> Operate Magento Open Source or Adobe Commerce in compliance with GDPR, ePrivacy and TDDDG. Cookies, EU residency, CMP integration and DPIA explained. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/magento E-commerce # Magento Preferences · [Official website](https://magento.com) Magento (rebranded Adobe Commerce since 2018) is a leading open source e commerce platform written in PHP. Magento Open Source can be self hosted on EU infrastructure for full GDPR control, while Adobe Commerce Cloud offers managed hosting on AWS Frankfurt or Dublin. Magento sets first party cookies for the cart, session and checkout. Marketing cookies added through extensions or the integrated Adobe Analytics tag require prior consent. [Block Magento until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 6 - Third-party domains 4 - Servers Self hosted on the merchant infrastructure (Adobe Commerce, Magento Open Source, Mage-OS) or on Adobe Commerce Cloud (AWS US, Ireland, Frankfurt regions). Overview ## What does Magento do? Magento was created in 2008 by Varien, acquired by eBay in 2011, then by Adobe in 2018 for 1.68 billion USD. Since 2021 the platform exists as Magento Open Source (free, community), Adobe Commerce (paid, with B2B and headless features) and Adobe Commerce Cloud (managed PaaS on AWS). The community fork Mage-OS continues the open source lineage independently. Magento powers around 200,000 active stores worldwide and remains the dominant choice for mid market and enterprise e commerce in the EU. ## **What Magento is and how it works** Magento is a server side PHP application running on Apache or Nginx with MySQL or MariaDB as the database. The storefront serves rendered HTML and uses Knockout.js for the cart and checkout. Customer state is persisted in PHP sessions backed by Redis or the database, and a small set of first party cookies tie the browser to the session. Adobe Commerce Cloud automates the deployment on AWS with auto scaling and a Fastly based CDN. ## **What data and cookies Magento collects** Strictly necessary cookies set by core Magento include PHPSESSID (PHP session, session), form\_key (anti CSRF, session), private\_content\_version (caching invalidation, 1 year), mage-cache-storage (cart cache, session), mage-messages (storefront messaging, session) and X-Magento-Vary (cache vary key, session). Customer authentication adds persistent\_shopping\_cart (1 year). Marketing extensions and integrated tags (Adobe Analytics, Google Analytics, Meta Pixel) add their own cookies that require consent. ## **GDPR and ePrivacy implications** The strictly necessary checkout cookies are exempt from the Art. 5(3) ePrivacy consent requirement because they are necessary to provide the requested service (the contract). Marketing, analytics and personalisation cookies added through extensions or the integrated Adobe Analytics tag always require prior consent. The persistent\_shopping\_cart cookie sits in a grey area: most regulators accept it as strictly necessary if the visitor explicitly opted in to the Remember me feature. ## **Consent requirements and configuration** Install a CMP that natively integrates with Magento (Cookiebot, CookieFirst, Klaro for Magento, Amasty Cookie Notice, MageWorx Cookie Manager). Configure the storefront layout XML so every marketing tag is wrapped behind the consent state. Use the built in Magento GDPR features (Customer Privacy module: data export, anonymisation, Right to Erasure workflow) to satisfy data subject requests. Adobe Commerce Cloud customers get the Adobe Privacy Service for the Right to Erasure across the Marketing Cloud. ## **Data transfers outside the EU** Self hosted Magento on EU infrastructure has zero third country transfer for the storefront itself. Adobe Commerce Cloud customers can choose AWS Frankfurt or Dublin to keep all data in the EU. Adobe is certified under the EU US Data Privacy Framework, and the Master Subscription Agreement includes Standard Contractual Clauses as a fallback. Always check that the third party extensions you install do not silently transfer data to the US. ## **Practical compliance steps** Choose AWS Frankfurt or Dublin if you use Adobe Commerce Cloud. Sign the Adobe Customer DPA. Install a CMP integrated with Magento and gate every marketing tag behind it. Enable the Magento Customer Privacy module to handle data subject requests. Document Adobe Inc as a processor in your Article 30 register if you use Adobe Commerce Cloud. Audit every third party extension before installation to confirm its data flows. Compliance ## Magento and the GDPR Magento is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Performance of contract (Art. 6(1)(b) GDPR) for strictly necessary checkout cookies. Consent (Art. 6(1)(a) + Art. 5(3) ePrivacy) for marketing, analytics and personalisation cookies. Legitimate interest (Art. 6(1)(f)) for fraud prevention. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, TDDDG (DE), LOPDGDD (ES), Loi Informatique et Libertes (FR), CCPA, IAB TCF v2.2 (via extension), Google Consent Mode v2 ### Impact assessment (DPIA) A DPIA is generally not required for the Magento platform itself when used as an e commerce store. A DPIA may be triggered by the marketing extensions (advertising pixels, recommendation engines, fraud scoring) installed from the Adobe Commerce Marketplace if those involve large scale profiling. ### Sample text for your banner > We use cookies and similar technologies to operate this store. Cookies that are strictly necessary for the cart, checkout and security are always active. Marketing, analytics and personalisation cookies require your consent. You can change your choice at any time via the Cookie preferences link in the footer. Cookies and trackers ## What Magento sets and contacts - Tracking method Server side e commerce platform written in PHP. Storefront sets first party cookies for the cart, customer session and checkout. Optional Adobe Commerce cloud telemetry and integrated Adobe Analytics or Google Analytics tags require additional consent. - Server location Self hosted on the merchant infrastructure (Adobe Commerce, Magento Open Source, Mage-OS) or on Adobe Commerce Cloud (AWS US, Ireland, Frankfurt regions). ### Cookies set (6) | Name | Type | Duration | Purpose | | -------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | PHPSESSID | first\_party | session | PHP server session cookie that links the visitor browser to the Magento application session. Strictly necessary. | | form\_key | first\_party | session | Anti CSRF token used to protect form submissions. Strictly necessary. | | mage-cache-storage | first\_party | session | Local storage cache for the cart and customer state. Strictly necessary. | | private\_content\_version | first\_party | 1 year | Used by the full page cache to invalidate private blocks (cart count, mini cart). Strictly necessary. | | X-Magento-Vary | first\_party | session | Cache vary key used by Varnish or the built in full page cache to serve the correct customer specific page. Strictly necessary. | | persistent\_shopping\_cart | first\_party | 1 year | Restores the customer cart and address when the visitor returns from the same browser. Requires consent unless the visitor opted in to Remember me. | ### Third-party domains contacted (4) - `magento.com` - `adobe.com` - `mage-os.org` - `(merchant controlled storefront domain)` Questions ## Frequently asked questions about Magento Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Magento set? Strictly necessary first party cookies on the merchant domain: PHPSESSID, form\_key, mage-cache-storage, private\_content\_version, X-Magento-Vary (all session). The customer Remember me feature adds persistent\_shopping\_cart (1 year). Marketing extensions and integrated tags add their own cookies that fall outside the strictly necessary scope. ### Is consent required for Magento? The strictly necessary checkout cookies do not require consent under the Art. 5(3) ePrivacy exemption. Marketing, analytics and personalisation cookies installed via Magento extensions or the integrated Adobe Analytics tag always require prior consent. ### What is the legal basis for processing through Magento? Performance of contract (Art. 6(1)(b) GDPR) for cart, checkout and customer account management. Legal obligation (Art. 6(1)(c)) for invoicing and tax records. Legitimate interest (Art. 6(1)(f)) for security and fraud prevention. Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy) for marketing tags. ### Does Magento transfer data to the United States? Self hosted Magento on EU infrastructure does not transfer any data outside the EU. Adobe Commerce Cloud customers can choose AWS Frankfurt or Dublin to keep data in the EU. Adobe is certified under the EU US Data Privacy Framework and the Master Subscription Agreement includes Standard Contractual Clauses. ### Do I need a DPIA for Magento? A DPIA is generally not required for the platform itself when used as a standard e commerce store. A DPIA may be required for marketing extensions (advertising pixels, recommendation engines, fraud scoring) installed from the Adobe Commerce Marketplace if they involve large scale profiling. ### How do I implement Magento for GDPR compliance? Pick a CMP integrated with Magento (Cookiebot, CookieFirst, Klaro for Magento, Amasty Cookie Notice). Gate every marketing tag behind the consent state. Enable the Magento Customer Privacy module to handle data subject requests. Keep your hosting in the EU (self hosted or Adobe Commerce Cloud Frankfurt or Dublin) and audit each third party extension before installation. ### What are the alternatives to Magento? Other open source e commerce platforms: PrestaShop (France), Sylius (Symfony), Spryker (Germany, headless), OroCommerce (B2B), CommerceTools (Germany, MACH), Shopware (Germany). Hosted alternatives include Shopify, BigCommerce and Salesforce Commerce Cloud. ### How do I keep my cookie policy up to date with Magento? List the strictly necessary cookies (PHPSESSID, form\_key, mage-cache-storage, private\_content\_version, X-Magento-Vary, persistent\_shopping\_cart) with their lifetime and purpose. Re scan after every extension installation or upgrade. Document Adobe Inc as a processor if you use Adobe Commerce Cloud. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Addi](https://www.flowconsent.com/en/services/ecommerce/addi) [Addi is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Addi supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Addi ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/addi) [Preferences](https://www.flowconsent.com/en/services/ecommerce/addi) · ### [Mojo](https://www.flowconsent.com/en/services/ecommerce/mojo) [Mojo offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Mojo integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for sustainable growth.](https://www.flowconsent.com/en/services/ecommerce/mojo) [Preferences](https://www.flowconsent.com/en/services/ecommerce/mojo) · ### [Fact Finder](https://www.flowconsent.com/en/services/ecommerce/fact-finder) [Fact Finder is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Fact Finder supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Fact Finder enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/ecommerce/fact-finder) [Analytics](https://www.flowconsent.com/en/services/ecommerce/fact-finder) · ### [Medusa](https://www.flowconsent.com/en/services/ecommerce/medusajs) [Medusajs is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Medusajs integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Medusajs helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/medusajs) [Preferences](https://www.flowconsent.com/en/services/ecommerce/medusajs) · ### [MyTime](https://www.flowconsent.com/en/services/ecommerce/mytime) [MyTime is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. MyTime supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, MyTime ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/mytime) [Preferences](https://www.flowconsent.com/en/services/ecommerce/mytime) · ### [Reserva INK](https://www.flowconsent.com/en/services/ecommerce/reserva-ink) [Reserva INK is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Reserva INK supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Reserva INK ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/reserva-ink) [Preferences](https://www.flowconsent.com/en/services/ecommerce/reserva-ink) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)