Making your Shopify business GDPR compliant includes more than just writing a privacy policy. It means providing transparency with a cookie consent banner, collecting user consent, guaranteeing data security, and more.
In this article, we’ll teach you all the steps on how to make your Shopify store GDPR-compliant in detail. You’ll also learn the main GDPR requirements and why compliance is important.
Add a cookie consent banner app to your website in just a few clicks, configure layout and placement, collect consent forms, manage cookies, and more
Try TinyCookie todayWhat is GDPR on Shopify?
General Data Protection Regulation (GDPR) compliance on a Shopify website means that you’re generally in control of user data and you dictate that the data handling practices would be in accordance with the law.
Shopify doesn’t ensure GDPR compliance by itself, meaning you have to apply certain measures, such as a cookie consent banner and privacy policy to comply with the law.
This applies to businesses that have products or services available to citizens of the European Union. Even if your business isn’t located in Europe but you get EU customers or visitors to your site, GDPR still applies to you.
If you need information on how Shopify handles your customer data, refer to their Data Processing Addendum.
Why is GDPR compliance important for Shopify merchants?
GDPR was created as a framework to secure the personal data of citizens of the European Union. Store owners, including Shopify merchants, must ensure GDPR compliance to increase trust and prevent getting large fines. So, here are the main reasons why GDPR compliance is important:
- Legal obligation. Under the European Union’s GDPR, website owners are required to collect cookie usage consent before using them.
- Avoid fines. According to the European Commission, not complying with GDPR can result in a warning, temporary or definitive ban on processing, or a fine of 4% of the business’s total annual worldwide turnover (up to €20 million or around $21.5 million).
- Transparency. With many users being increasingly concerned about privacy and their data rights, having a legitimate cookie policy and banner on your website ensures user trust.
- Data security. By handling user cookie consent choices, you are ensuring their data is safe and won’t get into the hands of the wrong people.
Main GDPR requirements for Shopify merchants
GDPR compliance isn’t difficult to implement if you have clear instructions. So, let’s go through the main requirements for Shopify merchants:
- Request consent. Website owners need to have a cookie banner present as soon as users enter their site, whether one that’s integrated with the theme or a third-party cookie consent app like TinyCookie. It’s prohibited to use cookies before consent is given.
- Record user consent forms. Aside from asking for consent, you also need to store consent forms in a secure way.
- Make consent withdrawal easy. According to GDPR Article 7, it must be as easy to withdraw consent as it was to give it.
- Allow site access. Shopify website owners must allow European Union citizens protected by GDPR access to the website even if consent isn’t granted.
- Provide detailed cookie explanations. Merchants must include a cookie policy on their website explaining what cookies they use, what for, for how long, and why.
- Protect user data. Shopify website owners must ensure that customer information is protected by using data protection tools such as an antivirus.
- Data access and deletion. Website owners must allow access for a user to their personal data or its deletion upon request. Shopify offers tools for customer data deletion when requested as well.
How to comply with Shopify GDPR?
To comply with GDPR as a Shopify merchant, you need to set up a cookie consent banner, include legal agreements, collect user consent, adopt security measures, and more. Keep reading to learn everything you need to do for compliance in detail.
Step 1: Set up a cookie consent banner
To get user consent for using cookies, you need to set up a cookie consent banner. The process is quite similar on many third-party apps. Here’s a detailed guide on how to do it:
- Go to the Shopify App Store and install the cookie consent banner app. We suggest TinyCookie.
- Follow the installation instructions and embed the app to your website. Click Save.
- Go to your Shopify Admin dashboard, open the cookie consent app, and click Configure.
- Choose the layout and placement of the cookie consent banner that you want. Click Save.
- That’s all – the cookie consent banner is now live.
Step 2: Write a privacy policy
The essence of legal agreements, including a GDPR-friendly privacy policy, is that they have to be written in simple language so that ordinary people can clearly understand what they’re agreeing to. Plus, it has to be easily accessible to all users.
Here are the main things you need to include in a privacy policy:
- Effective date. You need to clearly state the date the policy becomes in effect for transparency and legal reasons.
- Owner of the website. This includes contacts of the organization or its representative.
- Reason for data collection. You need to provide the reason you collect user data on a legal basis.
- What information is collected. The policy must list what personal details of users are gathered and how.
- Data retention period. The policy must clearly state for how long the user’s information is going to be kept.
- Information sharing with third parties. You must provide information on who is the recipient(s) of the user’s personal data.
- Third-country data transfer. If user data is going to be transferred to third countries, you must note the measurements taken to ensure data safety.
- User rights. The policy must state what rights the user has, including the right to withdraw consent.
- Privacy policy updates. Provide information on how you’re going to inform users about any privacy policy updates.
You can use an official privacy policy template provided by the GDPR – it even includes a cookie section.
Step 3: Include a cookie policy
Once you set up a cookie consent banner, you’ll have to include a hyperlink to your privacy or cookie policy (depending on where the information about cookies is placed).
Usually, businesses don’t write a separate cookie policy but rather include it as a section in the privacy policy. However, you’re free to pick your own approach.
In any case, to help you write an effective and GDPR-compliant cookie policy, here are a few pointers on what you should include:
- The definition of “cookie.” Users have to comprehend what the term means in the first place.
- User consent information. You must inform users what they’re agreeing to when they click the consent button.
- Cookies used. The policy must include a detailed list of each cookie that is used on your site, including their purpose and expiration date.
- Consent withdrawal information. Website owners must explicitly mention that the user has the right to revoke their consent at any time and provide information on how to do it.
- Company information. Make sure you leave your contacts, such as email or phone number and company registration number.
- Policy’s effective date. State the date when the policy becomes in effect.
If you don’t know what cookies your website uses, you can use a cookie scanner tool, such as TinyCookie. Just open the app, go to the Cookie scanner section, and click the Scan button to get ahold of the list of cookies.
TinyCookie also lets you manage which non-essential cookies you want to keep or block in the Cookie categories section.
Step 4: Collect user consents
Under GDPR, Shopify website owners must collect user consent for proof of compliance and store them securely. To collect consent, you can use any cookie consent tool with this functionality.
Apps like TinyCookie collect user consent forms automatically. You can find all of it by opening the app in your Shopify Admin dashboard and clicking Consent tracking.
If you don’t see any consent forms being tracked after some time, make sure that the cookie consent banner is really live.
Step 5: Ensure data security
GDPR requires securely storing user data to prevent unauthorized access or misuse. For this reason, you need to adopt cybersecurity measures. Some of the tools include:
- Employee IDs. Assigning unique codes to your employees can help prevent unauthorized access to specific systems or data.
- Antivirus software. Setting up an antivirus on all employee devices can help prevent malware and encourage real-time threat detection to not compromise confidentiality.
- Firewall. These protection tools help filter traffic and avoid hacking attempts.
You can learn what steps Shopify takes for security specifically in their Security page.
Step 6: Get a data protection officer (DPO)
Conclusion
GDPR compliance means being transparent about personal user data usage and protecting it. By not complying with this regulation while your website is accessible to EU citizens, you’re risking large fines up to around $21.5 million.
So, complying with GDPR includes setting up a cookie consent banner with an app like TinyCookie that also lets you collect consent forms. You must also write a privacy and cookie policy that clearly states what data is collected and why, adopt data security measures, and hire a data protection officer.
Frequently asked questions
GDPR compliance means meeting the proper personal data handling requirements as defined by the regulation. This framework was designed to hold business owners accountable regarding user privacy, with the main requirements being transparency, lawfulness, and confidentiality.
Using Shopify doesn’t automatically guarantee GDPR compliance. To ensure your Shopify website adheres to the regulations, you need to set up a cookie consent banner, collect user consent forms, and add a privacy and cookie policy to your website explaining what cookies are used, why, and for how long.
