Gdpr Ecommerce

Name: Gdpr Ecommerce
Author: finsilabs

finsilabs/awesome-ecommerce-skills

72 installs
41 repo stars
Updated March 13, 2026
finsilabs/awesome-ecommerce-skills

Make a store GDPR-compliant with cookie consent, data export on request, right-to-deletion workflows, and data processing agreements.

About

Covers GDPR obligations for EU/UK stores: consent, data portability, right to erasure, and lawful-basis documentation. A developer uses it when serving EU customers, adding data-processing tools, or handling a Subject Access Request.

RoPA data-processing mapping with lawful basis per category
Focus on cookie consent management and handling SARs/deletion

Gdpr Ecommerce by the numbers

72 all-time installs (skills.sh)
Ranked #1,165 of 2,203 Security skills by installs in the Skillselion catalog
Data as of Aug 3, 2026 (Skillselion catalog sync)

npx skills add https://github.com/finsilabs/awesome-ecommerce-skills --skill gdpr-ecommerce

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/finsilabs/awesome-ecommerce-skills/gdpr-ecommerce.svg)](https://skillselion.com/skills/finsilabs/awesome-ecommerce-skills/gdpr-ecommerce)

Installs	72
repo stars	★ 41
Last updated	March 13, 2026
Repository	finsilabs/awesome-ecommerce-skills ↗

What it does

Make a store GDPR-compliant with cookie consent, data export on request, right-to-deletion workflows, and data processing agreements.

Files

SKILL.mdMarkdownGitHub ↗

GDPR E-commerce

Overview

GDPR (General Data Protection Regulation) requires e-commerce stores serving EU/UK customers to obtain informed consent for data processing, provide data portability (Article 20), support the right to erasure (Article 17), and maintain a lawful basis for every category of personal data processing. Non-compliance carries fines up to €20M or 4% of global annual turnover. All major platforms have GDPR tools built in; the main gaps are cookie consent management and handling Subject Access Requests (SARs).

When to Use This Skill

When your store serves customers in the EU, EEA, or UK (UK GDPR)
When adding analytics, marketing, or personalization tools that process personal data
When a customer submits a Subject Access Request (SAR) or deletion request
When reviewing third-party integrations for GDPR compliance
When preparing for a data protection audit or DPA (Data Processing Agreement) review

Core Instructions

Step 1: Map your data processing activities

Before configuring any tool, document every category of personal data and its lawful basis. This Register of Processing Activities (RoPA) is required under Article 30 for large processors and recommended for all:

Data Category	Lawful Basis	Retention Period
Order data (name, address, items)	Contract (Art. 6(1)(b))	7 years (tax law)
Account data (email, password hash)	Contract	Until account deletion + 30 days
Analytics (page views, session duration)	Legitimate interest / Consent	13 months
Marketing emails	Consent (Art. 6(1)(a))	Until unsubscribe
Fraud prevention (IP, device fingerprint)	Legitimate interest	90 days

Step 2: Implement cookie consent

---

Shopify

Shopify includes a built-in cookie consent banner via the Privacy & Compliance app (free):

1. Go to Apps → Shopify Privacy & Compliance (or search in the App Store) 2. Configure the banner text, position, and which cookie categories to ask about 3. The app integrates with Shopify's Consent API so that analytics and marketing pixels respect customer choices 4. Alternatively, install a dedicated CMP (Consent Management Platform) like CookieYes or Cookiebot — both have Shopify app integrations

Enabling consent-aware analytics:

For Google Analytics / GA4: use Shopify's Customer Events (Settings → Customer events) which respects consent automatically
For custom Pixel tracking: use the Shopify Customer Privacy API to check consent before loading tracking code

---

WooCommerce

WooCommerce includes basic GDPR features since version 3.4, but cookie consent requires a dedicated plugin.

Install GDPR Cookie Consent (by WebToffee) — free/premium: 1. Install from the WordPress plugin directory 2. Go to Cookie Law Info → Settings:

Configure the banner text, colors, and button labels
Set up cookie categories: Necessary (always on), Analytics, Marketing
Map your installed plugins/scripts to categories (Google Analytics → Analytics, Facebook Pixel → Marketing)

3. The plugin blocks third-party scripts until consent is given

WordPress native GDPR tools:

Go to Settings → Privacy to configure your privacy policy page
Go to Settings → Privacy → Data Erasure Requests — customers can submit erasure requests from My Account; WordPress generates a confirmation email and you process it manually

---

BigCommerce

Install CookieYes or Cookiebot from the BigCommerce App Marketplace. Both provide:

A GDPR-compliant consent banner
Script blocking until consent is given
Consent logging for audit purposes

BigCommerce also supports custom cookie consent via the Script Manager (Storefront → Script Manager) — you can add a Cookiebot or CookieYes script globally.

Step 3: Handle Subject Access Requests (SARs)

Under GDPR Article 20, customers have the right to receive all their personal data in a machine-readable format within 30 days.

---

Shopify

1. When a customer requests their data, go to their Customer profile in Shopify admin 2. Click Request data — Shopify generates a data export file containing:

Customer profile data
Order history
Addresses

3. Shopify emails the download link directly to the customer

Customer privacy settings: 1. Go to Settings → Customer privacy 2. Configure data request webhooks — Shopify sends customers/data_request webhooks to all installed apps when a customer requests their data, so apps can also provide their data

---

WooCommerce

WordPress includes a built-in personal data export tool: 1. Go to Tools → Export Personal Data 2. Enter the customer's email address and click Send Request 3. The customer receives a confirmation email; once they confirm, you see the request in the admin 4. Click Generate export file — WordPress collects data from WooCommerce and all plugins with data exporters 5. The customer receives a zip file with their data in a machine-readable format

---

BigCommerce

BigCommerce does not have a built-in SAR tool. To handle data requests: 1. Use the BigCommerce Customers API and Orders API to extract all data for a customer 2. Package the data as a JSON or CSV export 3. Deliver to the customer within 30 days of the request

Consider building or using a third-party service like Transcend or Mine to automate data request handling.

Step 4: Handle Right to Erasure (Article 17)

The right to erasure must balance deletion with legal retention obligations (tax records must be kept 5–7 years).

---

Shopify

1. Open the customer's profile in Shopify admin 2. Click More actions → Erase personal data 3. Shopify anonymizes the customer's PII (replaces name, email, phone with anonymized placeholders) while keeping the order records for accounting 4. Shopify sends customers/redact webhooks to all installed apps

---

WooCommerce

1. Go to Tools → Erase Personal Data 2. Enter the customer's email and send them a verification request 3. Once they confirm, WordPress and WooCommerce anonymize:

Customer account (email replaced with anonymized placeholder)
Orders (customer name, billing/shipping details replaced with "Deleted User" / anonymized)

4. Order financial records are preserved

---

BigCommerce

Use the Customers API to update the customer record, replacing PII with anonymized placeholders, and delete the customer account. The order records remain (financial data preserved) with the customer references removed.

Step 5: Ensure lawful marketing consent

Only send marketing emails to customers who have explicitly opted in. Pre-ticked boxes are prohibited under GDPR.

On all platforms: 1. Add a clearly labeled, unchecked checkbox to the registration form and checkout: "Yes, I'd like to receive marketing emails" 2. Record the consent timestamp, IP address, and form version in your database (or in your email platform) 3. Include a one-click unsubscribe link in every marketing email 4. Process unsubscribes immediately — within 10 business days is the standard requirement

Email platforms:

Klaviyo: tracks consent separately; use Klaviyo's built-in opt-in forms and consent properties
Mailchimp: uses double opt-in by default (recommended for GDPR); configure under audience settings
Omnisend: has GDPR mode with consent recording built in

Step 6: Sign Data Processing Agreements (DPAs)

Every third-party tool that processes customer data on your behalf must have a DPA in place: 1. Stripe: DPA available at stripe.com/legal/dpa 2. Klaviyo: DPA available in Klaviyo account settings under Account → Privacy 3. Google Analytics: accept Google's DPA in the GA4 admin 4. Shopify: Shopify is a data processor for your customer data; their DPA is in their legal agreements 5. For each vendor, find the DPA in their privacy/legal documentation and complete it

Best Practices

Default all consent to denied — under GDPR, consent must be freely given and unambiguous; pre-ticked boxes are explicitly prohibited
Keep a consent audit trail — log every consent grant, withdrawal, and change with timestamp and the exact consent text version shown to the user
Respond to SARs within 30 days — automate data exports so they're available quickly via a self-service portal; manual exports are slow and error-prone at scale
Sign DPAs with all vendors before using their service — Stripe, Klaviyo, Google Analytics — any tool processing customer data must have a DPA
Separate consent from account creation — do not bundle marketing consent with T&Cs acceptance; each processing purpose needs a separate, granular consent
Test your deletion pipeline regularly — run erasure requests on test accounts quarterly to verify all data is deleted from the database, search indexes, analytics tools, and third-party processors

Common Pitfalls

Problem	Solution
Cookie banner pre-ticking analytics boxes	GDPR requires opt-in consent; pre-ticked boxes are explicitly prohibited under Recital 32
Deleting orders when customer requests erasure	Orders must be retained for the statutory tax period (5–7 years); anonymize PII within orders rather than deleting the order record
Forgetting to delete from email platform and analytics	Shopify's `customers/redact` webhook notifies apps; ensure your Klaviyo, Mailchimp, and analytics tools also receive the deletion request
Marketing emails sent without consent documentation	Store the IP address, timestamp, consent text version, and method (checkbox, sign-up form) for every marketing opt-in
Missing DPA with a key vendor	Audit your vendor list annually; Google, Stripe, Klaviyo, and your hosting provider all need DPAs if they process EU customer data

Related Skills

@data-retention-policies
@account-security
@analytics-integration
@fraud-detection

{
  "context": "Tests whether the agent correctly implements a GDPR-compliant cookie consent system integrated with Google Analytics 4, including proper default consent modes, consent state modeling, versioning, dual persistence, and correct gtag consent update calls.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Necessary always true",
      "max_score": 8,
      "description": "ConsentState type/interface includes a `necessary` field that is always set to `true` and cannot be toggled by the user"
    },
    {
      "name": "Version field present",
      "max_score": 8,
      "description": "ConsentState includes a `version` string field and the saved consent object includes the current version value"
    },
    {
      "name": "Re-prompt on version mismatch",
      "max_score": 8,
      "description": "When loading stored consent, the code compares the stored version against a current version constant and treats the stored consent as null/absent if they differ"
    },
    {
      "name": "GA4 default consent denied",
      "max_score": 10,
      "description": "gtag('consent', 'default', ...) is called with analytics_storage, ad_storage, ad_user_data, and ad_personalization all set to 'denied'"
    },
    {
      "name": "GA4 wait_for_update set",
      "max_score": 8,
      "description": "The gtag consent default call includes wait_for_update: 500"
    },
    {
      "name": "gtag consent update on analytics",
      "max_score": 8,
      "description": "When analytics consent is granted, gtag('consent', 'update', {analytics_storage: 'granted'}) is called"
    },
    {
      "name": "gtag consent update on marketing",
      "max_score": 8,
      "description": "When marketing consent is granted, a gtag consent update sets both ad_storage and ad_user_data to 'granted'"
    },
    {
      "name": "Server-side consent persistence",
      "max_score": 10,
      "description": "After saving consent, a POST request is made to a server-side endpoint (e.g. /api/consent) to persist consent for logged-in users"
    },
    {
      "name": "All checkboxes default unchecked",
      "max_score": 10,
      "description": "The consent banner component initializes analytics, marketing, and personalization choices all to false (NOT pre-checked/pre-ticked)"
    },
    {
      "name": "Reject all option",
      "max_score": 8,
      "description": "The cookie banner includes a 'Reject all' button (or equivalent) that saves all non-necessary consent as false"
    },
    {
      "name": "Client-side only rendering",
      "max_score": 7,
      "description": "The consent banner checks for browser environment (e.g. typeof window !== 'undefined') before accessing localStorage or window globals, preventing SSR errors"
    },
    {
      "name": "Timestamp on consent save",
      "max_score": 7,
      "description": "Saved consent includes a timestamp field (e.g. Date.now() or new Date().toISOString()) for the audit trail"
    }
  ]
}

{
  "context": "Tests whether the agent correctly implements a GDPR right-to-erasure pipeline that checks legal blockers, anonymizes rather than deletes tax-relevant records, uses correct anonymization patterns, logs compliance records, and notifies third-party processors.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Pending orders check",
      "max_score": 10,
      "description": "The erasure function checks for pending/open orders before proceeding and throws an error or returns an error response if any pending orders are found"
    },
    {
      "name": "Orders anonymized not deleted",
      "max_score": 10,
      "description": "Order records are anonymized (UPDATE, not DELETE) — the order row is retained while personal fields are overwritten"
    },
    {
      "name": "PII replaced with [DELETED] or equivalent",
      "max_score": 8,
      "description": "Order anonymization replaces customer name, email, and phone with a placeholder string such as '[DELETED]' or 'Deleted User', not with NULL or empty string"
    },
    {
      "name": "City/country retained in orders",
      "max_score": 8,
      "description": "The shipping address anonymization keeps the city and country fields intact while nulling the street address"
    },
    {
      "name": "Customer record uses placeholder email",
      "max_score": 8,
      "description": "The customer's email is replaced with a unique placeholder pattern containing the customer's ID (e.g. deleted_{id}@deleted.invalid), not simply blanked or set to NULL"
    },
    {
      "name": "Reviews text preserved",
      "max_score": 8,
      "description": "Review records are anonymized by removing the author association, not deleted — the review body/text is kept"
    },
    {
      "name": "Audit log with completedAt",
      "max_score": 10,
      "description": "A record is inserted into a GDPR/erasure log table with both requestedAt and completedAt timestamps after the erasure completes"
    },
    {
      "name": "Third-party notification",
      "max_score": 10,
      "description": "After local deletion/anonymization, the code notifies third-party processors (marketing, support, or loyalty tools) to delete their copy of the customer's data"
    },
    {
      "name": "Promise.allSettled for third parties",
      "max_score": 8,
      "description": "Third-party processor deletion calls are made with Promise.allSettled (not Promise.all), so one failure does not prevent others from being notified"
    },
    {
      "name": "Search index deletion mentioned",
      "max_score": 8,
      "description": "The implementation or accompanying documentation explicitly addresses deleting the customer from search indexes (e.g. Elasticsearch, Algolia) or analytics warehouses"
    },
    {
      "name": "Marketing data deleted",
      "max_score": 6,
      "description": "The erasure pipeline includes a step to delete or unsubscribe the customer from email marketing lists"
    },
    {
      "name": "Sessions deleted",
      "max_score": 6,
      "description": "Login sessions for the customer are deleted as part of the erasure process"
    }
  ]
}

Customer Data Deletion Pipeline

Problem/Feature Description

Verdana Commerce operates an e-commerce platform that recently started receiving formal deletion requests from customers exercising their rights under EU data protection law. The support team is currently handling these requests manually — a process that takes hours per request, involves multiple systems, and is inconsistently executed. The data protection officer has flagged that this creates compliance risk and that they need a reliable, repeatable automated process.

The complication is that Verdana is subject to tax and financial record-keeping obligations, which means they cannot simply delete all customer data. Order history must be retained for up to seven years. At the same time, the marketing team uses Klaviyo for email campaigns, the support team uses Zendesk, and there is a points-based loyalty platform — all of which hold copies of customer personal data that also need to be purged. The platform also has a product review system where customers have left reviews under their names.

Write a TypeScript module that implements the erasure processing logic. Assume a db object is available with methods matching the pattern db.<table>.<method>(customerId). Assume third-party clients (klaviyo, zendesk, loyaltyPlatform) are imported and available. You do not need to implement these — just call their methods as if they exist.

Output Specification

Produce the following files:

lib/gdpr-deletion.ts — the main erasure function processErasureRequest(customerId: string) with all steps of the deletion/anonymization pipeline
lib/gdpr-deletion.test.ts — unit tests (using any testing framework) covering at minimum: the pending-orders guard, the anonymization path for orders, and the third-party notification step
DELETION_PIPELINE.md — a short document describing each step of the pipeline and noting any systems that must be manually verified or that are not yet automated (e.g. search indexes or analytics warehouses)

{
  "context": "Tests whether the agent implements a complete Subject Access Request (SAR) data export API, a GDPR request intake system with identity verification and deadlines, and a marketing email function that enforces consent and includes unsubscribe mechanics.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "All data types exported",
      "max_score": 10,
      "description": "The SAR export includes all of: customer profile, orders (with line items), addresses, reviews, consent history, and login sessions in the response"
    },
    {
      "name": "Export audit log entry",
      "max_score": 8,
      "description": "After generating the export, an audit record is inserted into a GDPR/requests log table with at least customerId, type='export', and requestedAt timestamp"
    },
    {
      "name": "Content-Disposition attachment header",
      "max_score": 8,
      "description": "The export API response sets the Content-Disposition header to 'attachment' with a filename (e.g. my-data-{timestamp}.json)"
    },
    {
      "name": "Content-Type application/json",
      "max_score": 6,
      "description": "The export API response explicitly sets Content-Type to 'application/json'"
    },
    {
      "name": "Identity verification before processing",
      "max_score": 10,
      "description": "The GDPR request intake endpoint does NOT immediately process the request; it first sends a verification email/token and creates the request with a 'pending_verification' status"
    },
    {
      "name": "30-day deadline set",
      "max_score": 8,
      "description": "A deadline field on the GDPR request record is set to 30 days from the time of request (requestedAt + 30 days)"
    },
    {
      "name": "Multiple request types supported",
      "max_score": 6,
      "description": "The GDPR request intake accepts at minimum export, erasure, correction, and objection as request types"
    },
    {
      "name": "Marketing email consent gate",
      "max_score": 8,
      "description": "The marketing email function checks that the customer's marketing consent is explicitly true before sending; if not, the send is skipped"
    },
    {
      "name": "Unsubscribe URL in every email",
      "max_score": 8,
      "description": "Every marketing email sent includes an unsubscribeUrl field generated using a secure per-customer token"
    },
    {
      "name": "One-click unsubscribe sets marketing false",
      "max_score": 8,
      "description": "The unsubscribe handler sets the customer's marketing consent to false and records an unsubscribedAt timestamp"
    },
    {
      "name": "Consent opt-in metadata stored",
      "max_score": 10,
      "description": "When capturing a marketing opt-in, the code stores at minimum the IP address, timestamp, and either the consent text version or the source method (e.g. checkbox, form)"
    },
    {
      "name": "exportedAt timestamp in export",
      "max_score": 10,
      "description": "The exported JSON object includes an exportedAt field with an ISO 8601 timestamp indicating when the export was generated"
    }
  ]
}

Privacy Portal and Marketing Consent System

Problem/Feature Description

Luminos Retail has been growing rapidly across Europe and recently brought on a dedicated data protection officer. The DPO's first audit identified two critical gaps: customers have no self-service way to access or download their personal data, and the marketing team has been sending promotional emails to customers without a robust system to enforce consent or allow easy opt-out.

The DPO wants a privacy portal where customers can submit requests for their data (access, deletion, correction, objection) and receive a machine-readable download of everything the platform holds about them. The portal must also accommodate the right to opt out of marketing at any time with a single click. Additionally, the marketing engineering team needs a utility function for sending promotional emails that enforces consent checks before delivery and embeds a signed unsubscribe link. The DPO has also noted that whenever someone opts into marketing — whether during checkout or on a newsletter signup page — the platform needs to record enough metadata to demonstrate consent if ever challenged.

Assume a db object is available with standard CRUD methods. Assume sendGrid and sendVerificationEmail helper functions are available. Use Next.js API route conventions (NextApiRequest, NextApiResponse).

Output Specification

Produce the following files:

pages/api/gdpr/export.ts — the data export endpoint (authenticated, returns all customer data as a downloadable file)
pages/api/gdpr/request.ts — the request intake endpoint that accepts a request type and email address, validates identity before processing, and sets an appropriate deadline
lib/marketing-email.ts — the marketing email send function, the unsubscribe handler, and a function for recording a new marketing opt-in with the required metadata fields
PRIVACY_PORTAL.md — a short overview of how the three endpoints fit together and what the self-service flow looks like from a customer's perspective

{
  "name": "finsi/gdpr-ecommerce",
  "version": "0.1.0",
  "summary": "GDPR compliance — consent management, data export, right to deletion",
  "skills": {
    "gdpr-ecommerce": {
      "path": "SKILL.md"
    }
  }
}