FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

Shopware

PreferencesOfficial website

Shopware is a leading German ecommerce platform with a community open source edition and a commercial Cloud and Enterprise tiers. Hosted in Frankfurt and Belgium for the Cloud, fully under German DPA oversight. Strictly necessary cookies plus consent for analytics and marketing extensions.

Block Shopware until consentScan my site
Overview

What does Shopware do?

What Shopware is

Shopware is a major German ecommerce platform with roots in the early 2000s. Shopware 6, released in 2019, is a modern API first PHP and Symfony based platform with a Vue.js admin and a Twig storefront. The product line includes Shopware 6 Community (open source, free, self hosted), Shopware 6 Professional and Enterprise (commercial, self hosted) and Shopware Commercial Cloud (managed PaaS). The Shopware Store offers more than 5,000 extensions covering payment, shipping, marketing, ERP integration and design.

Cookies set by Shopware

Strictly necessary: session- (session, basket and login), csrf_token (session, CSRF protection), sw-cache-hash (1 year, cache invalidation), sw-states (session, cookie banner state), shopware6CookieConsent (1 year, stores the consent choices made on the built in cookie banner). With Shopware native analytics (Shopware Analytics) activated: sw-tracking-* cookies for behavioural tracking. Store extensions add their own cookies depending on the integration (Mailchimp, Klaviyo, Google Analytics, Facebook Pixel, Trusted Shops).

GDPR, ePrivacy and the German context

The strictly necessary cookies are exempt under ePrivacy art. 5(3) and German TTDSG paragraph 25. The Shopware native cookie banner is preconfigured with the German TTDSG categories (technisch erforderlich, statistik, marketing) and provides a Granular Consent UI. The newsletter subscription requires a double opt in under the German UWG, which Shopware ships as the default behaviour. The customer account, the order history and the invoicing rely on contract and legal obligation bases. Shopware native analytics and any third party Store extension require consent.

EU residency and German oversight

Shopware Commercial Cloud runs on Google Cloud Frankfurt and Belgium by default. Self hosted installations run where the merchant deploys them, typically on a German or European host (Hetzner, IONOS, Mittwald, Plus.Line, Cloudways with EU region). shopware AG, headquartered in Schoppingen near Munster, is supervised by the North Rhine Westphalia DPA. The Boston US office handles a portion of customer success and engineering, with SCC 2021 in place for any incidental transfer.

Compliance setup

Pick the Cloud EU region or a German host for self hosted, sign the shopware AG Auftragsverarbeitungsvertrag, activate the Shopware cookie banner with the TTDSG categories, configure the double opt in newsletter under UWG, audit cookies after each Store extension install, document the chain in your record of processing under GDPR art. 30, and train support on the Shopware customer account DSAR self service flow.

Compliance

Shopware and the GDPR

Shopware is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
For checkout and order processing: performance of contract (GDPR art. 6(1)(b)) and legal obligation for invoicing (art. 6(1)(c)). For the strictly necessary session and basket cookies (session-, csrf_token, sw-cache-hash, sw-states): legitimate interest and the ePrivacy art. 5(3) exemption. For Shopware native analytics, marketing tracking extensions from the Shopware Store, the Customer Login double opt in newsletter and the personalisation extensions: consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3).
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, German TTDSG, BDSG, German UWG for direct marketing, CNIL ecommerce guidance, EDPB guidelines 2/2023, AEPD ecommerce guidelines

Impact assessment (DPIA)

A DPIA is generally not required for a Shopware 6 store with strictly necessary cookies only. A DPIA is recommended when the Shopware native analytics, the Customer Account product reviews, the Shopware Email Marketing or any third party extension from the Shopware Store (Mailchimp, Klaviyo, Google Analytics, Facebook Pixel, Trusted Shops, eKomi) is activated. The DPIA should document the EU hosting choice (Cloud) or the merchant infrastructure (self hosted), the retention of order history, the double opt in flow for the newsletter and the legal basis for each marketing flow.

Sample text for your banner

Our store runs on Shopware 6 by shopware AG (Germany). Strictly necessary cookies (session-, csrf_token, sw-cache-hash, sw-states) keep your basket and your session working without consent. With your consent we activate the Shopware native analytics, the marketing extensions from the Shopware Store, the personalisation features and the double opt in newsletter under the German UWG. Data is hosted in the European Union (Cloud) or on our own infrastructure (self hosted). You can accept, refuse or withdraw at any time.
Cookies and trackers

What Shopware sets and contacts

Tracking method
self_hosted_or_managed_ecommerce_platform_with_first_party_session_cookies_and_optional_marketing_extensions
Server location
Shopware is operated by shopware AG, a German company headquartered in Schoppingen near Munster. Shopware comes in three editions: Shopware 6 Community (self hosted open source), Shopware 6 Professional and Enterprise (self hosted commercial) and Shopware Commercial Cloud (PaaS). The Shopware Commercial Cloud runs on Google Cloud Platform regions europe-west3 (Frankfurt) and europe-west1 (Belgium). Self hosted installations run wherever the merchant deploys the PHP application and the MySQL or MariaDB database.
Cookieless mode available
Yes

Cookies set (6)

NameTypeDurationPurpose
session-First party (Shopware 6)SessionStores the shopping basket and the customer login session for the Shopware 6 storefront
csrf_tokenFirst party (Shopware 6)SessionCSRF protection token for the storefront and the customer account forms
sw-cache-hashFirst party (Shopware 6)1 yearStores the cache version hash used to invalidate cached pages when the catalogue or context changes
sw-statesFirst party (Shopware 6)SessionStores transient UI states such as the cookie banner display state
shopware6CookieConsentFirst party (Shopware 6 cookie banner)1 yearStores the visitor consent choices made on the Shopware native cookie banner per TTDSG categories
sw-tracking-*First party (Shopware Analytics, optional)PersistentSet when the Shopware native analytics module is activated; tracks behavioural data for merchant analytics

Third-party domains contacted (6)

  • shopware.com
  • shopware.store
  • shopware.de
  • sbp.shopware.com
  • account.shopware.com
  • store.shopware.com
Questions

Frequently asked questions about Shopware

Can't find your question? Write to us, we answer fast.

What cookies does Shopware set?

Strictly necessary: session- (session), csrf_token (session), sw-cache-hash (1 year), sw-states (session), shopware6CookieConsent (1 year, consent state). With Shopware Analytics: sw-tracking-* cookies. Store extensions add their own cookies depending on the integration (Mailchimp, Klaviyo, Google Analytics, Facebook Pixel, Trusted Shops).

Is consent required for Shopware?

Strictly necessary cookies do not need consent under ePrivacy art. 5(3) and German TTDSG paragraph 25. Consent is required for Shopware native analytics, the newsletter (double opt in under UWG) and any Store extension that loads tracking. The Shopware cookie banner handles the German TTDSG categories natively.

What is the legal basis for Shopware?

Contract (GDPR art. 6(1)(b)) and legal obligation (art. 6(1)(c)) for orders and invoices. Legitimate interest (art. 6(1)(f)) and ePrivacy art. 5(3) exemption for the session cookies. Consent (art. 6(1)(a)) for Analytics and marketing extensions. UWG explicit opt in for the newsletter.

Are data transferred outside the EU?

For the Cloud edition: no, data stays on Google Cloud Frankfurt and Belgium. For self hosted: only where the merchant deploys. Limited transfers to the shopware AG Boston office under SCC 2021. The platform is German with North Rhine Westphalia DPA oversight.

Do I need a DPIA for Shopware?

Usually no for a Shopware store with strictly necessary cookies only. Recommended when Shopware Analytics, Customer Account product reviews, Email Marketing or third party Store extensions are activated.

How do I implement Shopware compliantly?

Pick the Cloud EU region or a German host for self hosted, sign the shopware AG AVV, activate the Shopware cookie banner with TTDSG categories, configure double opt in newsletter under UWG, audit cookies after Store extension installs, document the chain in your record of processing.

What are the alternatives to Shopware?

Other EU ecommerce platforms: Shopify (Canada with EU sub processors), Adobe Commerce (Magento), Sylius (Poland), Saleor (Poland), CommerceTools (Germany), Spryker (Germany), Salesforce Commerce Cloud, BigCommerce (US), Centra (Sweden), PrestaShop (France). Shopware, Commercetools and Spryker are the most German centric.

How do I update my cookie policy after adding Shopware?

List shopware AG (Germany) as the data processor for Cloud edition (or just yourself for self hosted), declare the strictly necessary cookies and the consent based cookies separately, mention the German DPA jurisdiction, link to the Shopware Datenschutzerklärung and document the Store extensions used in your sub processor list.

Same category

More services: E-commerce

See the whole category

iPresta

iPresta is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. iPresta integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, iPresta helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Shopix

Shopix is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Shopix supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Shopix ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Lumise

Lumise is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Lumise enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Lumise empowers marketing teams to achieve measurable growth.

Preferences

Prima Software

Prima Software is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Prima Software integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Prima Software helps organizations maintain robust websites that meet user expectations and technical.

Preferences

GReminders

GReminders is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GReminders supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GReminders ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

AceShop

AceShop is a reliable shopping cart solution that enables e-commerce businesses to provide a seamless checkout experience for their customers. It supports multiple payment methods, coupon codes, tax calculations, and shipping options, ensuring a frictionless purchasing process. AceShop integrates with popular e-commerce platforms and payment gateways, offering customizable cart designs and abandoned cart recovery features to help merchants maximize revenue and reduce cart abandonment rates.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site