You added a cookie banner. You have a privacy policy page somewhere in the footer. You figured that was enough.
It probably isn't.
GDPR compliance for e-commerce stores isn't a checkbox - it's an ongoing legal obligation that most store owners get wrong in ways they don't even realise. And the consequences aren't theoretical. Since 2018, EU regulators have issued over €4 billion in GDPR fines. Small stores get hit too.
Here's what actually matters - and where most stores quietly fail.
What GDPR Actually Requires From Your Store
GDPR gives EU customers specific rights over their personal data. As a store owner, you're a data controller - which means you're legally responsible for how that data is collected, stored, processed and deleted.
That's not just email addresses. It's:
- Browsing behaviour tracked by analytics tools
- Purchase history and payment data
- Shipping addresses stored in your system
- Any data shared with third-party tools like email platforms, ad networks or CRMs
If any of that data belongs to an EU resident - even if your store is based outside the EU - GDPR applies to you.
The 7 Places Most Stores Fail GDPR Compliance
1. Cookie consent that doesn't actually consent
A banner that says "We use cookies" with only an "Accept" button is not GDPR compliant. Users must be able to reject non-essential cookies as easily as they accept them. Pre-ticked boxes are illegal. Implied consent is illegal.
Your cookie banner needs:
- A clear "Reject all" option
- Granular controls for different cookie categories (analytics, marketing, functional)
- No cookies fired before consent is given
Most cookie banner implementations - including many popular plugins - fail at least one of these.
2. A privacy policy that doesn't say enough
Your privacy policy isn't just a legal formality. Under GDPR, it must specifically tell users:
- What data you collect and why
- The legal basis for processing each type of data
- How long you retain data
- Who you share data with (name the third parties)
- How users can exercise their rights (access, deletion, portability)
"We may share your data with trusted partners" is not sufficient. You need to name those partners.
3. No process for handling data subject requests
GDPR gives customers the right to request access to their data, correct it, or have it deleted. You have 30 days to respond to these requests.
Do you have a process for this? Do you know where all customer data actually lives across your tools? Can you export or delete it on request?
Most stores don't have a clear answer to any of these questions.
4. Third-party tools you forgot about
Every tool you've connected to your store - Google Analytics, Facebook Pixel, Klaviyo, Hotjar, live chat software - is potentially processing EU customer data. Each of these requires:
- A Data Processing Agreement (DPA) with the vendor
- Disclosure in your privacy policy
- Consent where required
When did you last audit what tools are actually running on your store?
5. Email marketing without proper consent
Pre-ticking a newsletter signup box at checkout is illegal under GDPR. Soft opt-ins ("by completing your purchase you agree to receive marketing emails") are illegal. Consent must be:
- Freely given
- Specific
- Informed
- Unambiguous
If you can't prove when and how a subscriber consented - that's a compliance problem.
6. Data retention that goes on forever
GDPR requires you to delete personal data when you no longer need it. That means customer accounts, order data, and email lists need a defined retention policy.
Keeping data "just in case" is not a legal basis for retention.
7. No SSL on every page
If any page of your store - including checkout - loads over HTTP rather than HTTPS, you're transmitting customer data without encryption. This isn't just a GDPR issue. It's a fundamental security failure.
How to Know If You're Actually Compliant
The honest answer: most store owners don't know. GDPR compliance isn't visible from the outside - it lives in your configurations, your vendor contracts, and your internal processes.
The practical starting point is an audit. Not a legal audit - those cost thousands and take weeks. A technical audit that tells you what's actually happening on your store: what cookies are firing before consent, what data is being shared with which tools, what's missing from your privacy policy, and where your checkout flow creates compliance exposure.
That's exactly what QuoAudit checks - alongside the UX and conversion issues that are costing you sales.
The Bottom Line
GDPR compliance is not a one-time task. It's a state your store needs to maintain - and most stores drift out of compliance every time they install a new plugin, run a new ad campaign, or switch email providers.
The stores that get fined aren't always the ones that ignored GDPR. They're often the ones that thought they'd handled it and didn't check again.
Find out where your store stands → Order QuoAudit