Snipcart
Snipcart is a Canadian drop in shopping cart for any website, operated by Snipcart Inc. in Quebec City (acquired by Duda in 2021). The script loaded from cdn.snipcart.com lets developers turn any static or CMS based site into an e commerce store with a cart drawer and a hosted checkout. Snipcart sets non strictly necessary cookies on the seller's page and processes orders on AWS Canada and Frankfurt. The Canadian adequacy decision keeps the GDPR risk low.
What does Snipcart do?
What is Snipcart?
Snipcart is a drop in HTML/JavaScript shopping cart developed by Snipcart Inc. in Quebec City, Canada, and now part of the Duda website builder group. Developers add a script tag from cdn.snipcart.com to any static site, Jamstack project, Hugo, Eleventy or CMS based site and define products with HTML data attributes. Snipcart injects a cart drawer and a checkout iframe that handles the full purchase flow, with payment routed through Stripe, Square, Authorize.Net or Mollie.
Cookies and data collected
Once the Snipcart script loads, the cart drawer writes first party Snipcart cookies on the seller's domain (snipcart_session, snipcart_locale, snipcart_cart) to keep the in progress cart and remember language and currency. The checkout iframe served from app.snipcart.com sets additional session and CSRF cookies. Stripe and other payment processors add their own cookies during the payment step. Snipcart's dashboard uses Google Analytics 4 and Sentry.
GDPR and ePrivacy implications
Until the visitor opens the cart, Snipcart cookies are not strictly necessary, so Art. 5(3) ePrivacy requires prior consent in the EU. A pragmatic option is to defer the Snipcart script to a consent gated tag manager, or to use Snipcart's cookieless mode which only writes cookies after Add to cart. Once the customer initiates the checkout, the strictly necessary cookies are exempt and the processing relies on contract performance.
International data transfers
Snipcart processes EU customer data on AWS Canada Central and AWS Frankfurt. Canada has an adequacy decision under Art. 45 GDPR for commercial entities subject to PIPEDA, so the transfer is treated like an intra EEA flow. The Snipcart DPA also incorporates the EU SCCs as a fallback. Payment processors apply their own transfer mechanisms.
Practical compliance steps
Sign the Snipcart DPA, gate the script behind a CMP toggle or use the cookieless Add to cart mode, list Snipcart and the payment processors in your privacy notice and Article 30 record, document the Canadian adequacy and the onward transfers and update your terms so refunds, taxes and disputes are handled by the seller (Snipcart is not the merchant of record).
Snipcart and the GDPR
Snipcart is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the Snipcart cart cookies set on the seller's own page, because they are not strictly necessary until the visitor opens the cart. Contract performance (Art. 6(1)(b)) for processing the order once the customer initiates checkout. Legal obligation (Art. 6(1)(c)) for tax record keeping on the seller side, since Snipcart is a processor and not a merchant of record.
- Risk level
- low
- Applicable regulations
- GDPR, UK GDPR, ePrivacy Directive 2002/58/EC, Canadian PIPEDA, EU VAT, PSD2, PCI DSS, US CCPA/CPRA
Impact assessment (DPIA)
A DPIA is not normally required for a small shop using Snipcart. It can become relevant for stores combining Snipcart with extensive customer profiling, AI driven recommendation and special category data tied to the customer base.
Sample text for your banner
Sales on this site are powered by Snipcart (Snipcart Inc., Canada), a drop in shopping cart provider. Snipcart sets functional cookies, opens an iframe to its hosted checkout and processes orders on AWS Canada and Frankfurt. Canada benefits from an EU adequacy decision and payment processors handle the card data under their own SCCs and DPF.
What Snipcart sets and contacts
- Tracking method
- Drop in HTML/JavaScript shopping cart for any website: the Snipcart script loaded from cdn.snipcart.com injects a cart drawer that the seller controls with HTML data attributes; opens an iframe to the Snipcart checkout that sets first party Snipcart session, cart and CSRF cookies; payments are routed through Stripe, Square, Authorize.Net or Mollie
- Server location
- Canada (Snipcart Inc., Quebec City, owned by Duda since 2021); production hosted on AWS Canada Central (ca central 1) and AWS Frankfurt (eu central 1) for European traffic; static assets served from Cloudflare with EU edge presence
- Data transferred outside the EU
- Snipcart Inc. is established in Canada. Canada benefits from a European Commission adequacy decision for commercial entities subject to PIPEDA, so transfers from the EEA to Snipcart are treated similarly to intra EEA flows. EU customer carts and checkout sessions are typically processed on AWS Frankfurt (eu central 1). The Snipcart DPA incorporates the EU Standard Contractual Clauses as a fallback and the UK International Data Transfer Addendum. Payment processors (Stripe, Mollie, Square) apply their own transfer mechanisms.
Cookies set (5)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| snipcart_session | first_party | Session | Snipcart session cookie set on the seller domain to keep the in progress cart for the visitor. |
| snipcart_locale | first_party | 1 year | Functional cookie used by Snipcart to remember the visitor's language and currency preference between visits. |
| snipcart_cart | first_party | 30 days | Persistent cart cookie used by Snipcart to recover the visitor's cart contents across sessions. |
| asp_session | third_party | Session | Snipcart session cookie on the app.snipcart.com checkout iframe to keep the in progress order. |
| asp_csrf | third_party | Session | CSRF protection token for the Snipcart hosted checkout iframe. |
Third-party domains contacted (4)
snipcart.comcdn.snipcart.comapp.snipcart.comjs.stripe.com
Frequently asked questions about Snipcart
Can't find your question? Write to us, we answer fast.
What cookies does Snipcart set?
Once the Snipcart script loads, it writes first party Snipcart cookies on the seller domain (snipcart_session, snipcart_locale, snipcart_cart) and on the app.snipcart.com checkout iframe (session and CSRF cookies). Stripe and other payment processors add their own cookies during the payment step.
Do I need consent to use Snipcart?
Yes for the cart cookies set as soon as the script loads. Art. 5(3) ePrivacy requires prior consent in the EU. Use a CMP toggle or Snipcart's cookieless Add to cart mode. Once the visitor initiates the checkout, the cookies become strictly necessary and are exempt.
What is the legal basis for using Snipcart?
Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the cart cookies on the seller domain. Contract performance (Art. 6(1)(b)) for the checkout. Legal obligation (Art. 6(1)(c)) for the seller's tax record keeping (Snipcart is a processor, not the merchant of record).
Does Snipcart transfer data to third countries?
Primarily no. Snipcart Inc. is established in Canada, which has an EU adequacy decision for PIPEDA. EU customer data is processed on AWS Canada Central and AWS Frankfurt. Onward transfers occur to Stripe and similar processors under their own SCCs and DPF.
Do I need a DPIA for Snipcart?
Not for a small shop. A DPIA may be appropriate if Snipcart is combined with extensive customer profiling, AI recommendations and special category data tied to the customer base.
How do I implement Snipcart compliantly?
Sign the Snipcart DPA, gate the script behind a CMP or use the cookieless mode, list Snipcart and the payment processors in your privacy notice and Article 30 record, document the Canadian adequacy and the onward transfers, and update your terms so refunds and disputes are handled by you (Snipcart is not the merchant of record).
Are there alternatives to Snipcart?
Drop in cart alternatives include Foxy.io (US with EU friendly setup), Ecwid (US with EU servers), Shopify Lite (US with EU AWS), Sellfy (Latvia), Mollie Tip Jar / Mollie Checkout (Netherlands) and self managed Stripe Checkout. For Jamstack stacks, you can also wire a custom cart on top of Stripe Payment Links.
How should I update my cookie and privacy policy for Snipcart?
List the Snipcart cookies in your cookie policy with their categories and durations. In your privacy notice describe Snipcart as your cart processor, the Canadian adequacy, the EU hosting on AWS Frankfurt and the onward transfers to Stripe and similar processors.
GoodEshop
GoodEshop is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GoodEshop supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GoodEshop ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
ShopKeeper Tools
ShopKeeper Tools is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ShopKeeper Tools integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ShopKeeper Tools helps organizations maintain robust websites that meet user expectations and.
Shopmaker
Shopmaker is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Shopmaker supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Shopmaker ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
iPresta
iPresta is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. iPresta integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, iPresta helps organizations maintain robust websites that meet user expectations and technical requirements.
Omise
Omise is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Omise supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Omise ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Marcando
Marcando is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Marcando supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Marcando ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.