GDPR for E-commerce — Cookies, Tracking and Customer Data

Tracking Starts Before the Sale

An online store collects personal data long before anyone reaches checkout. Analytics scripts, advertising pixels, session recorders, and retargeting tags all fire as the page loads, building a profile of a visitor who hasn’t bought anything and may never. Non-essential trackers like these need prior consent; only the genuinely essential ones — the shopping cart, fraud prevention, load balancing — are exempt. The line between “essential” and “nice for marketing” is narrower than most stores assume, and almost everything in the typical ad and analytics stack sits on the wrong side of it.

The Banner Failures Regulators Keep Fining

After years of enforcement, the failures are no mystery — they’re a short, repeated list. Implied consent (“by using this site, you accept cookies”). Pre-ticked boxes. Trackers that fire on page load before the visitor clicks anything. An “Accept” button that’s prominent while “Reject” is buried two screens deep or absent entirely. Vague purposes that tell the shopper nothing about what’s actually being collected or by whom. Regulators have fined every one of these, repeatedly, which means none of them can be passed off as an honest misunderstanding anymore.

Consent and the Ad Stack

For stores running Google’s advertising or measurement products on European traffic, the banner is only the front of a pipeline — the choice a shopper makes has to actually reach the tags. Google’s Consent Mode is the mechanism that carries it; a banner that records a clean choice but never transmits it leaves the store in the worst of both worlds: non-compliant on paper and losing the measurement data it broke the rules to collect. The collection problem and the conversion problem turn out to be the same problem.

Customer Data Beyond the Banner

The banner is one slice of a much larger footprint. An online store also holds accounts, order histories, shipping addresses, payment tokens, and the marketing profiles built on top of them — and each needs its own treatment. Marketing emails need consent or a valid soft opt-in to existing customers, with an easy unsubscribe in every message. Abandoned-cart retargeting is consent-based. Building rich customer profiles for personalisation needs a lawful basis and transparency. A perfect cookie banner sitting on top of a sloppy customer-data operation is a familiar regulator finding.

Looks Compliant vs. Is Compliant

Pattern-matching from real store reviews — the gap between a banner that looks fine and one that holds up tends to follow the same shape:

Compliance Doesn’t Have to Kill Conversion

The objection is always the same: a genuine reject button will tank the numbers. In practice the trade-off is overstated — a clear, honest banner with a real choice tends to perform close to a manipulative one, and the shoppers who decline tracking were rarely the high-intent buyers anyway. What is not overstated is the fine. The store that bets its banner against the regulator is risking a number with seven or eight digits to protect a conversion delta that usually turns out to be small.

Final Thought

E-commerce lives and dies on tracking, and tracking is exactly what regulators watch most closely. The banner isn’t a cosmetic detail to copy from a competitor — it’s the most-enforced surface in the entire regime, and the failures that get fined are the same ones, over and over: consent assumed, choice denied, reject hidden, purpose obscured. Getting it right is neither hard nor expensive. Getting it wrong has a price list, and it runs into the hundreds of millions.

The test: load the store fresh and answer three things — do any non-essential tags fire before a choice is made, can a shopper refuse as easily as accept on the same screen, and does the banner actually say what’s collected and by whom. If any answer is no, the banner is a finding waiting for a complaint.