> WooCommerce and GDPR: the strictly necessary cookies it sets, the legal basis for orders, hosting, plugin risks and what to add to your privacy policy. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/woocommerce E-commerce # WooCommerce Preferences WooCommerce is the most widely deployed e-commerce platform in Europe, an open-source plugin for WordPress published by Automattic. It is fully self-hosted, so all customer and order data stays on the merchant infrastructure. WooCommerce sets only strictly necessary first-party cookies for cart and checkout flow; analytics, marketing and most third-party integrations are opt-in via additional plugins. [Block WooCommerce until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Not required - Documented cookies 4 - Third-party domains 3 - Servers depends on the WordPress hosting provider chosen by the merchant Overview ## What does WooCommerce do? ## **What is WooCommerce?** WooCommerce is an open source e-commerce plugin for WordPress launched in 2011 and now developed by Automattic. It powers an estimated 30 percent of online stores worldwide and is the dominant platform for European SMEs that already run WordPress. Because WooCommerce is a self hosted plugin rather than a SaaS, the merchant remains in full control of where the data lives and which third party integrations are loaded. ## **Cookies and data collected** By default WooCommerce sets a small set of strictly necessary first party cookies: woocommerce\_cart\_hash, woocommerce\_items\_in\_cart, wp\_woocommerce\_session\_\*. These cookies persist the cart, the customer session and the checkout flow. Customer accounts, orders and addresses are stored in the WordPress database. The optional WooCommerce Analytics module reads order data already in the database without sending it externally. Marketing emails, abandoned cart recovery and external analytics require dedicated plugins that the merchant chooses. ## **GDPR and ePrivacy implications** The strictly necessary cookies are exempt from consent under Art. 5(3) ePrivacy. Customer accounts and orders rely on contract performance (Art. 6(1)(b) GDPR). Marketing communications, abandoned cart automation, profiling and any third party tracker added through plugins (Google Analytics, Meta Pixel, TikTok Pixel, etc.) require freely given consent (Art. 6(1)(a)). ## **Data transfers and hosting** WooCommerce does not transfer data anywhere by itself. The actual transfer surface depends on the hosting provider, the CDN, the email service, the payment processor and any analytics or marketing plugin. To stay inside the EEA, choose an EU host (e.g. Hetzner, OVHcloud, Infomaniak, Scaleway), favour EU based plugins and document the residency of every external integration. ## **Practical compliance steps** Install a consent platform (Complianz, CookieYes, OneTrust) that blocks marketing and analytics scripts before opt-in. Use the WooCommerce privacy settings to configure data retention and the predefined privacy notice template. Sign DPAs with your host, payment processor and any plugin vendor that processes personal data. Audit installed plugins regularly. Provide a documented process for data subject requests using the built-in WordPress export and erase tools. Compliance ## WooCommerce and the GDPR - Legal basis Strictly necessary cookies (cart, session, checkout flow) rely on Art. 5(3) ePrivacy Directive exemption. Customer account data and order processing rely on contract performance (Art. 6(1)(b) GDPR). Marketing emails, abandoned cart recovery and analytics extensions require consent (Art. 6(1)(a)). - Risk level low - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, national consumer protection laws (e.g. French Code de la consommation, German UWG/BGB) ### Impact assessment (DPIA) A DPIA is generally not required for standard WooCommerce stores. It becomes relevant when the store processes special category data, very large customer volumes, or extensive behavioural profiling through analytics and marketing plugins. ### Sample text for your banner > This online store runs on WooCommerce. Cart and checkout cookies are strictly necessary. Analytics, advertising and marketing scripts are loaded only after you give consent in our cookie banner. Cookies and trackers ## What WooCommerce sets and contacts - Tracking method self hosted WordPress plugin written in PHP; first party session and cart cookies for the storefront and checkout, optional WooCommerce Analytics module - Server location depends on the WordPress hosting provider chosen by the merchant ### Cookies set (4) | Name | Type | Duration | Purpose | | ----------------------------- | ------------ | -------- | -------------------------------------------------------------------------------------------------------------------------------- | | woocommerce\_cart\_hash | first\_party | Session | Strictly necessary cookie that stores a hash of the cart contents so the storefront can quickly detect when the cart changes. | | woocommerce\_items\_in\_cart | first\_party | Session | Strictly necessary cookie that stores the number of items in the cart, used to update the mini cart and checkout summary. | | wp\_woocommerce\_session\_\* | first\_party | 48 hours | Strictly necessary cookie that stores a unique customer session identifier so cart and checkout data persist between page loads. | | woocommerce\_recently\_viewed | first\_party | Session | Optional cookie that stores recently viewed products to power related-product widgets in some themes. | ### Third-party domains contacted (3) - `woocommerce.com` - `woo.com` - `api.woocommerce.com` Questions ## Frequently asked questions about WooCommerce Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does WooCommerce set? By default WooCommerce sets only strictly necessary first party cookies: woocommerce\_cart\_hash and woocommerce\_items\_in\_cart (session, store the cart state) and wp\_woocommerce\_session\_\* (48 hours, persist the customer session). woocommerce\_recently\_viewed is sometimes set by themes. Customer accounts and orders are stored in the WordPress database, not in cookies. Any analytics, marketing or social cookies come from extra plugins, not from WooCommerce itself. ### Do I need consent to use WooCommerce on my website? No banner is required for the WooCommerce cart and checkout cookies because they are strictly necessary under Art. 5(3) ePrivacy. You do need consent for any third party tracker added by a plugin (Google Analytics, Meta Pixel, TikTok Pixel, abandoned cart automation, customer reviews widgets, social plugins, etc.). Configure your CMP to block those scripts before opt-in. ### What is the legal basis for processing personal data through WooCommerce? Order processing, account creation and shipment fulfilment rely on contract performance (Art. 6(1)(b) GDPR). Tax and accounting retention rely on legal obligation (Art. 6(1)(c)). Marketing emails, newsletter subscriptions, abandoned cart recovery and any analytics or advertising integration require consent (Art. 6(1)(a)). Strictly necessary cookies rely on Art. 5(3) ePrivacy. ### Does WooCommerce transfer data to third countries? WooCommerce itself does not transfer data anywhere. Whether your store transfers customer data outside the EEA depends on the hosting provider, the CDN, the email service, the payment processor and any third party plugin you install. Document the location of every external service in your records of processing. ### Do I need a DPIA for WooCommerce? A standalone WooCommerce store with standard products typically does not require a DPIA. A DPIA is recommended when you process special category data (health, biometric, political opinions), very large customer volumes or extensive behavioural profiling through marketing and analytics plugins. ### How do I implement WooCommerce compliantly? Pick an EU host. Install a CMP that blocks marketing and analytics scripts before opt-in. Use the WooCommerce privacy settings to configure data retention and the predefined privacy notice template. Sign DPAs with your host, payment processor and every plugin vendor. Audit installed plugins quarterly. Use the built-in WordPress export and erase tools to handle data subject requests. ### Are there privacy-friendly alternatives to WooCommerce? EU-based open source alternatives include PrestaShop (France), Sylius (France) and Shopware (Germany). Hosted EU SaaS options include Lightspeed eCom (Belgium) and Wix Stores (Israel based but with EU hosting). The privacy result depends mostly on the hosting and integrations selected. ### How should I update my cookie policy for WooCommerce? List the strictly necessary WooCommerce cookies (woocommerce\_cart\_hash, woocommerce\_items\_in\_cart, wp\_woocommerce\_session\_\*, woocommerce\_recently\_viewed) with name, purpose, duration and category. Add every cookie introduced by your theme, payment, shipping, analytics and marketing plugins. Document the consent mechanism and the third party processors involved. Related guide ## Our guides on WooCommerce [19 June 2026](https://www.flowconsent.com/en/blog/woocommerce-gdpr-compliance-guide) ### [WooCommerce and GDPR: the complete compliance guide](https://www.flowconsent.com/en/blog/woocommerce-gdpr-compliance-guide) [WooCommerce sets functional cookies and third-party tracking scripts subject to GDPR. This guide explains which cookies require consent and how to make your store compliant.](https://www.flowconsent.com/en/blog/woocommerce-gdpr-compliance-guide) [Read the guide](https://www.flowconsent.com/en/blog/woocommerce-gdpr-compliance-guide) Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Aryeo](https://www.flowconsent.com/en/services/ecommerce/aryeo) [Aryeo is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Aryeo integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Aryeo helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/aryeo) [Preferences](https://www.flowconsent.com/en/services/ecommerce/aryeo) · ### [AlumnIQ](https://www.flowconsent.com/en/services/ecommerce/alumniq) [AlumnIQ is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. AlumnIQ supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, AlumnIQ ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/alumniq) [Preferences](https://www.flowconsent.com/en/services/ecommerce/alumniq) · ### [Yodel](https://www.flowconsent.com/en/services/ecommerce/yodel) [Yodel is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Yodel integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Yodel helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/yodel) [Preferences](https://www.flowconsent.com/en/services/ecommerce/yodel) · ### [Tashi](https://www.flowconsent.com/en/services/ecommerce/tashi) [Tashi is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Tashi enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Tashi empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/ecommerce/tashi) [Preferences](https://www.flowconsent.com/en/services/ecommerce/tashi) · ### [Visenze](https://www.flowconsent.com/en/services/ecommerce/visenze) [Visenze is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Visenze integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Visenze helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/visenze) [Preferences](https://www.flowconsent.com/en/services/ecommerce/visenze) · ### [Salesfloor](https://www.flowconsent.com/en/services/ecommerce/salesfloor) [Salesfloor is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Salesfloor integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Salesfloor helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/salesfloor) [Preferences](https://www.flowconsent.com/en/services/ecommerce/salesfloor) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)