Most stores I take over for a rebuild have a privacy policy written by a lawyer and not a single setting in the admin panel that matches it. The document promises that customer data will be erased on request, and the store does not even have a button that would do it. So when someone searches for GDPR in an online store, they land on a dozen law-firm articles about legal bases and information duties, and never get an answer to the question I hear most often: what exactly do I click in WooCommerce so that what I signed in the document is actually true.
I write this as a developer, not a lawyer, and that disclaimer matters here: this is not legal advice. I will not tell you which legal basis fits your newsletter or how long you may keep invoicing data. You confirm that with a lawyer or your accountant. What I will show you is the part legal guides usually leave out: where customer data physically sits in the store, which WooCommerce and WordPress settings are responsible for it, and how to check once a year whether the document still describes the store you run.
GDPR in an online store - what to implement technically
GDPR implementation in an online store has two halves, and in practice almost everyone does only one of them. The first half is paperwork: the online store privacy policy, information clauses, a register of processing activities, data processing agreements with the companies you hand data to. That is the lawyer’s territory. The second half is a store that behaves the way those documents promise. That is the territory of a developer or whoever administers the panel.
The split is simpler than it looks. The lawyer answers the questions “is this allowed”, “on what basis” and “for how long”. The technical side answers “where does it sit”, “who has access”, “how do I export it” and “how do I delete it so it is really gone”. If the document says a customer can get a copy of their data, someone in the store has to be able to generate it in a quarter of an hour, not dig through database tables by hand. If it says data is deleted once the retention period ends, the store has to do that on its own, because no owner is going to clean up orders manually every month.
I described the border between these two worlds in more detail when writing about online store terms and conditions, where the problem is the same: the document is written once and the store changes ten times. With GDPR the gap is only more dangerous, because it concerns other people’s data rather than your own terms of sale.
Where customer data really sits in the store
Before you click anything, you need to know what you are protecting. Most store owners, asked about customer data, point to the order list and the customer accounts. Good start, but in a typical WooCommerce store personal data sits in far more places:
- Orders - name, address, phone, email, sometimes a tax ID and order notes where customers type things nobody asked them for.
- Customer accounts - the same plus purchase history and saved addresses.
- Product reviews and comments - name, email and the IP address stored with every entry.
- Contact forms - many form plugins save every submission to the database by default, even though the email already went to your inbox. After two years that is hundreds of records nobody remembers.
- Email logs - SMTP plugins often keep copies of sent messages together with their content, which means the data from order confirmations.
- Abandoned carts and newsletter - cart recovery plugins save the email and cart contents before anyone has bought anything.
- Backups - every database backup is a full dump of everything above. Deleting a customer from the store does not delete them from last month’s backup. How I arrange backups for a store is in the post on WooCommerce store backups.
- Server logs - IP addresses and visited URLs, usually rotated by the host.
An exercise I run at the start of every rebuild: I take one customer email address and search for it across the whole store database. The number of tables it shows up in usually surprises the owner and is the first argument for making some plugins stop saving things nobody reads.
What helps: make a simple spreadsheet: location, what data, why, for how long, who has access. You do not need a lawyer or a tool for this. That list later becomes the basis for the conversation with the lawyer and the only sensible starting point for a clean-up.
Consents, cookies, export and erasure in WooCommerce
This is the part you came here for. GDPR in WooCommerce can largely be set up without extra plugins, because WordPress and WooCommerce ship with built-in tools that most stores have switched off or never configured.
The privacy policy page. WordPress has a Privacy tab under Settings where you pick which page is your privacy policy. The ready-made consent texts in WooCommerce and the login form link to whatever you set there. WooCommerce adds a guide in the same place with snippets describing what data the store collects at checkout and where it sends it. Those snippets do not replace the document from your lawyer, but they are a good checklist: whatever they mention that your privacy policy does not is a topic for the lawyer.
Consents at registration and checkout. In WooCommerce, under Settings, in the Accounts & Privacy section, there are two text fields: the notice at account registration and the notice on the checkout page, both linking to the privacy policy. Most stores have the default text there, or nothing. You agree the wording with the lawyer, but whether it actually displays is something you check yourself by walking through checkout as a customer. Consent to the terms and the privacy notice are two different fields, not one checkbox with three links.
Cookies and scripts. Here the technical side splits into two questions. First: which scripts does the store load before the visitor consents, and does the cookie banner actually block them or just display a message. Second: does Google measurement still work after the banner goes in. I covered both separately in the post on the Consent Mode v2 rollout, so just one note here: a banner that displays nicely and blocks nothing is worse than no banner, because it gives a false sense that the topic is handled.
Data export on request. WordPress has an “Export Personal Data” item under Tools. You enter the customer’s email address, the system sends them a confirmation request, and once confirmed it generates a package with data from every place that has hooked into the mechanism. WooCommerce adds orders, addresses and downloads to the package. It works out of the box, no plugin needed. The catch: form, cart and mailing plugins only join this export if their author did the work. So after setting it up, run a test on your own address and compare the package with the list of locations from the previous section. Whatever is missing from the package has to be exported separately or added to the mechanism with your own code.
Erasure. Next to the export sits “Erase Personal Data”. Same pattern: address, confirmation, then the system clears what can be cleared and reports what it left alone. WooCommerce does not delete orders on erasure; it anonymises them. The order stays in your statistics and your accounts, and the customer’s details are replaced with a marker saying they were removed. That matters, because invoices and accounting records have their own retention periods, and those cannot be shortened just because a customer asked to be deleted. Which orders can be anonymised and which must stay in full is again a question for your lawyer and accountant, not for me.
Automatic clean-up. In the same Accounts & Privacy section, WooCommerce lets you set after how long the store itself anonymises orders in particular statuses and removes inactive accounts. The periods you enter are whatever you agreed with the lawyer; I only make sure the setting is switched on and matches the document. This is the mechanism that replaces manual tidying, and in most stores nobody has ever turned it on.
Admin access. Something legal guides stay silent about: who has an administrator account. Former agencies, a designer from three years ago, a “temporary” account for the accountant. Every account with access to orders is access to customer data, and one compromised account is enough to be writing a breach notification about whose data leaked. What to do once it has happened is in my recovery plan for a hacked WordPress site; better to delete unused accounts once a year.
When I build or rebuild a store, these settings are on my handover checklist next to payments and shipping, not under “client will fill in later”. Switching them on takes less time than one meeting with a lawyer, and without them that lawyer’s document describes a store that does not exist.
Parties outside the store - gateway, courier, mailing, analytics
A WooCommerce store almost never keeps data only on its own server. With every order, customer data goes out to the payment provider, to the courier or shipping broker, often to an invoicing system, a mailing tool and analytics. The processing agreements with those companies are the lawyer’s job. My job is knowing exactly what goes out: the courier integration needs an address and a phone number, but not necessarily the contents of the order notes, and the mailing plugin needs an email address but sometimes receives the whole purchase history. When I review a store, I open the settings of every integration and check the mapped fields. Part of it can usually be switched off with one click, and the list of what remains goes into the privacy policy as a concrete description instead of a vague “data may be shared with partners”.
The once-a-year review
GDPR in an online store is not something you implement once. The store gains a new plugin, changes courier, adds a loyalty programme, and the document stays frozen on the day it was signed. So once a year, ideally on a fixed date, I walk through this list with the client:
- The list of data locations from the second section of this post: have new plugins appeared that store something, and are the old ones still needed.
- A test export and erasure on your own test address: does the package contain what it should, and after erasure does the data really disappear from the new plugins too.
- Automatic clean-up: is it still switched on and do the periods match the document. Plugin updates can quietly reset settings.
- Admin accounts and access to hosting, FTP and the database: who has access and does each of those people still work with you.
- The cookie banner: after a year of updates, does it still block scripts before consent rather than just displaying itself.
- Integrations: has a new one appeared that sends data outside, and is it in the privacy policy and the processing agreements.
- Backups: where they sit, how long they are kept and who has access, because they are a copy of everything above.
- Privacy policy and terms: do they describe the store that stands today, not the one from a year ago. You write down the mismatches and take them to the lawyer.
In a mid-sized store this review takes one afternoon. The outcome is a list of things to fix on the technical side and a second, shorter one to talk through with the lawyer. Without the review, the gap between document and store grows every year and surfaces at the worst possible moment: a leak, a complaint or an inspection.
Summary
A privacy policy from a lawyer handles half the job. The other half is a store that does what the document promises: knows where it keeps data, can export and erase it on request, cleans up old orders and accounts on its own, shows consents at checkout and registration, blocks scripts until consent is given, and sends integrations only what they really need. Most of that is built into WooCommerce and WordPress and is waiting to be switched on.
If you do not know whether your panel settings match what you signed in the privacy policy, send me the link. I will go through the list from this post and send back what needs doing on my side and what to take to the lawyer.
Frequently asked questions
Do I need a separate plugin for GDPR in my store? Not for the basics. The privacy policy page, consent texts at registration and checkout, data export and erasure on request, and automatic clean-up of orders and accounts are built into WordPress and WooCommerce. A plugin is usually useful for a cookie banner that blocks scripts before consent, and sometimes for reporting what other plugins have not hooked into the export.
Does erasing a customer on request delete their orders? WooCommerce does not delete orders; it anonymises them. The order stays for statistics and accounting, and the customer’s details are replaced with a marker that they were removed. Which orders can be anonymised this way and which must stay in full for the period required for accounting records is something you settle with your lawyer and accountant.
What about customer data in backups? Deleting from the store does not delete from the backup. That is why the backup retention period is part of how long you keep data and belongs in the privacy policy. Technically, you make sure old backups are actually deleted and that only the people who must have access to them do.
Running a store where something does not work the way it should? I build and rebuild WooCommerce stores - from a single fix to reworking the whole sales flow. Tell me what you are dealing with and I will send back a scope and a price.