How do you get cookies and privacy right in an online store?
The banner is not a cosmetic formality. The Garante's June 2021 guidelines require refusing to be as immediate as accepting, and nothing profiling to run before consent.
Short answer
- Technical cookies need no consent, but must be described in the notice.
- Profiling and third-party analytics cookies require prior consent.
- The banner must let users refuse as easily as accept, including by closing it.
- Scrolling does not count as consent and cookie walls are not allowed.
- You need an art. 13 GDPR notice and a processor agreement with suppliers that handle the data.
What requires consent
Cookies and tracking tools in a store
| Tool | Consent | Note |
|---|---|---|
| Cart and login session | No | Technical cookies, essential to the service |
| Third-party analytics | Yes, as a rule | Unless measures make them equivalent to technical ones |
| Advertising and remarketing pixels | Yes | Must not fire before the choice is made |
| Newsletter and marketing profiling | Yes, separately | Consent distinct from the order |
The correct sequence
- Block non-essential scripts until the visitor has chosen.
- Show a banner with a short notice, a link to the full one and two equivalent options.
- Record the choice and do not re-show the banner before six months, unless something substantial changes.
- Publish the privacy notice with purposes, legal bases, recipients and data-subject rights.
- Sign processor agreements with the platform, the payment provider and the couriers.
Common mistakes
- A banner with a prominent “Accept” and refusal buried in a second layer.
- Analytics scripts and pixels already running on the first page load.
- Subscribing to the newsletter anyone who merely completed an order, with no separate consent.
- A privacy notice copied from another site, listing suppliers and purposes that are not yours.
How 4shopy helps
- The cookie banner is built in, with accept and refuse at the same level.
- Analytics and marketing scripts only fire after consent.
- Newsletter consent is a field separate from the order.
- Data and hosting stay inside the European Union, which shortens the paperwork you must produce.