E-commerce · GDPR

E-commerce — GDPR: cookies, prospecting and profiling

GDPR is at the heart of compliance for any e-commerce site. Three areas concentrate regulatory scrutiny: cookie consent, commercial prospecting, and marketing profiling. Added to these are payment data security and retention periods. This guide details these obligations and provides an operational roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • Every e-commerce site is concerned, with no threshold, as soon as it processes customer data.
  • Bringing cookies into compliance.
  • Govern prospecting.
  • Govern profiling.
  • Fines of up to €20M or 4% of global turnover.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

The e-merchant is the data controller for the entire customer journey. Non-essential cookies require compliant consent; prospecting relies on consent or legitimate interest depending on the context; profiling must be governed and transparent.

The security of accounts and payment data is a cross-cutting imperative.

Is the 'E-commerce' sector affected?

Every e-commerce site is concerned, without any threshold, as soon as it processes customer data. The intensity depends on volume and marketing practices.

Service providers (hosting, payment solutions, marketing tools) are data processors and must be governed by DPAs.

Detailed obligations

Bring cookies into compliance

Deploy a banner enabling free, specific, informed, and revocable consent, with no non-essential trackers deposited prior to consent.

Govern prospecting

Determine the legal basis (consent for B2C prospecting, exceptions for similar products), and offer a simple unsubscribe option.

Govern profiling

Inform about marketing profiling and recommendation, and provide the ability to object where applicable.

Secure payments and accounts.

Secure payment data (compliant service providers) and customer accounts (passwords, authentication).

Control retention periods

Define retention periods for inactive accounts, orders, and marketing data.

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Cookies and prospecting are among the most frequent grounds for penalties in e-commerce.

Common mistakes in the sector

  • 1Non-compliant cookies. Drop trackers before consent.
  • 2Prospecting without a legal basis. Sending marketing emails without a legal basis.
  • 3Opaque profiling. Profiling without information.
  • 4Excessive retention. Keep inactive accounts indefinitely.

Practical case

A website was placing advertising cookies upon arrival, without consent. Following remediation, it only activates non-essential trackers after consent is obtained, revises its cookie policy, and documents prospecting activities — reducing the risk of sanctions.

Compliance roadmap

  1. 1

    Audit cookies. Verify banner and trackers.

  2. 2

    Frame prospecting. Legal bases and unsubscription.

  3. 3

    Document profiling. Information and objection.

  4. 4

    Secure. Payment, accounts, providers.

  5. 5

    Define retention periods. Accounts, orders, marketing.

Frequently asked questions

No: strictly necessary trackers are exempt; advertising and non-exempt measurement cookies require consent.

Back to the E-commerce guideE-commerce & NIS2

Take action on GDPR

Free assessment or a chat with an expert dedicated to e-commerce.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the e-commerce sector secured their compliance with DCO.

See testimonials