By business type

Cookie Policy Generator for e-commerce

Written for checkout data, payment hand-offs, marketing consent and cross-border selling.

Generate your cookie policy Read the cookie policy guide

Store cookie policies have to cover an unusually long tail, because commerce sites accumulate tags: analytics, retargeting, reviews, chat, loyalty, personalisation and A/B testing all arrive at different times and all set their own.

An online store collects more categories of personal data than almost any other small business, and it collects them at the highest-stakes moment: checkout. Name, address, phone, email, order contents, payment token, device identifiers and behavioural history all arrive in one flow, feeding a dozen downstream systems.

The marketing layer is where most stores go wrong. Abandoned cart emails, review requests, loyalty programmes and retargeting all reuse data collected to fulfil an order. Each of those is a distinct purpose, and in the UK and EU each needs its own basis - which is usually consent or the narrowly-defined soft opt-in, not the contract basis that covers the order itself.

Selling across borders multiplies everything. Every market adds a consumer law, a cancellation regime and a set of disclosure duties, and shipping internationally means transmitting customer data to carriers and customs authorities in each destination.

What a cookie policy for an online store has to cover

Cart and session cookies as strictly necessary, distinguished from everything else
Retargeting and conversion pixels, named per platform
Reviews, chat and loyalty widget cookies
A/B testing and personalisation tools, and the identifiers they persist
How consent gating works and what happens to the cart if cookies are refused

How an online store actually moves personal data

Checkout data

Collected under contract, but the fields you add beyond what fulfilment needs - date of birth, gender, marketing preferences - are on a different footing.

Payment tokens and fraud scoring

The gateway processes card data as its own controller for fraud prevention, which is a hand-off, not a straightforward sub-processing.

Abandoned cart capture

An email address entered but never used to complete an order. Using it is direct marketing, and whether the soft opt-in applies is genuinely debatable because no sale happened.

Retargeting and lookalike audiences

Uploading customer lists to ad platforms for matching or audience building is a disclosure to a third party and, in California, likely sharing.

Reviews and post-purchase requests

Review platforms receive customer name, email and order data, and typically publish part of it.

Cross-border shipping and customs

Address and contents data transmitted to carriers, customs brokers and destination authorities.

Third parties the draft will ask you about

Stripe · PayPal · Klarna · Klaviyo or Mailchimp · Trustpilot or Judge.me · Meta and Google Ads · DPD, Royal Mail or your carrier · Gorgias or Zendesk

The rules that apply

Distance selling and cancellation rules

Fourteen days in the UK and EU, seven in Brazil, none federally in the US - the same store faces different obligations per market.

Marketing consent and the soft opt-in

Post-purchase marketing is permitted only where the address was collected in a sale of similar goods with an opt-out offered at the time and in every message.

Cookie and tracking consent

Retargeting pixels, analytics and personalisation all require consent in the UK and EU before they fire.

Payment card handling

Using a hosted gateway keeps card data off your systems, but the policy has to describe the hand-off accurately rather than implying you store nothing at all.

Consumer information duties

Total price, delivery costs, return costs, complaint routes and trader identity, disclosed before the order is placed.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

The e-commerce document set

Map the checkout field by field
For each field: why it is collected, the basis, where it goes and how long it is kept.
Separate order processing from marketing
Different purposes, different bases, different retention. The consent record for marketing has to be independent.
Scan the storefront for pre-consent tags
Retargeting pixels are the usual finding.
Write the refund policy against every market you ship to
Statutory rights first, then your own terms.
Document the payment hand-off
Which provider, which fields they see, and what you retain.
Set retention for orders and for marketing profiles separately
Tax retention is not a reason to keep a behavioural profile.

Where this usually goes wrong

Abandoned cart emails without a basis

Where no purchase completed, the soft opt-in argument is weak. Consent captured at the point of email entry is the defensible route.

Pre-ticked marketing checkboxes

Invalid consent in the UK and EU, and it taints the whole list rather than just the individual record.

Customer list uploads to ad platforms undisclosed

It is a disclosure to a third party and in several US states a sale or share requiring an opt-out.

Retargeting pixels firing before consent

The most common UK and EU failure on e-commerce sites, and the one a cookie scan finds in seconds.

A returns policy that contradicts statutory rights

Final sale rules that override cancellation rights are unenforceable and, in several markets, independently actionable.

Order data retained forever

Tax records justify a period for the transaction data, not for marketing profiles and behavioural history attached to it.

Frequently asked questions

Do I need a privacy policy for a small online shop?

Yes. Taking an order always involves personal data, which triggers transparency obligations in every major market, and payment providers and marketplaces require a published policy as a condition of service.

Can I email customers after they buy?

In the UK and EU, only under the soft opt-in: your own similar products, to someone who bought from you, with an opt-out offered at collection and in every message. Otherwise you need consent.

Are abandoned cart emails allowed?

They are direct marketing, and where no purchase completed the soft opt-in is difficult to rely on. Capturing explicit consent at the point of email entry is the safer route.

Do I need a cookie banner for an online shop?

If you serve the UK or EU and run analytics, retargeting or personalisation - which nearly every store does - then yes, and it needs to block those tags until consent.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.