Ecommerce privacy policy: what to include and common mistakes

Most ecommerce privacy policies are copied from a generator or another store's policy, updated with a company name and forgotten. This approach fails in two ways: it misses data categories specific to ecommerce, and it goes stale as laws change and new vendors are added. Regulatory investigations frequently begin with a privacy policy review before examining actual data practices.

A compliant privacy policy for an ecommerce store must satisfy the disclosure requirements of GDPR (Articles 13 and 14), CCPA/CPRA (Section 1798.100 and related sections) and an expanding set of US state privacy laws. These frameworks have meaningful overlaps but also specific differences that a single policy needs to address. For a checklist of everything GDPR requires at the operational level, see our GDPR compliance checklist for ecommerce.

Required elements under GDPR Articles 13 and 14

GDPR distinguishes between data collected directly from the individual (Article 13) and data obtained from other sources (Article 14). For ecommerce, most data is collected directly. Article 13 requires disclosure of:

• The identity and contact details of the data controller (your company).
• The contact details of your Data Protection Officer (DPO), if you have one.
• The purposes and legal basis for each type of processing.
• Legitimate interests pursued (where legitimate interests is the legal basis).
• Recipients or categories of recipients of the data.
• Whether data will be transferred outside the EU and on what basis.
• Retention periods for each category of data.
• The rights of data subjects: access, rectification, erasure, restriction, portability, objection and withdrawal of consent.
• The right to lodge a complaint with a supervisory authority.
• Whether providing data is a contractual requirement and the consequences of not providing it.
• The existence of automated decision-making and profiling.

Article 14 adds a requirement to disclose the source of data when it was not collected directly. For ecommerce, this applies to data purchased from third parties, data from lead generation campaigns or data obtained from data brokers for advertising audiences. Stores that sell to or collect data from children under 13 also need a dedicated COPPA-compliant children's privacy section in their policy.

Required elements under CCPA

California requires privacy policies to include:

• Categories of personal information collected in the past 12 months.
• The business or commercial purposes for collecting, selling or sharing personal information.
• Categories of third parties to whom personal information was sold or shared.
• Consumer rights: right to know, right to delete, right to opt out of sale/sharing, right to correct (CPRA), right to limit use of sensitive personal information (CPRA).
• How to submit consumer rights requests.
• A "Do Not Sell or Share My Personal Information" link or instructions on how to opt out.
• Whether your business honors the Global Privacy Control signal.
• Retention periods for each category of personal information.
• Non-discrimination notice: consumers who exercise rights cannot be denied goods or services at different prices.

What data ecommerce stores actually collect

This is where most template-based policies fail. The data categories must reflect your actual practices. For a typical ecommerce store:

• Account and identity data. Name, email address, phone number, date of birth (if collected for age verification or loyalty), account password (hashed), profile preferences.
• Order and transaction data. Shipping and billing addresses, order history, product purchases, returns and refunds, gift recipient information if orders are sent as gifts, coupon code usage.
• Payment data. Payment method type (card, PayPal, etc.), last four digits of card number, billing address. You should not retain full card numbers (PCI DSS requirement). Your payment processor retains tokenized data; clarify this relationship in your policy.
• Browsing and interaction data. Pages visited, products viewed, search queries on your site, cart additions and abandonments, session duration and navigation patterns.
• Device and technical data. IP address, browser type and version, operating system, device type, screen resolution, referring URL, UTM parameters from marketing campaigns.
• Cookie and tracking data. First-party cookies, third-party cookies from analytics and advertising partners, pixel data, cross-site tracking identifiers.
• Marketing and communications data. Email subscription status, SMS marketing consent, email open and click history, marketing preferences, unsubscribe history.
• Customer service data. Support ticket history, chat transcripts, return and dispute correspondence, agent notes, complaint history.
• Location data. Shipping address (which provides location), IP-derived location, precise GPS location if your mobile app collects it.
• Social data. If you offer social login, social media profile identifiers and public profile data provided at login.

Legal basis for processing

GDPR requires a legal basis for every type of processing. US state laws do not have this requirement, but documenting it is good practice and helps with GDPR compliance. Common bases for ecommerce:

• Contract performance (Article 6(1)(b)). Processing order data, payment data, shipping information and account data to fulfill orders and manage customer accounts. This is the primary basis for core ecommerce operations.
• Legitimate interests (Article 6(1)(f)). Fraud prevention, security monitoring, improving your services based on usage patterns, sending marketing emails to existing customers (subject to soft opt-in rules). Requires a Legitimate Interests Assessment (LIA) documenting the balance test.
• Consent (Article 6(1)(a)). Marketing emails to prospects, cookies that are not strictly necessary, targeted advertising to new contacts, processing of sensitive data. Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes do not count.
• Legal obligation (Article 6(1)(c)). Retaining order records for tax and accounting obligations, responding to law enforcement requests, maintaining employment records.

Data sharing disclosure

Your policy must disclose who you share data with. For ecommerce stores, the list is typically extensive:

• Payment processors. Stripe, Braintree, Adyen, PayPal or others. Specify what data they receive (billing information, transaction data) and that they process it under their own privacy policies as data processors or independent controllers.
• Shipping and logistics. UPS, FedEx, DHL, USPS, ShipBob, Shipstation or similar. They receive names, addresses and phone numbers for delivery purposes.
• Email marketing platforms. Klaviyo, Mailchimp, Omnisend. They receive email addresses, names and purchase behavior data for marketing campaigns.
• Analytics providers. Google Analytics, Mixpanel, Segment. They receive behavioral data and device identifiers. Note whether analytics is set to share data with Google for advertising purposes.
• Advertising platforms. Meta, Google Ads, TikTok Ads. If you run retargeting campaigns using customer data (custom audiences), these platforms receive personal data. This is often the most sensitive disclosure, as it constitutes "sharing" under CCPA.
• Customer service platforms. Zendesk, Gorgias, Intercom. They process customer communications and support data.
• Fraud detection. Signifyd, NoFraud, Kount. They receive transaction and behavioral data to assess fraud risk.
• Fulfillment partners. Third-party logistics (3PL) providers if you outsource warehousing or fulfillment. They receive order and recipient data.
• Review platforms. Trustpilot, Yotpo, Stamped.io. They receive names, emails and order information to solicit and display reviews.

Retention periods

Both GDPR and CCPA (via CPRA amendment) require disclosure of retention periods. For ecommerce:

• Order records. Typically 7 years for tax and accounting compliance. Some jurisdictions require longer. Our data retention policies guide covers jurisdiction-specific requirements in detail.
• Account data. While the account is active, plus a period after account closure (typically 2-3 years for customer service and dispute purposes).
• Marketing consent records. As long as the marketing relationship is active, plus evidence of consent for a period after opt-out.
• Customer service records. Typically 3-5 years after the last interaction.
• Analytics data. Governed by your analytics platform settings. GA4 defaults to 2 months for user-level data; this can be extended.
• Fraud detection data. Per your fraud vendor's policies, often 3-5 years.

Consumer rights section

Your policy must explain how customers can exercise their rights. The minimum rights you must explain:

• How to request access to their personal data (DSAR process).
• How to request correction of inaccurate data.
• How to request deletion of their data.
• How to opt out of sale or sharing of their data (with a link to the opt-out mechanism).
• How to withdraw consent for marketing communications (unsubscribe instructions).
• How to lodge a complaint with a supervisory authority (for GDPR: the DPA in their country; for CCPA: the California Privacy Protection Agency).

Cookie policy integration

Your privacy policy should either include a cookie section or link to a separate cookie policy. The cookie disclosure must cover: categories of cookies used (strictly necessary, functional, analytics, advertising), which specific cookies and who sets them, their purpose and duration, and how to manage cookie preferences.

Under GDPR and the ePrivacy Directive, you also need a cookie consent mechanism (banner) that allows users to accept or reject non-essential cookies. The cookie policy explains what they are consenting to. These two elements work together.

Common privacy policy mistakes

Supervisory authorities review privacy policies during investigations. The most common problems they find:

• Copy-paste from templates without customization. Policies that list data categories or sharing recipients that do not match the company's actual practices. The ICO and FTC have both cited this as a deceptive practice when the gap between policy and practice is material.
• Missing advertising data sharing disclosure. Many stores run retargeting campaigns that involve sharing customer data with Meta and Google but do not disclose this in their privacy policy or Do Not Sell section. Under CCPA, sharing data for targeted advertising is a "sale" that must be disclosed and opted out of.
• No legal basis for GDPR processing. Policies that describe what data is collected and how it is used but never state the legal basis. GDPR Articles 13 and 14 require explicit legal basis disclosure.
• Missing or vague retention periods. Saying "we retain data as long as necessary" without specifying what "necessary" means for each data category does not satisfy GDPR or CPRA requirements.
• Stale policies. Policies that were last updated in 2021 or 2022 will not reflect CPRA amendments, new US state laws or new vendors added since then. Review and update annually at minimum, and whenever you add a major new data processing activity.
• No international transfer mechanism disclosure. Stores based in the US serving EU customers must disclose the legal mechanism for transferring EU personal data to the US (Standard Contractual Clauses are the most common mechanism post-Schrems II).
• Wrong or missing contact information. Some policies list generic email addresses that are not monitored. Others list the company address incorrectly. The ICO requires privacy policy contact details to be accurate and functional.

How often to update your privacy policy

Review your privacy policy at minimum annually. Also review it whenever:

• You add a new significant vendor that receives customer data (new email platform, new analytics tool, new advertising integration).
• A new state privacy law takes effect that applies to your customers.
• You change your data retention practices.
• You add new product features that collect new categories of data.
• You receive a DSAR and discover that your policy does not accurately describe your actual data holdings.

When you update your policy, note the revision date at the top. Consider notifying customers of material changes via email, especially when adding new data categories or sharing recipients. For a more systematic approach, our guide on privacy by design for ecommerce covers how to build privacy considerations into your store architecture so policy updates follow naturally from good data practices.

Frequently asked questions

What must an ecommerce privacy policy include under GDPR?

GDPR Articles 13 and 14 require disclosure of the data controller identity, purposes and legal basis for processing, data recipients, international transfer mechanisms, retention periods, data subject rights and whether automated decision-making is used.

How often should I update my ecommerce privacy policy?

Review your privacy policy at minimum annually. Also update it when you add a new vendor that receives customer data, when a new state privacy law takes effect or when you change data retention practices.

What is the most common privacy policy mistake for ecommerce stores?

The most common mistake is missing advertising data sharing disclosure. Many stores run retargeting campaigns that share customer data with Meta and Google but do not disclose this in their privacy policy or Do Not Sell section.

Do I need to list retention periods in my privacy policy?

Yes. Both GDPR and CPRA require disclosure of retention periods for each category of personal data. Saying you retain data as long as necessary without specifying timeframes does not satisfy the legal requirement.