WooCommerce GDPR Compliance: Store Owner’s Complete Guide

This guide covers the operational and technical side of GDPR compliance for WooCommerce stores. It is not legal advice.

Confirm your specific obligations with a qualified privacy lawyer, particularly if you process sensitive data or sell at meaningful volume into the EU.

WooCommerce ships with built-in privacy tools. Most guides stop at listing them and imply that flipping the right switches makes a store compliant. That is not accurate.

WordPress’s export and erasure tools only cover plugins that were specifically built to hook into them, a real share of the plugins on a typical WooCommerce store were not.

This guide covers what WooCommerce’s native tools actually do, the specific settings to configure today, and the gap between what these tools handle automatically and what a store owner still has to check manually.

Key Takeaways

• WooCommerce’s privacy settings live under WooCommerce, then Settings, then Accounts and Privacy. WordPress’s own export and erasure tools live under Tools in the main admin menu.
• Account erasure options that remove personal data from orders and revoke download access are disabled by default. Most stores never turn them on.
• WordPress’s export and erasure tools only include data from plugins that were built to hook into them. Contact forms, newsletter tools, CRMs, and custom checkout fields often store data outside this system completely.
• Server logs, backups, staging environments, and support email inboxes are not covered by WooCommerce’s privacy tools at all and need separate handling.
• WooCommerce’s cart cookies are strictly necessary and exempt from cookie consent requirements. Analytics and advertising cookies are not.
• The most common WordPress cookie compliance failure is a banner that displays but does not actually block tracking scripts from firing before consent is given.
• Installing a GDPR or cookie consent plugin does not make a store compliant on its own. Configuration and ongoing review still matter.

What GDPR Actually Requires for a Store

The General Data Protection Regulation gives EU residents specific rights over their personal data, and applies to any store selling to EU customers regardless of where the store itself is based.

The core rights relevant to a WooCommerce store are the right to access the data a business holds, the right to have it corrected, the right to have it erased, and the right to know what it is being used for.

Consent for marketing and non-essential cookies must be freely given, specific, informed, and unambiguous, according to the UK’s ICO. A pre-ticked checkbox does not meet that standard. Neither does a cookie banner that only offers Accept with no equivalent option to decline.

None of this changes because a store runs on WooCommerce instead of a custom build. The obligations are the same, WooCommerce simply provides some of the technical infrastructure to help meet them.

WooCommerce’s Built-In Privacy Tools

Tool	Location	What It Does
Export Personal Data	Tools, then Export Personal Data	Lets a customer or admin generate a file of a specific person’s stored data
Erase Personal Data	Tools, then Erase Personal Data	Processes a request to delete a specific person’s data
Personal data retention	WooCommerce, then Settings, then Accounts and Privacy	Sets how long inactive accounts and old orders are kept before automatic cleanup
Account erasure request options	Same settings page	Controls whether orders and download access are included in erasure requests
Bulk personal data removal	WooCommerce, then Orders	Removes personal data from multiple historical orders at once

These tools have existed since WordPress 4.9.6 and WooCommerce 3.4. They are not new, and most stores still have them configured with the defaults rather than settings that reflect an actual policy decision.

Configure These Settings Today

Work through this in order. Each step takes a few minutes.

1. Go to WooCommerce, then Settings, then Accounts and Privacy.
2. Under Account erasure requests, enable Remove personal data from orders on request and Remove access to downloads on request. Both are off by default, which means a genuine erasure request currently would not remove order data even if a customer asks.
3. Under Personal data retention, set how long to keep inactive accounts, and how long to keep pending, failed, or cancelled orders before they are removed. Completed orders can be set to anonymize rather than delete, which preserves your sales reporting while removing the personal identifiers.
4. Save changes.
5. Place a real test order on your own store. Then go to Tools, then Export Personal Data, and run an export request for that test order’s email address.
6. Review the exported file. Every plugin that correctly hooks into WordPress’s privacy tools will appear here with its own data section. Any plugin storing personal data that does not appear is a plugin you will need to check manually, contact the developer, or handle erasure requests for by hand.
7. For any store with an existing order history and no prior cleanup, go to WooCommerce, then Orders, select older orders, and use Bulk Actions, then Remove personal data to clear data that falls outside your new retention policy.

This test-order method is the fastest way to see exactly what your store’s real privacy tooling covers versus what the settings page implies it covers.

The Real Gap: What These Tools Do Not Cover

This is the part vendor content skips. Enabling every setting above does not mean every trace of a customer’s data has been addressed.

Third-party plugins that were never built to hook into WordPress’s privacy exporter and eraser keep their own data completely outside this system.

Contact form submissions, newsletter signups, live chat transcripts, CRM records, and custom checkout field data are common examples.

If a plugin does not appear in your test export from Step 6 above, its data needs to be found and handled separately, the plugin’s own settings or its developer’s documentation is where to check first.

Several other data locations sit outside WooCommerce and WordPress completely:

• Server access logs and error logs, which typically include IP addresses
• Full site and database backups, which contain a complete historical copy of everything, including data that has since been erased from the live site
• Staging and test environments, which are frequently cloned from production and then forgotten
• Support email inboxes, where a customer’s order details and personal information often live in plain email threads

A meaningfully thorough erasure process checks all of these, not just the WordPress admin. For most small stores, a documented policy of what gets checked and how often is more realistic than promising instant, complete erasure across every system on request.

WooCommerce’s own official direction on this gap is the newer Data Privacy Manager extension, a first-party plugin that adds a self-service privacy centre to the customer’s My Account area and gives staff controlled access to manage requests, though it still depends on the same underlying hook system for third-party plugin data.

Cookie Consent: A Separate Requirement

GDPR and cookie consent get treated as one topic, but they are governed by related, distinct rules, the ePrivacy rules specifically covering tracking technologies like cookies. In practice, most WooCommerce stores need to satisfy both at once.

What Needs Consent and What Does Not

WooCommerce’s own cart cookies, which track what is in a shopping cart, are strictly necessary for the purchase process and are exempt from consent requirements. Google Analytics cookies, Facebook Pixel cookies, YouTube embed cookies, social sharing widget cookies, and live chat cookies all require consent before they load.

The Most Common Failure

A cookie banner that displays but does not actually block those tracking scripts from firing before the visitor responds is the most common compliance failure on WordPress sites generally.

The banner exists, the legal appearance of compliance exists, but the underlying tracking still runs regardless of what the visitor chooses.

A cookie consent plugin needs to be configured to block scripts by default until consent is given, not just display a notice alongside scripts that load anyway.

Cookie Consent Plugins Compared

Plugin	Pricing	Notable For
Complianz	Free tier available, premium from $59 to $69/year single site	Wizard-based setup, built-in cookie scanner, supports GDPR, CCPA, and several other regional frameworks in one plugin
CookieYes	Free tier with limits, premium from $10/month/domain	Auto-translation into 40-plus languages, Google-certified consent management platform
WebToffee GDPR Cookie Consent	WooCommerce Marketplace listing, check current pricing	Built specifically for WooCommerce, supports Google Consent Mode v2

Every one of these plugin vendors states plainly, in their own documentation, that installing the plugin alone does not make a site fully compliant. Configuration, an accurate cookie scan, and correctly blocking scripts by default all still depend on the store owner setting it up properly.

Privacy Policy and Checkout Consent

WooCommerce auto-generates a starter Privacy Policy page during setup. That template is a starting point, not a finished policy, it needs your actual business name, what data you collect, which third parties you share it with (your payment processor, your email platform, your analytics tool), and how long you retain it.

At checkout, any marketing opt-in checkbox must be unticked by default. Pre-checked consent boxes do not meet the freely given and unambiguous standard GDPR requires.

If your checkout currently pre-selects a newsletter signup or marketing consent box, that is worth fixing regardless of how minor it seems, it is one of the more commonly cited violations in GDPR enforcement guidance.

Data Processing Agreements With Third Parties

Every third-party service that touches customer data on your behalf, your payment processor, your email marketing platform, your shipping software, your analytics provider, needs a data processing agreement in place.

Most established providers (Stripe, PayPal, Klaviyo, and similar) publish a standard DPA that can be accepted directly through their account settings or trust centre.

Confirm one exists and has been accepted for every service connected to your store, rather than assuming it happens automatically when you sign up.

FAQ’s