FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

Lightspeed eCom

PreferencesOfficial website

Lightspeed eCom is a cloud ecommerce platform operated by Lightspeed Commerce. European stores are hosted on AWS Ireland. The shopfront sets strictly necessary session and cart cookies, while marketing tags installed from the Lightspeed App Store require consent under ePrivacy.

Block Lightspeed eCom until consentScan my site
Overview

What does Lightspeed eCom do?

What Lightspeed eCom is and how it serves a shop

Lightspeed eCom is a cloud ecommerce platform operated by Lightspeed Commerce Inc., headquartered in Montreal, Canada. The platform combines a hosted storefront, a catalog manager, the back office for order processing and an App Store of integrations (analytics, advertising, payment, shipping). European merchants are typically provisioned on AWS Ireland for content storage and the application stack. Stores are reachable on a customer subdomain (mystore.webshopapp.com) or a custom domain.

Cookies and identifiers set on visitors

By default the Lightspeed storefront sets a PHP session cookie, a cart identifier, a CSRF token and a CDN load balancing cookie. These are strictly necessary for the cart and checkout to work. The backoffice for merchants uses its own authentication cookies on admin.merchantos.com. Marketing cookies such as Google Ads, Meta Pixel, Klaviyo or TikTok Pixel appear only when the merchant installs the corresponding app in the Lightspeed App Store and configures it on the theme.

GDPR and ePrivacy implications

Strictly necessary cart and session cookies fall under the Article 5(3) ePrivacy carveout and do not require prior consent. Any optional analytics or advertising cookie added through the App Store requires opt in consent under Article 5(3) ePrivacy and Article 6(1)(a) GDPR. The merchant is the controller for all customer data processed in the shop. Lightspeed Commerce is the processor under Article 28 GDPR, with a DPA available in the merchant agreement.

Data transfers and Schrems II

European stores are hosted on AWS Ireland which keeps order data in the EEA. The corporate Lightspeed Commerce Inc. operates from Canada, which benefits from an adequacy decision. Support, billing and marketing tooling use additional US providers (Segment, HubSpot, Intercom, Stripe) covered by Standard Contractual Clauses and the EU US Data Privacy Framework. The optional Lightspeed marketing apps may transfer behavioral data to US platforms when installed.

Practical compliance steps

Install a consent management platform that integrates with the Lightspeed theme to gate Google Ads, Meta Pixel, Klaviyo and other marketing scripts. Sign the Lightspeed DPA. Document the processor in your record of processing activities with the AWS Ireland region, the order retention period and the list of installed apps. Configure shopper data retention and deletion flows. For shops in Germany, France, Spain and the rest of the EU, the consent banner must operate before any non strictly necessary cookie is set.

Compliance

Lightspeed eCom and the GDPR

Lightspeed eCom is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Article 6(1)(f) GDPR (legitimate interest) for the strictly necessary cart and session cookies. Article 6(1)(a) (consent) and Article 5(3) ePrivacy for any optional analytics and advertising tags activated in the Lightspeed app marketplace.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, DSGVO, RGPD, LSSI, Canadian PIPEDA, Belgian GBA enforcement of GDPR, IAB TCF when consent management is layered on top

Impact assessment (DPIA)

A DPIA is recommended for Lightspeed eCom stores that activate behavioral marketing tags (Google Ads, Meta Pixel, TikTok Pixel, Klaviyo) because they enable profiling of shoppers. Document the legal basis for each tag, the EU US data transfer triggered by Meta and Google, the retention period for cart and order data, and the integration with a consent management platform.

Sample text for your banner

This shop is powered by Lightspeed eCom. Lightspeed sets a session and cart cookie that is strictly necessary for the checkout to work. Additional marketing cookies (Google Ads, Meta Pixel, Klaviyo) are activated only after you accept them in the consent banner.
Cookies and trackers

What Lightspeed eCom sets and contacts

Tracking method
Cloud ecommerce platform that hosts the storefront and admin on Lightspeed infrastructure. The shopfront sets first party session, cart and CSRF cookies (PHPSESSID, cartid, lightspeed_session, _shopify_y for some templates) and integrates with Google Analytics, Meta Pixel, Klarna and other third party tags through the marketing apps. The customer chooses which trackers to install.
Server location
Lightspeed eCom (E Series, formerly EcWid, and C Series, formerly SEOshop) is operated by Lightspeed Commerce Inc. (Montreal, Canada). Hosting is on Amazon Web Services with primary regions EU West 1 (Ireland) for European customers and US East 1 (Virginia) for North American customers. CDN by Amazon CloudFront. Lightspeed Retail POS in Europe is operated by Lightspeed Europe (Ghent, Belgium).
Data transferred outside the EU
European Lightspeed eCom stores are hosted on AWS Ireland, keeping core shop data in the EEA. Lightspeed Commerce is headquartered in Canada, which has an adequacy decision from the European Commission. Corporate support and analytics tools include US providers (Segment, HubSpot, Intercom). The marketing tags injected through Lightspeed apps (Google, Meta, Klaviyo) may transfer data to the US.

Cookies set (5)

NameTypeDurationPurpose
PHPSESSIDfirst-partySessionPHP session cookie used by the Lightspeed storefront to maintain the shopper context across pages. Strictly necessary.
cartidfirst-partyUp to 30 daysCart identifier used to persist the basket between visits. Strictly necessary for ecommerce functionality.
lightspeed_sessionfirst-partySessionLightspeed session identifier used by the storefront framework. Strictly necessary.
AWSALBfirst-party (AWS Application Load Balancer)7 daysAWS load balancer cookie that routes requests to the same backend instance during a session. Strictly necessary for performance.
XSRF-TOKENfirst-partySessionCross site request forgery token used to protect state changing operations like checkout. Strictly necessary.

Third-party domains contacted (6)

  • lightspeedhq.com
  • webshopapp.com
  • shoplightspeed.com
  • admin.merchantos.com
  • d2cnel0prk94o2.cloudfront.net
  • static.webshopapp.com
Questions

Frequently asked questions about Lightspeed eCom

Can't find your question? Write to us, we answer fast.

Does Lightspeed eCom set cookies on shop visitors?

Yes. The Lightspeed storefront sets a PHP session cookie, a cart identifier, a CSRF token and a load balancing cookie. These are strictly necessary for the cart and checkout. Marketing cookies (Google Ads, Meta Pixel, Klaviyo) only appear if the merchant installs the corresponding app from the Lightspeed App Store.

Do I need consent for Lightspeed eCom under GDPR and ePrivacy?

No consent is required for the strictly necessary cart and session cookies. Optional analytics and advertising cookies installed via the App Store require prior opt in consent under Article 5(3) ePrivacy.

What is the legal basis for processing data with Lightspeed eCom?

Article 6(1)(b) GDPR (performance of a contract) for order processing, Article 6(1)(f) (legitimate interest) for the strictly necessary storefront cookies, Article 6(1)(a) (consent) for any optional marketing tag. The merchant is the controller, Lightspeed Commerce is the processor with a DPA.

Does Lightspeed eCom transfer data to the United States?

European stores are hosted on AWS Ireland, keeping order data in the EEA. Lightspeed Commerce operates from Canada with an EU adequacy decision. Marketing apps that connect Google Ads, Meta or TikTok will transfer behavioral data to the US, covered by SCCs and the EU US Data Privacy Framework.

Is a DPIA required for Lightspeed eCom?

A DPIA is recommended when marketing apps that profile shoppers are installed (Meta Pixel, Google Ads, TikTok Pixel, Klaviyo). It is also useful when the shop processes large volumes of orders or stores additional personal data through custom fields.

How do I implement Lightspeed eCom compliantly?

Install a consent management platform that integrates with the Lightspeed theme, gate marketing tags behind consent, sign the Lightspeed DPA, document the AWS Ireland region in your RoPA, configure order retention and customer deletion flows, and ensure all installed marketing apps respect consent signals.

What are the alternatives to Lightspeed eCom?

Other ecommerce platforms include Shopify, BigCommerce, WooCommerce, PrestaShop (France), Shopware (Germany), Sylius (open source), Saleor (open source), Magento, Wix, Squarespace and Centra (Sweden).

How do I update the cookie policy for Lightspeed eCom?

List the strictly necessary storefront cookies (session, cart, CSRF, load balancing) with their purpose and duration in the cookie disclosure. Add an entry for each marketing app installed (Google Ads, Meta Pixel, Klaviyo, TikTok Pixel) with retention and EU US transfer information. Update whenever a new app is installed.

Same category

More services: E-commerce

See the whole category

Sellwild

Sellwild is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Sellwild supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Sellwild ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

CommentSold

CommentSold is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. CommentSold integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, CommentSold helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Payflex

Payflex is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Payflex integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Payflex helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Thelia

Thelia is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Thelia integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Thelia helps organizations maintain robust websites that meet user expectations and technical requirements.

E-commerce

Namastay

Namastay is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Namastay enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Namastay empowers marketing teams to achieve measurable growth.

Preferences

Piano

Piano is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Piano provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Piano helps deliver the right message to the right audience at the right time.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site