FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

OXID eShop

PreferencesOfficial website

OXID eShop is a German open-source e-commerce platform developed by OXID eSales AG (Freiburg). It powers thousands of B2C and B2B online stores in the DACH region and beyond. Because it is self-hosted, the merchant remains the data controller for all customer data and chooses the server location. OXID eShop sets functional cookies for the cart, the session, and (depending on configuration) marketing or analytics modules.

Block OXID eShop until consentScan my site
Overview

What does OXID eShop do?

What OXID eShop is

OXID eShop is an open-source e-commerce platform developed by OXID eSales AG, headquartered in Freiburg im Breisgau. Available in Community, Professional, and Enterprise editions, it powers a large share of mid-market online stores in Germany, Austria, and Switzerland. Because it is self-hosted, the merchant chooses the infrastructure, the modules, and the data flows. OXID eShop is built around a PHP/Smarty core and is highly extensible through modules and themes.

What data and cookies OXID eShop handles

The platform itself sets a small number of strictly necessary cookies: the session identifier (sid), a session checksum (sid_key), and the language and currency preferences. Optional cookies depend on the active modules: newsletter trackers, social pixels, recommendation engines, analytics scripts, payment gateway scripts, and reCAPTCHA. OXID eShop stores customer data (name, address, phone, email, order history, password hashes) in its own MySQL/MariaDB database, fully under the merchant control.

GDPR and TTDSG implications

For German merchants, both GDPR and TTDSG apply. TTDSG section 25 requires consent before any non-essential storage or access on the user device, including marketing pixels, analytics, and personalisation cookies. The strictly necessary cookies of OXID eShop (cart, session, language, security) are exempt under section 25(2)(2) TTDSG. The order data itself is processed under Art. 6(1)(b) for contract performance and Art. 6(1)(c) for compliance with tax and commercial law obligations.

International data transfers

OXID eShop itself does not transfer data to third countries. Transfers arise from the modules a merchant chooses to enable: PayPal, Stripe, Klarna, Mollie, Adyen for payment; Google Analytics, Matomo, etracker for analytics; Facebook Pixel, Google Ads, Microsoft Advertising for marketing. Each of these modules has its own GDPR profile. A typical EU-only setup uses EU-hosted payment providers, Matomo, and a privacy-friendly newsletter solution to keep all flows inside the EEA.

Practical compliance steps

Deploy a Consent Management Platform (CMP) compatible with the OXID eShop module ecosystem, list every module-generated cookie in the cookie policy, document the merchant DPAs with each module vendor, choose EU-hosted alternatives for analytics and email when possible, and apply data minimisation in the customer account (avoid collecting fields you do not strictly need). Provide a clear deletion workflow for customer accounts under Art. 17 GDPR.

Compliance

OXID eShop and the GDPR

OXID eShop is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Contract performance (Art. 6(1)(b) GDPR) for order processing, legitimate interest (Art. 6(1)(f)) for fraud prevention, consent (Art. 6(1)(a)) for marketing cookies and optional analytics
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive (Cookie Law), DSGVO, BDSG, TTDSG (Germany), DSA

Impact assessment (DPIA)

OXID eShop processes the full customer lifecycle: account creation, order, payment, delivery, and post-sale communication. Because it is self-hosted, the controller is the merchant. Key DPIA considerations: (1) order data including name, address, phone, email, and purchase history is processed under Art. 6(1)(b) for contract performance; (2) payment data is generally tokenised through gateway modules, but the choice of gateway determines US transfers; (3) recommendation and personalisation modules can amount to profiling under Art. 22 GDPR if they drive automated decisions; (4) marketing modules (newsletter, social pixels, retargeting) require consent and a cookie banner; (5) B2B installations may process limited employee personal data of customer staff. A DPIA is recommended for stores with personalisation, loyalty programmes, or scoring features.

Sample text for your banner

Our online store runs on OXID eShop. We use strictly necessary cookies to keep your cart, session, and language preference, and only set marketing or analytics cookies after you have given consent through the cookie banner. Your order and account data is processed to fulfil the purchase and to comply with our legal obligations (Art. 6(1)(b) and (c) GDPR). You can manage your consent at any time via the cookie settings.
Cookies and trackers

What OXID eShop sets and contacts

Tracking method
PHP-based e-commerce platform (server-side rendering), with optional JavaScript modules for checkout, search, and tracking integrations
Server location
Self-hosted (the OXID eShop core is open source; the merchant chooses the hosting location). The vendor OXID eSales AG is based in Freiburg, Germany.

Cookies set (6)

NameTypeDurationPurpose
sidStrictly necessary / SessionSession (end of browser session)Stores the unique session identifier used to maintain the shopping cart, the customer login state, and the multi-step checkout context.
sid_keyStrictly necessary / SecuritySessionCryptographic checksum used to validate the session ID against tampering and CSRF, ensuring that the session cookie has not been forged.
languageStrictly necessary / Preference1 yearStores the visitor language preference so the shop displays the correct localised content on the next visit.
currencyStrictly necessary / Preference1 yearStores the visitor currency preference for product prices and checkout totals.
oxid_basketStrictly necessary / CartUp to 30 daysPersists the basket content for guest visitors between sessions so they can continue shopping without losing their selection.
oxid_admin_*Strictly necessary / AdminSessionInternal cookies set in the OXID administration backend for authenticated staff users. Not set on the public storefront.

Third-party domains contacted (4)

  • oxid-esales.com
  • www.oxid-esales.com
  • docs.oxid-esales.com
  • github.com/OXID-eSales
Questions

Frequently asked questions about OXID eShop

Can't find your question? Write to us, we answer fast.

What cookies does OXID eShop set?

OXID eShop sets a small set of strictly necessary cookies: sid (session identifier), sid_key (session checksum), language, currency, and a basket persistence cookie. These are required for the shop to function and are exempt under the ePrivacy cart and session use cases. Additional cookies come from modules (marketing, analytics, payment, captcha) and require consent.

Does OXID eShop require user consent?

For the strictly necessary cookies, no consent is required. For any marketing, analytics, personalisation, or social media module activated on the store, consent is required under TTDSG section 25 (Germany) and Art. 5(3) ePrivacy. A Consent Management Platform (CMP) integrated with OXID eShop should gate those modules.

What is the legal basis for processing order data?

Order processing relies on Art. 6(1)(b) GDPR (contract performance) for the purchase itself, and Art. 6(1)(c) for legal obligations (invoicing, tax retention up to 10 years under German HGB section 257). Marketing communications require either Art. 6(1)(a) consent or the strict customer-relationship exception of UWG section 7(3).

Does OXID eShop transfer data to the United States?

Not by itself. The platform is self-hosted, typically on EU infrastructure for German merchants. Transfers arise only from third-party modules (US payment gateways, US analytics, US marketing pixels). Choose EU-hosted modules or document SCCs for each US module.

Do I need a DPIA for an OXID eShop?

A DPIA is recommended for stores with personalisation, recommendation engines, loyalty scoring, or marketplaces that handle large volumes of personal data. A basic B2C store with a small product catalogue and EU-hosted modules can usually rely on a documented Records of Processing Activities (RoPA) without a full DPIA.

How do I implement OXID eShop compliantly?

Host the store in the EU, deploy a TTDSG-compliant CMP, audit every activated module for its data flows, prefer EU payment gateways (Mollie, Stripe with EU residency, Klarna), use Matomo or etracker for analytics, sign DPAs with each processor, keep a deletion workflow for customer accounts, and document everything in your RoPA.

What are the alternatives to OXID eShop?

Other EU-friendly self-hosted e-commerce platforms include Shopware (Germany), Shopgate Cloud, Spryker (Germany), Sylius (open source, France), Magento Open Source/Adobe Commerce, PrestaShop (France), and headless options like Saleor, Medusa, or Vendure.

How do I update the cookie policy for OXID eShop?

List the core OXID cookies (sid, sid_key, language, currency, basket) in a strictly-necessary section. Then list each module-generated cookie with its name, purpose, duration, and category. Map each non-essential category to a CMP toggle so visitors can grant or refuse it. Revisit the list whenever a new module is activated.

Same category

More services: E-commerce

See the whole category

Upscribe

Upscribe is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Upscribe enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Upscribe empowers marketing teams to achieve measurable growth.

Analytics

Droplabs

Droplabs is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Droplabs enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Droplabs empowers marketing teams to achieve measurable growth.

Preferences

Piano

Piano is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Piano provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Piano helps deliver the right message to the right audience at the right time.

Preferences

Akıllı Ticaret

Akilli Ticaret is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Akilli Ticaret supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Akilli Ticaret ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

TheFork

Thefork is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Thefork provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Thefork helps deliver the right message to the right audience at the right time.

Preferences

MindBody

MindBody is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. MindBody supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, MindBody ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site