https://www.flowconsent.com/en/services/ecommerce/ecwid

E-commerce

# Ecwid

Preferences · [Official website](https://www.ecwid.com/)

Ecwid is an e-commerce store widget by Lightspeed that can be embedded into any website. It sets essential cart and session cookies that keep the shopping basket and checkout working, plus analytics and marketing cookies. The essential cookies are exempt from consent, while analytics and marketing cookies require it.

[Block Ecwid until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [E-commerce](https://www.flowconsent.com/en/services/ecommerce)

- Consent

  Preferences

- Prior consent

  Required

- Documented cookies

  4

- Third-party domains

  3

- Servers

  United States

Overview

## What does Ecwid do?

## **What Ecwid is**

Ecwid is an e-commerce store widget provided by Lightspeed that merchants can embed into almost any website or platform. It turns an existing site into an online store with product catalogues, a shopping cart, and checkout. Because it runs inside the visitor browser, it sets cookies that keep the store working and that support analytics and marketing.

## **Data and cookies**

Ecwid sets functional cookies that remember the contents of the shopping cart and maintain the customer session through checkout. It can also set analytics cookies that measure store performance and marketing cookies that support advertising and remarketing. The store also processes order and customer data such as names, addresses, and payment references needed to fulfil purchases.

## **GDPR and ePrivacy**

Under the GDPR and the ePrivacy Directive, the functional cart and session cookies are strictly necessary to provide the service the customer requested, so they are exempt from consent. The analytics and marketing cookies are not strictly necessary and require prior consent under ePrivacy Art. 5(3). Order processing relies on contract under GDPR Art. 6(1)(b), while the merchant remains responsible for informing customers and handling their data lawfully.

## **Consent**

The essential cart and session cookies may load without consent because they are needed to operate the store. The analytics and marketing cookies should fire only after the visitor gives explicit, informed, and freely given consent through a consent management platform. Visitors must be able to withdraw consent as easily as they gave it, and declining must not break the ability to shop.

## **Data transfers**

Ecwid may process store and customer data in the United States. Transfers of personal data outside the European Economic Area rely on Standard Contractual Clauses and supplementary safeguards. Merchants should document these transfers in their records of processing and disclose them in the store privacy notice.

## **Practical steps**

To run an Ecwid store compliantly, classify the cart and session cookies as essential and gate analytics and marketing cookies behind consent. Sign a data processing agreement with Lightspeed, document international transfers, and publish a clear cookie and privacy policy. Test that the store still functions when a visitor declines non essential cookies.

Compliance

## Ecwid and the GDPR

Ecwid is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

- Legal basis

  Contract for order processing (GDPR Art. 6(1)(b)); consent for analytics and marketing cookies (Art. 6(1)(a), ePrivacy Art. 5(3))

- Risk level

  medium

- Applicable regulations

  GDPR, ePrivacy Directive

### Impact assessment (DPIA)

A data protection impact assessment should consider several factors when deploying Ecwid. (1) The scope of customer and order data processed, including names, addresses, and payment references handled during checkout. (2) The distinction between essential cart and session cookies that are exempt from consent and analytics and marketing cookies that require it. (3) The lawful bases involved, namely contract for order processing and consent for non essential cookies. (4) The international transfer of store and customer data to the United States and the adequacy of Standard Contractual Clauses. (5) Data subject rights, retention periods, the Lightspeed processor relationship, and security measures protecting transaction data.

### Sample text for your banner

> Our store uses Ecwid. Essential cookies keep your cart and checkout working. With your consent, we also use analytics and marketing cookies to improve the store and personalise offers. You can accept, reject, or manage your choices at any time.

Cookies and trackers

## What Ecwid sets and contacts

- Tracking method

  Functional cart and session cookies, with analytics and marketing cookies

- Server location

  United States

- Data transferred outside the EU

  Store and customer data may be processed in the United States; transfers rely on Standard Contractual Clauses.

### Cookies set (4)

| Name                  | Type       | Duration | Purpose                                                                               |
| --------------------- | ---------- | -------- | ------------------------------------------------------------------------------------- |
| ecwid\_shopping\_cart | Functional | 30 days  | Remembers the contents of the shopping cart so items are retained between page views. |
| ecwid\_session        | Functional | Session  | Maintains the customer session through browsing and checkout in the store.            |
| ecwid\_analytics      | Analytics  | 1 year   | Measures store performance and how visitors browse products to improve the store.     |
| ecwid\_marketing      | Marketing  | 1 year   | Supports advertising and remarketing campaigns and personalisation of offers.         |

### Third-party domains contacted (3)

- `ecwid.com`
- `app.ecwid.com`
- `images-cdn.ecwid.com`

Questions

## Frequently asked questions about Ecwid

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### What cookies does Ecwid set?

Ecwid sets functional cookies that remember the shopping cart and maintain the customer session, which are essential to the store. It can also set analytics cookies to measure store performance and marketing cookies for advertising and remarketing. You should scan your store to confirm the exact cookies before publishing your cookie policy.

### Is consent required to use Ecwid?

Consent is required only for the analytics and marketing cookies, not for the essential cart and session cookies. The cart and session cookies are strictly necessary to provide the store the customer asked for, so they are exempt under ePrivacy Art. 5(3). You must therefore gate only the non essential Ecwid cookies behind your consent banner.

### What is the legal basis for using Ecwid?

Order processing relies on contract under GDPR Art. 6(1)(b), as it is necessary to fulfil the purchase the customer requested. The analytics and marketing cookies rely on consent under Art. 6(1)(a) and ePrivacy Art. 5(3). The essential cart and session cookies are covered by the strictly necessary exemption rather than needing a separate consent.

### Does Ecwid transfer data to the United States?

Yes, Ecwid may process store and customer data in the United States. Transfers of personal data outside the European Economic Area rely on Standard Contractual Clauses and supplementary safeguards. You should disclose these transfers in your store privacy notice and record them in your processing documentation.

### Do I need a DPIA for Ecwid?

A DPIA is not always mandatory for a standard store, but it is worth considering because Ecwid processes order and customer data and may transfer it internationally. Assess the volume and sensitivity of the transaction data, the legal bases, and the transfer safeguards. If processing is likely to result in a high risk to customers, a DPIA becomes required.

### How do I implement Ecwid compliantly?

Classify the cart and session cookies as strictly necessary and load them by default, while blocking analytics and marketing cookies until the visitor consents. Sign a data processing agreement with Lightspeed, document international transfers, and publish a clear cookie and privacy policy. Confirm that customers can still browse and check out when they decline non essential cookies.

### Are there alternatives to Ecwid?

Yes, alternatives include other embeddable and hosted e-commerce platforms such as Shopify, WooCommerce, and Snipcart, some of which offer European hosting. Each has its own cookie behaviour and data transfer profile, so evaluate them against your compliance requirements. A platform with EU data residency can reduce your international transfer obligations.

### How do I update my cookie policy for Ecwid?

List each Ecwid cookie with its name, category, purpose, and duration, marking the cart and session cookies as essential and the analytics and marketing cookies as consent based. Disclose that store and customer data may be transferred to the United States under Standard Contractual Clauses. Review the policy when you add new store features that may introduce further cookies.

Same category

## More services: E-commerce

[See the whole category](https://www.flowconsent.com/en/services/ecommerce)

### [TradePro](https://www.flowconsent.com/en/services/ecommerce/tradepro)

[TradePro is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. TradePro integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, TradePro helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/tradepro)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/tradepro)

·

### [Hypervisual Page Builder](https://www.flowconsent.com/en/services/ecommerce/hypervisual-page-builder)

[Hypervisual Page Builder is a versatile page builder that enables web designers and marketers to create high-converting landing pages and web pages with an intuitive visual editor. It features drag-and-drop functionality, responsive design controls, and a library of customizable templates. Hypervisual Page Builder integrates with popular CMS platforms, marketing tools, and analytics services, allowing users to build and optimize pages that drive engagement and conversions without writing code.](https://www.flowconsent.com/en/services/ecommerce/hypervisual-page-builder)

[Analytics](https://www.flowconsent.com/en/services/ecommerce/hypervisual-page-builder)

·

### [LogoiX](https://www.flowconsent.com/en/services/ecommerce/logoix)

[LogoiX is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. LogoiX integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, LogoiX helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/logoix)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/logoix)

·

### [Loadify](https://www.flowconsent.com/en/services/ecommerce/loadify)

[Loadify is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Loadify supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Loadify remains a leading web development choice.](https://www.flowconsent.com/en/services/ecommerce/loadify)

[E-commerce](https://www.flowconsent.com/en/services/ecommerce/loadify)

·

### [ChargeAfter](https://www.flowconsent.com/en/services/ecommerce/chargeafter)

[ChargeAfter is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ChargeAfter integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ChargeAfter helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/chargeafter)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/chargeafter)

·

### [CJdropshipping](https://www.flowconsent.com/en/services/ecommerce/cjdropshipping-app)

[CJDropshipping app is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. CJDropshipping app supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, CJDropshipping app remains a leading web development choice.](https://www.flowconsent.com/en/services/ecommerce/cjdropshipping-app)

[Preferences](https://www.flowconsent.com/en/services/ecommerce/cjdropshipping-app)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)