FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

Volusion

PreferencesOfficial website

Volusion is a US based hosted ecommerce platform from Austin, Texas. Storefronts set strictly necessary cart and session cookies. All shop data is stored in the United States, so European merchants must disclose the EU US transfer and gate any optional analytics or advertising cookie behind consent.

Block Volusion until consentScan my site
Overview

What does Volusion do?

What Volusion is and how it serves a shop

Volusion is a hosted ecommerce platform founded in 1999 by Volusion LLC, headquartered in Austin, Texas. It targets small and mid sized merchants who want an all in one shop solution with templates, catalog, checkout and reporting. Storefronts run on a customer subdomain (mystore.volusion.com) or a custom domain. The admin backoffice manages products, orders and marketing campaigns.

Cookies and identifiers set on visitors

Volusion sets ASP.NET_SessionId, VolusionShopperCart and OrderNumber cookies that are strictly necessary for the cart and checkout. The admin uses its own authentication cookies on the merchant backoffice. Volusion Insights, if enabled by the merchant, can add analytics cookies. Third party integrations (Google Analytics, Meta Pixel, Klaviyo, Mailchimp) installed by the merchant introduce their own cookies and require consent.

GDPR and ePrivacy implications

Strictly necessary cart and session cookies fall under the Article 5(3) ePrivacy carveout. Article 6(1)(b) GDPR (performance of a contract) covers the order processing flow. Any optional analytics or advertising tag requires prior opt in consent under Article 5(3) ePrivacy. The merchant is the controller, Volusion LLC is the processor under Article 28 GDPR with a DPA available on request.

Data transfers and Schrems II

All Volusion shop data is hosted on AWS in the United States. There is no European data center option. The Standard Contractual Clauses and the EU US Data Privacy Framework cover the transfer. European merchants must include this in the privacy notice. The Akamai CDN delivers assets globally from edges, which is acceptable since cached HTML and images do not carry personal data. Email and customer service tooling are also US based.

Practical compliance steps

Add a consent banner script in the Volusion theme that blocks third party trackers until opt in. Include the US transfer disclosure in your privacy notice. Request and sign the Volusion DPA. Document the processor in your record of processing activities with the AWS US region, the order retention period and the list of installed integrations. Set up a procedure to honor DSAR requests from shoppers via the Volusion admin or email.

Compliance

Volusion and the GDPR

Volusion is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Article 6(1)(b) GDPR (performance of a contract) for order processing. Article 6(1)(f) (legitimate interest) for the strictly necessary cart and session cookies. Article 6(1)(a) (consent) for any analytics or advertising tag activated by the merchant.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, DSGVO, RGPD, LSSI, Schrems II, EU US Data Privacy Framework, California CCPA when shoppers reside in California

Impact assessment (DPIA)

A DPIA is recommended for European Volusion shops because the platform stores all order and customer data in the United States. Document the legal basis for the transfer, the retention period, the consent management strategy for analytics and advertising tags, and the procedure for data subject access and erasure requests.

Sample text for your banner

This shop runs on Volusion. Volusion sets a session and cart cookie that are strictly necessary for the checkout to work. Your shop data is stored on Volusion servers in the United States. Optional analytics and advertising cookies are activated only after you accept them in the consent banner.
Cookies and trackers

What Volusion sets and contacts

Tracking method
Hosted ecommerce platform for small and mid sized merchants. Storefronts run on volusion.com subdomains or custom domains. The platform sets first party session, cart and CSRF cookies (ASP.NET_SessionId, VolusionShopperCart, OrderNumber) on visitors. Merchant facing analytics may include Volusion Insights and integrations like Google Analytics or Meta Pixel installed by the merchant.
Server location
Volusion LLC (Austin, Texas, United States). Hosting on Amazon Web Services in US regions, with CDN delivery via Akamai. Volusion has no EU data center option.
Data transferred outside the EU
Volusion is hosted entirely in the United States and all shop data including customer accounts, order history and analytics is stored there. The transfer is covered by Standard Contractual Clauses and the EU US Data Privacy Framework. European merchants must explicitly disclose this in the privacy notice and obtain consent for any non strictly necessary cookie.

Cookies set (4)

NameTypeDurationPurpose
ASP.NET_SessionIdfirst-partySessionASP.NET session identifier used by the Volusion storefront to maintain shopper context across pages. Strictly necessary.
VolusionShopperCartfirst-partyUp to 30 daysCart identifier used to persist the basket between visits. Strictly necessary for ecommerce.
OrderNumberfirst-partySessionStores the in progress order identifier during the checkout. Strictly necessary.
VOLUSION-ADMINfirst-party (admin only)SessionAuthentication cookie for the Volusion merchant backoffice. Strictly necessary, never set on the public storefront.

Third-party domains contacted (4)

  • volusion.com
  • mivamerchant.net
  • static.volusion.com
  • cdn.volusion.com
Questions

Frequently asked questions about Volusion

Can't find your question? Write to us, we answer fast.

Does Volusion set cookies on shop visitors?

Yes. Volusion sets ASP.NET_SessionId, VolusionShopperCart and OrderNumber cookies that are strictly necessary for the cart and checkout. Optional analytics and advertising cookies only appear if the merchant installs the corresponding integration (Google Analytics, Meta Pixel, Klaviyo).

Do I need consent for Volusion under GDPR and ePrivacy?

No consent is required for the strictly necessary cart and session cookies. Prior opt in consent is required for any analytics or advertising tag activated by the merchant.

What is the legal basis for processing data with Volusion?

Article 6(1)(b) GDPR (performance of a contract) for order processing, Article 6(1)(f) (legitimate interest) for strictly necessary cookies, Article 6(1)(a) (consent) for any optional tracking tag. The merchant is the controller, Volusion LLC is the processor.

Does Volusion transfer data to the United States?

Yes. Volusion hosts all shop data on AWS in the United States and has no EU data center option. The transfer is covered by Standard Contractual Clauses and the EU US Data Privacy Framework. European merchants must disclose this in the privacy notice.

Is a DPIA required for Volusion?

A DPIA is recommended for European Volusion shops because all customer data is transferred to the United States. Document the transfer legal basis, the retention period and the consent management strategy.

How do I implement Volusion compliantly?

Add a consent banner script to the Volusion theme that gates analytics and advertising tags, include the US transfer in the privacy notice, sign the Volusion DPA, document the processor in your RoPA, and set up a DSAR procedure for shoppers.

What are the alternatives to Volusion?

Other hosted ecommerce platforms include Shopify, BigCommerce, Wix Stores, Squarespace Commerce, Lightspeed eCom, Ecwid and self hosted options like WooCommerce, PrestaShop (France) and Shopware (Germany).

How do I update the cookie policy for Volusion?

List the strictly necessary Volusion cookies (ASP.NET_SessionId, VolusionShopperCart, OrderNumber) in your cookie disclosure with purpose and duration. Add an entry for each third party integration with retention and EU US transfer information.

Same category

More services: E-commerce

See the whole category

Forte

Forte is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Forte supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Forte ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

FieldStack Omni

FieldStack Omni is a comprehensive e-commerce platform that provides businesses with all the tools needed to build, manage, and grow an online store. From product catalog management and secure payment processing to inventory tracking and order fulfillment, FieldStack Omni delivers a complete commerce solution. It features responsive storefront themes, SEO-optimized product pages, and powerful marketing tools to help merchants increase visibility and drive sales across channels.

Preferences

Maxxton

Maxxton is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Maxxton enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Maxxton empowers marketing teams to achieve measurable growth.

Preferences

Seko OmniReturns

Seko OmniReturns is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Seko OmniReturns supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Seko OmniReturns ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

E-commerce

Ocuco FitMix

Ocuco FitMix is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Ocuco FitMix provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Ocuco FitMix helps deliver the right message to the right audience at the right time.

Preferences

Droplabs

Droplabs is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Droplabs enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Droplabs empowers marketing teams to achieve measurable growth.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site