A WooCommerce store collects personal data from the moment a customer lands on the page: browsing behaviour via cookies, billing names and addresses at checkout, email addresses for order confirmation, payment tokens, and shipping history stored against customer accounts. If any of those customers are based in the European Union or California — and for most stores with international traffic, some will be — then GDPR and CCPA are not optional reading. Both laws were updated after 2021: GDPR enforcement ramped up sharply (total EU fines exceeded €4.5 billion by mid-2024), and California’s CPRA amendments to CCPA took effect in January 2023, adding new rights and a dedicated enforcement agency.
This guide covers what each law actually requires of a WooCommerce store in 2026 — not the generic “update your privacy policy” advice, but the specific configurations, tools, and workflows that constitute real compliance.
What GDPR requires of WooCommerce stores
GDPR applies to any business that processes personal data of EU residents, regardless of where the business is based. For WooCommerce, “processing” starts at the first cookie dropped on a visitor’s browser — before any purchase is made.
The core obligations break into four categories:
Lawful basis for processing
You need a documented legal basis for every type of data you process. The bases most relevant to WooCommerce are: contract (processing billing and shipping data to fulfil an order — no consent required), legitimate interest (fraud prevention, security logging — requires a documented balancing test), and consent (marketing emails, analytics cookies, retargeting pixels — consent must be freely given, specific, and withdrawable at any time). Do not use consent as a catch-all. If you need the data to fulfil the order, the basis is contract, not consent — conflating them causes problems when customers try to withdraw consent for something you legally need to process anyway.
Cookie consent
GDPR requires opt-in consent for any non-essential cookie. “Essential” means cookies without which the site cannot function: session cookies, CSRF tokens, WooCommerce cart cookies. Everything else — Google Analytics, Meta Pixel, Hotjar, live chat tracking — requires explicit opt-in before the script fires. A pre-ticked box, or a banner that fires GA4 on page load before the visitor makes a choice, is non-compliant. The banner must block the cookie from loading until consent is given, not just show a notice after the fact.
Privacy policy
Your privacy policy must include: what data you collect (with specific categories), the legal basis for each type of processing, who you share it with and why (payment processors, shipping APIs, analytics tools, email marketing platforms), how long you keep it, and how customers can exercise their rights. “We take your privacy seriously” does not satisfy the Article 13/14 transparency requirements. Name your data processors — Stripe, WooCommerce.com, Mailchimp — and link to their sub-processor documentation.
Data subject rights
EU customers have the right to access their data, correct it, delete it, restrict processing, and port it to another service. WooCommerce has built-in tools for two of these: go to Tools > Export Personal Data (sends a download link to the customer) and Tools > Erase Personal Data (anonymises order records while keeping accounting data intact). You must respond to data subject requests within 30 days. For stores processing significant EU volume, a formal process for logging and tracking requests is worth implementing — even a shared spreadsheet with timestamps is better than handling it ad hoc and losing track.
What CCPA/CPRA requires of WooCommerce stores
CCPA (updated by CPRA in January 2023) covers California residents. Unlike GDPR’s focus on consent, CCPA centres on transparency and opt-out rights. The thresholds matter: CCPA applies if your business has annual gross revenues above $25 million, buys/sells/shares personal information of 100,000+ consumers or households per year, or derives 50%+ of annual revenue from selling personal information. Many smaller WooCommerce stores fall below all three thresholds — but the law is still worth understanding because it shapes what US customers expect and because several other US state laws (Virginia CDPA, Colorado CPA, Texas TDPSA, Connecticut CTDPA) are closely modelled on it.
Key CPRA differences from CCPA (2023 amendments)
- New “sensitive personal information” category — precise geolocation, health data, financial account numbers, and biometric identifiers now have a specific opt-out right separate from the general data sale opt-out
- Right to correct — added in CPRA (not in original CCPA): customers can request correction of inaccurate personal data, not just deletion
- Right to limit use of sensitive PI — distinct from opt-out of sale; applies even when data is not being “sold” in the traditional sense
- California Privacy Protection Agency (CPPA) — CPRA created a dedicated enforcement agency; the CPPA can issue regulations and investigate independently of the AG’s office
Enforcement penalties: $2,500 per unintentional violation, $7,500 per intentional violation. CCPA’s private right of action — limited to data breaches of certain categories — allows $100–$750 per consumer per incident in statutory damages without proving actual harm.
What CCPA requires of your store
The “Do Not Sell or Share My Personal Information” link must appear in your footer if you share data with third parties in ways that could constitute “selling” under the statute. Using Google Analytics with advertising features enabled, running a Meta Pixel for retargeting, or passing email addresses to a third-party ESP for cross-context behavioural advertising all likely constitute “sharing” under CPRA’s expanded definition. The opt-out mechanism must actually work — a link to a privacy policy page with no action taken doesn’t satisfy the requirement.
Cookie consent architecture in practice
The right implementation blocks third-party scripts at the network level until the visitor makes a choice. The workflow is:
- On first visit, a cookie consent banner fires before any analytics or marketing scripts load
- The visitor accepts all, rejects all, or manages by category (necessary / functional / analytics / marketing)
- Consent is stored in a first-party cookie
- On subsequent visits, scripts load or don’t based on the stored choice
- The visitor can withdraw consent at any time via an accessible preferences link (typically in the footer)
Google Analytics 4’s consent mode v2 is relevant here: GA4 can now receive consent signals and adjust its data collection accordingly, enabling some basic measurement even for visitors who decline — without firing full tracking cookies. Configuring this correctly requires your consent plugin to pass the right consent signals to GA4’s gtag('consent', 'update', ...) call. Both Complianz and CookieYes handle this natively.
The difference between the two: Complianz scans your site automatically to detect which cookies are being set and categorises them — useful if you’ve accumulated third-party scripts over time and aren’t sure what’s firing. CookieYes is simpler to set up and has a cleaner UI, which makes it the better choice for stores where the cookie inventory is already known and relatively small.
Privacy policy: what it must actually say
A compliant WooCommerce privacy policy should address each of the following specifically, not generically:
- Data collected at checkout: name, billing/shipping address, email, phone, IP address, browser user-agent
- Payment data: clarify that card numbers are processed by [Stripe/PayPal/your gateway] and are never stored on your server — link to the gateway’s own privacy policy
- Analytics and tracking: name the tools (Google Analytics 4, Meta Pixel if applicable), what they collect, and that consent is required before they fire
- Email marketing: if you use Mailchimp, Klaviyo, or MailPoet, name the processor, the data you pass (email, name, purchase history), and the legal basis
- Data retention: how long you keep order records (specify — “as required by law” is not enough; UK businesses typically cite 6 years for VAT purposes, Australian businesses cite 5 years under the Tax Administration Act)
- Data subject rights: how to submit a request, the 30-day response window (GDPR), and the contact email/form for requests
WordPress’s default privacy policy template (Settings > Privacy) is a starting point, not a finished policy. Customise every section for your actual stack.
Handling data subject requests
When a customer submits a data erasure or access request, the clock starts at the moment you receive it — 30 days under GDPR, 45 days under CCPA (with a 45-day extension available). For WooCommerce specifically:
- Go to Tools > Erase Personal Data in wp-admin
- Enter the customer’s email address
- WooCommerce will anonymise billing/shipping information on historical orders while retaining the order records for accounting purposes (it doesn’t delete orders — it replaces personal data fields with “Anonymised”)
- Check your email marketing platform separately — WooCommerce’s erasure tool does not reach into Mailchimp, Klaviyo, or your CRM
- If you use a customer account system, delete or anonymise the user account as well
Log every request: who submitted it, when you received it, when you completed it, and what you did. If you’re ever investigated by a DPA (Data Protection Authority), the request log demonstrates you have a functioning process.
Third-party tools: the configurations that matter
The most common compliance gaps in WooCommerce stores aren’t in the store itself — they’re in the third-party tools that fire alongside it.
Google Analytics 4: Enable consent mode v2 (requires configuration via your consent plugin, not just the GA4 dashboard). Disable data collection for logged-in users if you’re storing any EU health or financial data. In GA4 Admin > Data Settings > Data Retention, set the retention period to the minimum your reporting needs.
Meta Pixel / Conversions API: If you’re running Facebook advertising, the Conversions API sends server-side events rather than browser-side pixels — this gives you more reliable attribution and better compliance control, because you can suppress events for users who declined tracking in your consent banner. The browser-side Pixel alone fires regardless of consent state on many themes unless explicitly blocked by your consent plugin.
Email marketing: Ensure your email platform’s Data Processing Agreement (DPA) is in place — most major ESPs (Mailchimp, Klaviyo, MailPoet, Brevo) provide DPAs in their account settings. Having the DPA signed makes them a formally recognised data processor under GDPR rather than a third party you’re sharing data with unilaterally.
For a broader look at locking down WooCommerce store security — beyond the privacy compliance layer — see the guide on protecting customer data in WooCommerce, which covers database hardening, login security, and what to do after a breach. For the payment processing side specifically — how gateways handle payment data and which ones offer the strongest PCI DSS posture — the WooCommerce payment gateways guide covers the major options.
Compliance plugins worth installing
You don’t need a full compliance stack — you need the right tools for the specific gaps in your setup. The minimum viable compliance configuration for most WooCommerce stores:
- Complianz or CookieYes — cookie consent management; blocks third-party scripts until consent is given, handles GA4 consent mode v2, provides the “Do Not Sell” opt-out mechanism for CCPA. One of these is required. Choose Complianz if your cookie inventory is complex and you want automatic scanning; CookieYes if you want faster setup.
- WP Legal Pages — templates for privacy policy, terms of service, and disclaimer pages, pre-populated with WooCommerce-specific language. Saves time on the policy drafting; still requires customisation for your specific stack.
WooCommerce’s built-in data tools (under Tools in wp-admin) handle the data subject rights workflow without an additional plugin — use them rather than adding yet another layer.
If your store is already running a plugin stack and you’re worried about performance or conflicts, the guide to securing WooCommerce against fraud covers how compliance tooling overlaps with fraud prevention — some plugins serve both functions. For the broader WordPress security layer that sits underneath the WooCommerce store, securing WordPress against modern threats covers the firewall, login protection, and file integrity monitoring that should be in place before compliance plugins are even considered.
What to do first if you haven’t started
If your store is currently non-compliant and you’re deciding where to start, the priority order is:
- Block third-party scripts until consent is given — this is the most actively enforced GDPR requirement in 2026. Install Complianz or CookieYes today.
- Update your privacy policy — with the actual tools you use and your real data retention periods.
- Enable WooCommerce’s data tools — so you can respond to erasure requests when they arrive, not when you get 30 days left to respond.
- Sign Data Processing Agreements with your processors — Stripe, your ESP, Google (for GA4). Most are available in account settings; some require a specific opt-in.
- Add a “Do Not Sell” link for CCPA — if you have US traffic and share data with ad platforms, this goes in the footer.
GDPR and CCPA compliance for a WooCommerce store is not a one-day project, but the most exposed gaps — unconsented analytics cookies and an absent privacy policy — can be closed in an afternoon. Start there, then work through the rest systematically.
If you need help auditing your current setup or implementing a specific compliance requirement — consent mode v2, Conversions API, DPA documentation — get in touch. Most compliance gaps can be closed remotely without touching your live store’s checkout flow.
