How do I make my online shop GDPR- and cookie-compliant?
The CNIL mainly checks three things on shops: refusing as easy as accepting, no tracker before the click, and proof of the choice. The rest of GDPR plays out on retention periods.
Short answer
- No analytics or advertising cookie may be dropped before the visitor consents.
- The “Reject all” button must be as accessible as “Accept all”, at the same level and one click away.
- The CNIL recommends keeping consent for no more than six months and trackers for no more than thirteen.
- A privacy policy must state purposes, retention periods and processors.
- Strictly necessary cookies — cart, session, security — do not require consent.
What a shop actually processes
Common processing and legal basis
| Processing | Legal basis | Watch out for |
|---|---|---|
| Order handling | Contract performance | Retention tied to accounting duties |
| Customer account | Contract performance | Deletion on request, purge inactive accounts |
| Newsletter | Consent | Unticked box, one-click unsubscribe |
| Analytics and advertising | Consent | No drop before the click |
A real example
Example: a shop shows a banner where “Accept all” is a coloured button while refusing means opening “Customise” and unticking four purposes. Refusal is not as simple as acceptance, so the consent collected is invalid. Adding a “Reject all” button next to the first one fixes the most-sanctioned point.
Common mistakes
- Loading analytics and remarketing scripts as soon as the page renders.
- Hiding refusal behind a second screen while acceptance takes one click.
- Automatically adding buyers to the newsletter without separate consent.
- Keeping inactive customer accounts and abandoned-cart history forever.
How 4shopy helps
- The cookie banner offers “Accept all” and “Reject all” at the same level and drops nothing before the choice.
- The choice is timestamped and stored, which is the evidence an inspection requires.
- The privacy policy is a dedicated, editable page linked from every page.
- Newsletter sign-up uses a separate box, never bundled with order confirmation.
- Data stays hosted in the European Union, avoiding paperwork for transfers outside the EU.