> YM Cart and the GDPR: what the cart widget stores, which cookies and order data it may handle, and how to deploy it with valid consent. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/ym-cart E-commerce # YM Cart Preferences · [Official website](https://ymcart.com) YM Cart is a Japanese shopping cart and e-commerce checkout solution embedded in product and category pages via a JavaScript widget. It manages cart state, coupon codes, tax and shipping calculation, and connects to multiple payment gateways. For European merchants serving Japanese tourists or expanding to APAC, YM Cart can simplify Japan-specific payment methods (convenience store, Pay-easy, JCB) but raises GDPR questions around cross-border transfers, cookies for cart persistence, and integration with Japanese analytics tools. [Block YM Cart until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 5 - Third-party domains 4 - Servers Japan (primary operator YM Square Inc.) with possible CDN edges in Asia and Europe Overview ## What does YM Cart do? ## **What is YM Cart** YM Cart is a hosted shopping cart and checkout solution popular in Japan, often embedded as a JavaScript widget into product and category pages of existing storefronts. It handles cart state, coupon and tax logic, shipping rate calculation, and order completion through a connected payment gateway. European merchants typically encounter YM Cart when partnering with Japanese suppliers, expanding into Japan, or running a Japan-specific microsite. ## **Cookies and data collected** YM Cart sets cart\_id (cart contents identifier), ym\_session (session ID), ym\_user (anonymous returning visitor), and optionally ym\_conv (conversion tag) and ym\_abandon (cart abandonment marker). It collects the shopper's name, address, email, phone, and payment metadata at checkout, and stores order history server-side against the user identifier. The widget can integrate with Google Analytics, Yahoo Tag Manager, and Japanese ad networks; those integrations introduce additional cookies and require separate consent. ## **GDPR and ePrivacy implications** Cart and session cookies fall under the strictly necessary exemption of Art. 5(3) ePrivacy and do not require consent. Cart abandonment cookies, persistent identifiers, and conversion tags do require prior consent. YM Cart is a data processor for order data and may be an independent controller for aggregate platform analytics. Under the EU-Japan Mutual Adequacy Decision, transfers to Japan are recognised as adequate; you still need a written processing agreement and transparent documentation in your privacy notice. ## **Data transfer to Japan and adequacy** On 23 January 2019, the European Commission adopted Decision 2019/419 recognising Japan's level of data protection as essentially equivalent to the EU, under the Supplementary Rules adopted by the PPC (Personal Information Protection Commission). This means transfers to Japanese recipients certified or otherwise covered by the adequacy decision do not require SCCs or BCRs. However, you must verify that YM Cart's operator falls within the scope of the decision, document the transfer in your Record of Processing Activities, and inform data subjects in your privacy notice. ## **Consent management** Categorise YM Cart cookies in your CMP: cart\_id and ym\_session as strictly necessary, ym\_user and ym\_abandon as functional or marketing depending on use, and any conversion tags as marketing. Make sure cart abandonment emails are gated behind explicit marketing consent and include a clear unsubscribe link. ## **Practical compliance steps** 1\. Sign a Data Processing Agreement with the YM Cart operator. 2. Confirm that the operator is within scope of the EU-Japan adequacy decision. 3. Map YM Cart cookies into your CMP categories. 4. Disable cart abandonment workflows for visitors who did not consent. 5. Add YM Cart and Japan to your privacy notice transfer disclosure. 6. Document the cross-border transfer (even if adequacy applies) in your Record of Processing Activities. Compliance ## YM Cart and the GDPR YM Cart is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract performance (Art. 6(1)(b) GDPR) for checkout; Consent (Art. 6(1)(a) GDPR) for analytics and persistent cart cookies that survive beyond the order completion - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, Japan APPI, ePrivacy Regulation (proposed) ### Impact assessment (DPIA) YM Cart processes order data (name, address, email, phone, payment metadata) and behavioural cookies (cart\_id, ym\_session, conversion tag). For European deployments, the principal risks are: (1) data transfer to Japan, which benefits from an EU adequacy decision but must still be documented; (2) integration with third-party Japanese payment gateways that may have their own data flows; (3) persistent cart cookies that may track abandoned carts and trigger reminder emails, requiring marketing consent; (4) potential collection of children's data when used on toy or game stores, requiring an age gate; (5) limited transparency about sub-processors. A streamlined DPIA covering cross-border transfer and the cart abandonment workflow is recommended. ### Sample text for your banner > We use YM Cart to operate our checkout. YM Cart sets cookies that are necessary for your basket and order to function. With your consent, we also use cart abandonment cookies that allow us to remind you about products left in your basket. Your order and cart data are transferred to YM Cart servers in Japan, which the European Commission has recognised as offering an adequate level of data protection. You can manage your preferences at any time in our cookie settings. Cookies and trackers ## What YM Cart sets and contacts - Tracking method JavaScript-based shopping cart widget with first-party cookies for cart state, AJAX calls to ym-cart.com API endpoints, and optional integration with payment gateways and analytics tags - Server location Japan (primary operator YM Square Inc.) with possible CDN edges in Asia and Europe - Data transferred outside the EU Personal data (cart contents, billing details, IP, browser fingerprint) is transferred to the operator's servers in Japan. The European Commission adopted an adequacy decision for Japan (Commercial Privacy Rules) on 23 January 2019, so transfers to Japan benefit from a streamlined legal basis under Art. 45 GDPR, but supplementary documentation is still recommended. ### Cookies set (5) | Name | Type | Duration | Purpose | | ----------- | ------------------ | -------- | ---------------------------------------------------------------------------------------------------------------------- | | cart\_id | Strictly necessary | 30 days | Identifies the visitor's active shopping cart. Required for adding products, applying coupons and completing checkout. | | ym\_session | Strictly necessary | Session | Session identifier used for authenticated checkout, CSRF protection, and order completion. | | ym\_user | Functional | 1 year | Persistent anonymous identifier used to remember returning shoppers and pre-fill cart contents. | | ym\_conv | Marketing | 90 days | Conversion attribution cookie tying the order to the original referrer or ad campaign. | | ym\_abandon | Marketing | 30 days | Marks the cart as abandoned to trigger reminder workflows (when marketing consent is granted). | ### Third-party domains contacted (4) - `ym-cart.com` - `api.ym-cart.com` - `cdn.ym-cart.com` - `pay.ym-cart.com` Questions ## Frequently asked questions about YM Cart Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does YM Cart set? cart\_id (cart identifier, strictly necessary), ym\_session (session ID, strictly necessary), ym\_user (anonymous returning visitor, functional or marketing), ym\_conv (conversion attribution, marketing), ym\_abandon (abandonment marker, marketing). Strictly necessary ones can be set without consent; the rest require prior consent under ePrivacy. ### Do I need user consent before YM Cart loads? Loading YM Cart for the purpose of operating a shopping cart can rely on the strictly necessary exemption (Art. 5(3) ePrivacy). However, marketing features like cart abandonment emails, conversion attribution, and persistent visitor tracking require prior consent. Configure the widget to operate in essential-only mode until the visitor accepts marketing cookies. ### What is the legal basis for processing order data via YM Cart? Order processing relies on contract (Art. 6(1)(b) GDPR). Cart abandonment reminders rely on consent or, where the customer is an existing buyer and national law allows soft opt-in, on legitimate interest. Aggregate analytics rely on legitimate interest, balanced against the visitor's expectations. ### Is data transferred to Japan, and how is the transfer covered? Yes. YM Cart processes data in Japan. The European Commission's adequacy decision of 23 January 2019 (Decision 2019/419) recognises Japan as offering an adequate level of protection for transfers covered by the Supplementary Rules. Confirm with the operator that they are within scope of the decision; if not, fall back to SCCs. ### Do I need a DPIA for YM Cart? A full DPIA is not always required, but a streamlined assessment is recommended whenever cart abandonment workflows, persistent identifiers, or integrations with Japanese ad networks are enabled. If you sell to children, the DPIA should also document age verification controls and parental consent flows. ### How do I deploy YM Cart in a compliant way? Sign a DPA with the operator, verify adequacy scope, document the transfer in the Record of Processing Activities, integrate cookie categories with your CMP, gate marketing features behind explicit consent, present a clear privacy notice that mentions Japan, and configure secure (HTTPS, SameSite=Lax) cookies. ### What alternatives to YM Cart exist? For European deployments, EU-hosted alternatives include Snipcart (Canada with EU options), CommerceLayer (Italy), and SimpleCart. Native platform carts in Shopify Plus, BigCommerce or Adobe Commerce are common alternatives. Open-source options like CommerceCart (EU community fork) reduce vendor lock-in. ### How do I update my cookie policy and privacy notice? Add an entry for cart\_id, ym\_session, ym\_user, ym\_conv, and ym\_abandon, with purpose, duration and category. In your privacy notice, identify the YM Cart operator as a data processor, mention Japan as the data processing location, cite the EU adequacy decision, and list the categories of personal data (order data, billing address, IP, browsing behaviour). Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [Grab PayLater](https://www.flowconsent.com/en/services/ecommerce/grab-pay-later) [Grab Pay Later is a secure payment processing solution that enables businesses to accept online payments through multiple methods including credit cards, digital wallets, and bank transfers. It provides PCI-compliant transaction processing, fraud detection, and automated invoicing. Grab Pay Later supports recurring billing, multi-currency payments, and seamless checkout experiences, helping merchants increase conversion rates while maintaining the highest standards of payment security and compliance.](https://www.flowconsent.com/en/services/ecommerce/grab-pay-later) [Preferences](https://www.flowconsent.com/en/services/ecommerce/grab-pay-later) · ### [X-Cart](https://www.flowconsent.com/en/services/ecommerce/x-cart) [X-Cart is a reliable shopping cart solution that enables e-commerce businesses to provide a seamless checkout experience for their customers. It supports multiple payment methods, coupon codes, tax calculations, and shipping options, ensuring a frictionless purchasing process. X-Cart integrates with popular e-commerce platforms and payment gateways, offering customizable cart designs and abandoned cart recovery features to help merchants maximize revenue and reduce cart abandonment rates.](https://www.flowconsent.com/en/services/ecommerce/x-cart) [Preferences](https://www.flowconsent.com/en/services/ecommerce/x-cart) · ### [PayPal](https://www.flowconsent.com/en/services/ecommerce/paypal) [PayPal is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. PayPal integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, PayPal helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/paypal) [Essential](https://www.flowconsent.com/en/services/ecommerce/paypal) · ### [Planfy](https://www.flowconsent.com/en/services/ecommerce/planfy) [Planfy is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Planfy supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Planfy ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/planfy) [Preferences](https://www.flowconsent.com/en/services/ecommerce/planfy) · ### [Mobify](https://www.flowconsent.com/en/services/ecommerce/mobify) [Mobify is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Mobify supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Mobify ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/mobify) [Preferences](https://www.flowconsent.com/en/services/ecommerce/mobify) · ### [Novaresa](https://www.flowconsent.com/en/services/ecommerce/novaresa) [Novaresa is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Novaresa supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Novaresa ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/novaresa) [E-commerce](https://www.flowconsent.com/en/services/ecommerce/novaresa) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)