WooCommerce is the most popular open-source e-commerce platform for WordPress, powering over 5 million stores. If you run a WooCommerce store, you are responsible for compliance with GDPR, CCPA, PIPEDA, LGPD, and other privacy laws that apply to your customers. WooCommerce offers native privacy features, but WordPress plugins add complexity, and that complexity is where most stores fall out of compliance.
This guide covers WooCommerce’s built-in privacy tools, the WordPress core tools underneath them, and the plugin habits that keep a store clean. No legal team required.
Why WooCommerce Compliance Is Messier Than Shopify
On Shopify, one company controls the platform, the checkout, and most of the data flows. On WooCommerce, you assemble the stack: WordPress core, WooCommerce, a theme, a payment gateway, and however many plugins you have installed. Every layer can collect, store, or transmit personal data, and under GDPR you are the controller for all of it.
Add hosting on top. Your host keeps server logs with IP addresses, and those logs are personal data too. The practical result: compliance on WooCommerce is less about one settings page and more about knowing your whole stack. The good news is that the tools to manage it are built into WordPress and WooCommerce already.
What Data a WooCommerce Store Actually Collects
Start with an inventory. A typical WooCommerce store holds:
- Customer accounts: names, emails, addresses, phone numbers, hashed passwords
- Order records: purchase history, shipping details, order notes, IP addresses at checkout
- Abandoned cart data: email addresses and items left behind
- Payment metadata: the gateway (Stripe, PayPal, Square) stores the actual card data, but your store keeps order references and sometimes last-four digits
- Cookies: WooCommerce cart and session cookies, comment cookies, analytics and ad cookies
- Plugin data: email marketing lists, loyalty points, reviewer emails, wishlists
- Server logs held by your hosting provider
Skim your active plugin list as you read that. Every plugin that touches customers is a new line in this inventory.
WordPress Core Privacy Tools You Already Have
Since WordPress 4.9.6, core ships with working privacy machinery. Three areas matter:
- Privacy settings: under Settings > Privacy, WordPress can create a privacy policy page and keep the suggested text updated as core changes.
- Export Personal Data: under Tools > Export Personal Data, you can generate a full export for a given email address. This is how you answer access and portability requests.
- Erase Personal Data: under Tools > Erase Personal Data, you can create an erasure request for an email address. WooCommerce hooks into this tool, so orders and customer records tied to that address are included in the erasure flow.
These tools are the engine room. WooCommerce adds store-specific settings on top of them.
WooCommerce Settings That Matter
Under WooCommerce > Settings > Accounts & Privacy you will find the store-level controls:
- Personal data retention: WooCommerce can automatically remove personal data from orders and accounts after a set period, replacing identifying details with anonymous placeholders. Turn this on. If you do not set it, order data stays forever.
- Account creation: decide whether checkout forces account creation, and whether you really need phone numbers and full addresses for every order.
- Privacy policy link: WooCommerce shows your privacy policy page in the checkout and account areas. Make sure the page is published and current.
The retention setting is the one most stores never touch, and it is the single highest-impact privacy control in the whole platform. Data you do not keep cannot be breached, misused, or requested.
Cookie Consent on WooCommerce
GDPR consent rules apply to every cookie that is not strictly necessary. On WooCommerce that means:
- Cart and session cookies are essential, so they can load without consent.
- Analytics, advertising, and social pixels need consent before they fire.
- WordPress comment forms set cookies for logged-in commenters, which matters if you allow reviews with accounts.
You need a consent banner that blocks non-essential scripts until a visitor opts in, with per-category toggles. The banner choice matters less than the blocking behavior: a banner that appears after tracking already fired is decoration, not compliance. Whatever plugin you pick, test it with your browser’s network tab and confirm pixels load only after consent.
Plugin and Payment Processor Audit
This is the step that separates compliant WooCommerce stores from the rest. Run it quarterly:
- List every active plugin and what customer data it can see.
- Delete plugins you no longer use. An abandoned plugin with customer sync access is a liability.
- Check that data-heavy plugins (email marketing, reviews, loyalty, analytics) document how they process data and sign data processing agreements where required.
- Know your payment processor. Stripe, PayPal, and Square are separate controllers or processors with their own obligations. You never see full card numbers, which is a real advantage, but you must keep the processor’s terms and policies on record.
- Watch plugins that sync customer lists to ad platforms for lookalike audiences. That activity can count as sharing or selling under CCPA language and needs an opt-out path.
If you handle a high volume of privacy requests, WooCommerce’s own Data Privacy Manager extension adds customer-facing self-service export, erasure, and account deletion workflows. It is optional, but it turns manual request handling into something customers can start themselves.
Erasure vs Retention: The Decision That Confuses Everyone
When a customer asks for erasure, the instinct is to delete everything. But some data must stay. The rule is simple: delete personal data unless a legal obligation requires keeping it.
- Delete: account profiles, marketing lists, abandoned cart records, support chat history, analytics tied to the person.
- Keep, anonymized: order records needed for tax and accounting. WooCommerce’s retention tools can strip identifying details and leave an anonymous order for financial reporting.
- Keep, identifiable: only what your local tax and warranty laws explicitly require, and only for the required period. Check your jurisdiction; requirements differ, and guessing wrong in either direction is a problem.
For a deletion request, use Tools > Erase Personal Data, then follow the erasure into your email tool, plugins, and hosting backups. The WordPress erasure tool covers core and WooCommerce data, but a plugin that synced the customer to a mailing list still holds a copy until you remove it there. A request is complete only when the data is gone from every layer of the stack.
CCPA and the Other Laws, Briefly
WooCommerce stores with California customers should check whether they meet CCPA thresholds (roughly $25M+ in annual revenue, or handling personal information of 100,000 or more consumers or households, or making 50% or more of revenue from selling or sharing personal information). If you qualify, you need a “Do Not Sell or Share My Personal Information” link and a process for opt-outs. Most small stores do not qualify today, but the thresholds are worth revisiting yearly.
Canadian customers bring PIPEDA, Brazilian customers bring LGPD. Both follow the same muscle memory as GDPR: know your data, get consent where required, honor deletion requests, report breaches. Our PIPEDA guide and LGPD guide cover the details, and the Global Privacy Law Hub compares all of them side by side.
The 15-Minute Monthly Compliance Habit
Privacy on WooCommerce does not have to be a project. Once the setup below is done, it becomes a short monthly routine:
- Confirm personal data retention is still enabled and set to your chosen period.
- Check the erasure and export request queue in Tools and action anything pending.
- Review newly installed plugins since last month and delete anything unused.
- Verify your consent banner still blocks tracking before opt-in after theme or plugin updates.
- Confirm the privacy policy page is live and linked from checkout.
Fifteen minutes a month. That routine, plus the retention setting, puts a WooCommerce store ahead of most of the 5 million others running the platform.
Running a Shopify store instead?
The platform setup differs but the laws are the same. Our Shopify GDPR and CCPA guide walks through the Shopify admin settings step by step.
About The Author
