By platform

Cookie Policy Generator for WooCommerce

Written for Woo order data, gateway plugins, extension sprawl and self-hosted retention.

Generate your cookie policy Read the cookie policy guide

A WooCommerce cookie table is a WordPress cookie table plus commerce: cart and session cookies that genuinely are strictly necessary, sitting alongside marketing, analytics and abandoned-cart trackers that are not. Getting the split right is what makes the banner usable without breaking checkout.

WooCommerce inherits every WordPress consideration and adds a full commerce stack on top. Orders, customer accounts, addresses, tax records and payment tokens live in your own database rather than a platform’s - which means retention, encryption, backup handling and breach exposure are genuinely yours.

The extension model multiplies recipients quickly. Subscriptions, bookings, memberships, shipping calculators, tax services, review platforms and marketing integrations each add their own processing, and several transmit order data to their own cloud services.

Woo does provide account-erasure tooling and personal data export hooks that integrate with the WordPress privacy tools, plus settings controlling how long it keeps inactive accounts and order data. Those settings default to keeping everything indefinitely.

What a cookie policy for a WooCommerce store has to cover

WooCommerce cart, session and recently-viewed cookies, classified as necessary or otherwise
Extension cookies from reviews, upsell, subscription and loyalty plugins
Abandoned-cart trackers, which capture an identifier before any purchase completes
Advertising and conversion pixels added through plugins or the theme
What breaks in checkout if strictly necessary cookies are blocked

How a WooCommerce store actually moves personal data

Order and customer records in your database

Billing and shipping addresses, phone, email, order history and notes, held until you configure otherwise.

Payment tokens and gateway hand-off

Hosted fields keep card data out of your server; direct integrations do not. The policy has to reflect which model you actually use.

Subscriptions and stored payment methods

Recurring billing stores a token tied to a customer, which is a longer-lived relationship with its own disclosure and cancellation duties.

Shipping and tax integrations

Address data sent to carriers for rates and labels, and to tax services for calculation - each an independent recipient.

Abandoned cart and marketing extensions

Capturing a partially completed checkout and emailing about it is direct marketing based on data collected for a different purpose.

Backups containing the full order table

Every backup replicates customer records. Erasure has to reach the backup policy or it is not erasure.

Third parties the draft will ask you about

Stripe · PayPal · Klarna · Automattic (WooCommerce.com) · Royal Mail, DPD or your carrier · Avalara or TaxJar · Mailchimp for WooCommerce · your hosting provider

The rules that apply

WooCommerce data retention settings

Settings → Accounts & Privacy controls retention for inactive accounts, pending, failed and cancelled orders. Defaults keep everything.

Payment gateway plugins

Stripe, PayPal, Klarna and others handle card data. Which fields your server sees depends on whether the gateway is hosted, embedded or direct.

Tax and compliance services

Automated tax calculation transmits order and address data to a third-party service for every quote.

Self-hosted breach exposure

You hold the order database, so a compromise is your notifiable breach, not a platform’s.

Guest checkout and account creation

Different retention and different lawful bases apply depending on whether an account is created.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

Publishing and enforcing on WooCommerce

Set the policy pages in WooCommerce settings
Settings → Accounts & Privacy lets you link the privacy policy on the checkout and account registration pages.
Configure retention for orders and inactive accounts
Choose real periods and let Woo enforce them, rather than describing periods nobody applies.
Add the terms checkbox at checkout
Woo supports a mandatory terms acceptance checkbox, which is what makes your terms part of the contract.
List your extensions
Every extension that transmits order data is a recipient for the policy.
Test personal data export and erasure
Woo hooks into the WordPress tools; confirm what they return and what they leave behind.
Document the backup and restore path
Including how an erasure request is honoured against backups.

Where this usually goes wrong

Never configuring retention

Settings → Accounts & Privacy exists and is nearly always left at the defaults, which retain orders and inactive accounts forever.

Abandoned cart emails with no basis

The email was collected to complete an order. Using it for recovery marketing needs consent or a correctly-applied soft opt-in.

Extensions transmitting order data undisclosed

Review requests, loyalty programmes and analytics extensions each send order and customer data to a vendor.

No breach plan for a self-hosted database

You are the one who has to notify within 72 hours in the UK and EU. Platform-hosted merchants can lean on the platform; you cannot.

Card data touching the server unnecessarily

Direct integrations widen PCI scope considerably compared with hosted fields, and the policy should describe the model you actually run.

Frequently asked questions

Does WooCommerce store credit card details?

Not usually. With hosted or embedded gateway fields the card data goes straight to the provider and you store a token. Direct integrations are different, and they expand your PCI scope substantially.

How long should I keep WooCommerce orders?

Long enough for tax and contractual purposes - commonly six years in the UK - and no longer for the personal data that is not needed. Woo can enforce this automatically once configured.

Are abandoned cart emails legal?

They are direct marketing. In the UK and EU they need consent or the soft opt-in, which requires the address to have been collected in the course of a sale of similar goods with an opt-out offered at the time.

Who is responsible if my WooCommerce database is breached?

You are. Self-hosting means the controller and the operator are the same party, and the 72-hour notification obligation lands on you.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.