YM Cart

What is YM Cart

YM Cart is a hosted shopping cart and checkout solution popular in Japan, often embedded as a JavaScript widget into product and category pages of existing storefronts. It handles cart state, coupon and tax logic, shipping rate calculation, and order completion through a connected payment gateway. European merchants typically encounter YM Cart when partnering with Japanese suppliers, expanding into Japan, or running a Japan-specific microsite.

Cookies and data collected

YM Cart sets cart_id (cart contents identifier), ym_session (session ID), ym_user (anonymous returning visitor), and optionally ym_conv (conversion tag) and ym_abandon (cart abandonment marker). It collects the shopper's name, address, email, phone, and payment metadata at checkout, and stores order history server-side against the user identifier. The widget can integrate with Google Analytics, Yahoo Tag Manager, and Japanese ad networks; those integrations introduce additional cookies and require separate consent.

GDPR and ePrivacy implications

Cart and session cookies fall under the strictly necessary exemption of Art. 5(3) ePrivacy and do not require consent. Cart abandonment cookies, persistent identifiers, and conversion tags do require prior consent. YM Cart is a data processor for order data and may be an independent controller for aggregate platform analytics. Under the EU-Japan Mutual Adequacy Decision, transfers to Japan are recognised as adequate; you still need a written processing agreement and transparent documentation in your privacy notice.

Data transfer to Japan and adequacy

On 23 January 2019, the European Commission adopted Decision 2019/419 recognising Japan's level of data protection as essentially equivalent to the EU, under the Supplementary Rules adopted by the PPC (Personal Information Protection Commission). This means transfers to Japanese recipients certified or otherwise covered by the adequacy decision do not require SCCs or BCRs. However, you must verify that YM Cart's operator falls within the scope of the decision, document the transfer in your Record of Processing Activities, and inform data subjects in your privacy notice.

Consent management

Categorise YM Cart cookies in your CMP: cart_id and ym_session as strictly necessary, ym_user and ym_abandon as functional or marketing depending on use, and any conversion tags as marketing. Make sure cart abandonment emails are gated behind explicit marketing consent and include a clear unsubscribe link.

Practical compliance steps

1. Sign a Data Processing Agreement with the YM Cart operator. 2. Confirm that the operator is within scope of the EU-Japan adequacy decision. 3. Map YM Cart cookies into your CMP categories. 4. Disable cart abandonment workflows for visitors who did not consent. 5. Add YM Cart and Japan to your privacy notice transfer disclosure. 6. Document the cross-border transfer (even if adequacy applies) in your Record of Processing Activities.