> OpenCart and GDPR: open source PHP e-commerce, EU self-hosting, strictly necessary cart cookies, analytics tags from extensions, DPIA and consent. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/opencart E-commerce # OpenCart Preferences · [Official website](https://www.opencart.com) OpenCart is an open source PHP ecommerce platform. The customer self hosts the application, which gives full control over the storage region. The storefront sets strictly necessary session, cart and language cookies. Optional analytics or advertising tags installed via extensions require consent. [Block OpenCart until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers OpenCart Limited (Hong Kong), with development contributed worldwide. The platform is fully self hosted, so the hosting region is chosen by the customer. Typical EU deployments run on OVH, Scaleway, Hetzner, Strato, IONOS, AWS Frankfurt or Ireland, or on premise LAMP stacks. Overview ## What does OpenCart do? ## **What OpenCart is and how it serves a shop** OpenCart is a free and open source PHP ecommerce platform launched in 2008. It is distributed under a GPL licence and maintained by OpenCart Limited in Hong Kong with a large worldwide community. The application runs on a standard LAMP stack (PHP, MySQL or MariaDB) and supports themes and a large catalogue of extensions through the OpenCart Marketplace. The customer self hosts on their own infrastructure, which gives full control over the storage region. ## **Cookies and identifiers set on visitors** By default OpenCart sets PHPSESSID, OCSESSID, currency and language cookies on the storefront. These are strictly necessary to maintain the shopper context, the cart and the localization preferences. The /admin area uses its own authentication cookies. Optional analytics or advertising cookies appear only when the merchant installs the corresponding extension (Google Analytics, Meta Pixel, Klaviyo) or adds custom scripts to the theme. ## **GDPR and ePrivacy implications** Strictly necessary cart and session cookies fall under the Article 5(3) ePrivacy carveout. Article 6(1)(b) GDPR (performance of a contract) covers the order processing flow. Any optional analytics or advertising tag installed via extensions requires prior opt in consent under Article 5(3) ePrivacy. The merchant is the controller of all data managed in OpenCart. There is no SaaS processor since the platform is self hosted. ## **Data transfers and Schrems II** Self hosted OpenCart does not transfer anything by itself. Pick an EU based hosting provider (OVH, Scaleway, Hetzner, Strato, IONOS, AWS Frankfurt or Ireland) and a CDN with EU presence (Cloudflare with the EU data localization suite, BunnyCDN, Fastly EU) to keep data inside the EEA. Be careful with installed extensions that connect to US APIs (Stripe, PayPal, Mailchimp), each of these adds a separate transfer that must be documented. ## **Practical compliance steps** Host inside the EU, protect /admin behind an IP allowlist or VPN, enforce strong passwords and consider an OpenCart 2FA extension. Document the deployment in your record of processing activities with hosting provider, retention period for orders and the list of installed extensions. Add a consent banner (OpenCart GDPR cookie law extensions, Cookiebot, CookieFirst) to gate analytics and advertising tags. Implement DSAR flows leveraging the built in OpenCart customer data export available since version 3.0.3. Compliance ## OpenCart and the GDPR OpenCart is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Article 6(1)(b) GDPR (performance of a contract) for order processing. Article 6(1)(f) (legitimate interest) for the strictly necessary cart and session cookies. Article 6(1)(a) (consent) and Article 5(3) ePrivacy for any optional analytics or advertising tag installed by the merchant. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, DSGVO, RGPD, LSSI, EU US Data Privacy Framework if a US based CDN or payment provider is used ### Impact assessment (DPIA) A DPIA is generally not required for a typical OpenCart shop. It should be considered when the shop processes large volumes of orders with sensitive data, when behavioral analytics extensions are installed, or when the shop integrates with third party advertising platforms. Document the hosting region, the access controls on /admin and the installed extensions in the record of processing activities. ### Sample text for your banner > This shop is powered by OpenCart. OpenCart sets a session and cart cookie that are strictly necessary for the checkout to work. Optional analytics or advertising cookies installed by extensions are activated only after you accept them in the consent banner. Cookies and trackers ## What OpenCart sets and contacts - Tracking method Open source PHP ecommerce platform. The customer self hosts on PHP plus MySQL/MariaDB infrastructure. OpenCart sets first party session, cart and language cookies on the storefront (PHPSESSID, OCSESSID, currency, language) and admin authentication cookies on /admin. Optional analytics or advertising tags are added through extensions and themes. - Server location OpenCart Limited (Hong Kong), with development contributed worldwide. The platform is fully self hosted, so the hosting region is chosen by the customer. Typical EU deployments run on OVH, Scaleway, Hetzner, Strato, IONOS, AWS Frankfurt or Ireland, or on premise LAMP stacks. ### Cookies set (4) | Name | Type | Duration | Purpose | | --------- | ----------- | -------- | ------------------------------------------------------------------------------------------------------------------ | | PHPSESSID | first-party | Session | Standard PHP session identifier used by OpenCart to maintain the shopper context across pages. Strictly necessary. | | OCSESSID | first-party | Session | OpenCart specific session identifier used for cart state and checkout flow. Strictly necessary. | | currency | first-party | 30 days | Stores the currency selected by the shopper. Strictly necessary for the shopping experience. | | language | first-party | 30 days | Stores the language selected by the shopper. Strictly necessary for the shopping experience. | ### Third-party domains contacted (4) - `opencart.com` - `www.opencart.com` - `extensions.opencart.com` - `cdn.opencart.com` Questions ## Frequently asked questions about OpenCart Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does OpenCart set cookies on shop visitors? Yes. OpenCart sets PHPSESSID, OCSESSID, currency and language cookies on the storefront. These are strictly necessary for the cart, checkout and localization. Optional analytics and advertising cookies appear only when the merchant installs the corresponding extension. ### Do I need consent for OpenCart under GDPR and ePrivacy? No consent is required for the strictly necessary cart, session and language cookies. Prior opt in consent is required for any analytics or advertising cookie added via extensions or theme customization. ### What is the legal basis for processing data with OpenCart? Article 6(1)(b) GDPR (performance of a contract) for order processing, Article 6(1)(f) (legitimate interest) for the strictly necessary cookies, Article 6(1)(a) (consent) for optional tracking tags. The merchant is the controller, the hosting provider acts as processor for the infrastructure. ### Does OpenCart transfer data to the United States? Self hosted OpenCart does not transfer anything by itself. The merchant chooses the hosting provider and the CDN. Pick EU based providers to keep data inside the EEA. Be careful with installed extensions that connect to US APIs (Stripe, PayPal, Mailchimp), each adds a separate transfer. ### Is a DPIA required for OpenCart? A DPIA is not generally required for a typical shop. It is recommended when large volumes of personal data are processed, when behavioral analytics extensions are installed, or when the shop integrates with third party advertising platforms. ### How do I implement OpenCart compliantly? Host inside the EU, protect /admin behind IP allowlist or VPN, enforce strong passwords and 2FA, document the deployment in your RoPA, add a consent banner via an OpenCart GDPR extension and implement DSAR flows via the native customer data export available since version 3.0.3. ### What are the alternatives to OpenCart? Other open source ecommerce platforms include WooCommerce (WordPress), PrestaShop (France), Shopware (Germany), Magento Open Source, Sylius, Saleor and Drupal Commerce. For hosted solutions consider Shopify, BigCommerce, Lightspeed eCom and Wix Stores. ### How do I update the cookie policy for OpenCart? List the strictly necessary OpenCart cookies (PHPSESSID, OCSESSID, currency, language) in your cookie disclosure with purpose and duration. Add an entry for each installed extension or theme script with retention and any third country transfer information. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [WineDirect](https://www.flowconsent.com/en/services/ecommerce/winedirect) [WineDirect is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. WineDirect supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, WineDirect ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/winedirect) [Preferences](https://www.flowconsent.com/en/services/ecommerce/winedirect) · ### [WSHOP](https://www.flowconsent.com/en/services/ecommerce/wshop) [WSHOP is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. WSHOP integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, WSHOP helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/wshop) [Preferences](https://www.flowconsent.com/en/services/ecommerce/wshop) · ### [Direktonline](https://www.flowconsent.com/en/services/ecommerce/direktonline) [Direktonline is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Direktonline integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Direktonline helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/direktonline) [Preferences](https://www.flowconsent.com/en/services/ecommerce/direktonline) · ### [Plattar](https://www.flowconsent.com/en/services/ecommerce/plattar) [Plattar is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Plattar provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Plattar helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/ecommerce/plattar) [Marketing](https://www.flowconsent.com/en/services/ecommerce/plattar) · ### [City Hive](https://www.flowconsent.com/en/services/ecommerce/city-hive) [City Hive is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. City Hive integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, City Hive helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/city-hive) [Preferences](https://www.flowconsent.com/en/services/ecommerce/city-hive) · ### [GloriaFood](https://www.flowconsent.com/en/services/ecommerce/gloriafood) [GloriaFood is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. GloriaFood provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, GloriaFood helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/ecommerce/gloriafood) [Preferences](https://www.flowconsent.com/en/services/ecommerce/gloriafood) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)