GDPR & cookie consent

Updated Oct 17, 2026 Trust & Compliance

TitanCart’s built-in GDPR Compliance extension gives you the privacy tools most stores need: a cookie consent banner, a consent checkbox at checkout, customer data export (“download my data”) and self-service account deletion with a sensible retention hold. It ships in TitanCart Lite and Pro, with no outside service.

Note: The extension helps you collect consent and honour data-subject requests; it is not a legal solution on its own. You still need a genuine privacy policy, and if you operate under GDPR, CCPA or similar rules, have the specifics reviewed by someone qualified.

1. Enable the extension

Go to TitanCart → Extensions → Installed Extensions, find GDPR Compliance in the Built-in Extensions card, make sure it is enabled, and click the gear icon to open its settings page. The page has two sections, Cookie Consent and Data Privacy.

2. The cookie consent banner

Under Cookie Consent, choose a Cookie consent mode:

Disabled — no banner.
Implicit (browsing = consent) — an informational banner with one Accept & Close button; continuing to browse counts as consent.
Explicit (must click Accept) — the default. The banner offers Decline and Accept, so the visitor makes an active choice.

Then set the Banner text and the Banner position: Bottom bar (default), Top bar or Center popup, which adds a dimmed overlay. The visitor’s choice is remembered for a year, so the banner returns only after that or if they clear cookies. A Privacy Policy link appears in the banner automatically once you set the page URL in the next step.

3. Link your privacy policy

Under Data Privacy, set the Privacy Policy page URL (default /privacy-policy). It feeds the link in the cookie banner and the checkout consent checkbox, so point it at your published policy page.

4. The consent checkbox at checkout

Require consent checkbox at checkout is on by default: a required checkbox appears before the Place Order button, and customers must tick it to complete the order. The Consent checkbox label is the text shown (default “I agree to the processing of my personal data”); the Privacy Policy link is appended when a URL is set.

5. Let customers download their data

With Allow customers to export their data on (the default), a Your Data card with a Download my data button appears on the customer’s My Account → My Profile page. Clicking it downloads a single JSON file with everything TitanCart holds about them: profile, saved addresses, order history with line items, and wishlist. That is the machine-readable copy the GDPR data-portability right expects.

6. Let customers delete their account

With Allow customers to request data deletion on (the default), a Delete My Account card appears on the same My Profile page. (The older General Settings switch Show “Delete my account” button surfaces the same card.) When the customer confirms, TitanCart does not do a blunt wipe; it splits the data by what is safe to remove now and what you may still need:

Immediately: the account is deactivated and the login removed, and the profile, saved addresses, wishlist, active cart and newsletter subscription are erased.
Held, then erased: the personal details on their past orders (name, e-mail, phone, billing and shipping address) are kept for the retention hold in §7 and then anonymised automatically by a daily background job. The orders’ amounts, dates and line items are always kept for your tax records.

If the customer has no orders, or their last order is already older than the hold, everything is erased at once. The customer is told the date their order details will be erased. Administrator accounts cannot be deleted from the storefront.

Why the hold? It lets you defend chargebacks and meet record-keeping obligations — GDPR Article 17(3) permits retention to establish or defend legal claims and to meet legal obligations — while honouring the erasure request for everything else straight away.

7. Set the retention hold

Data retention hold (days) is how long order-linked personal data is kept after the customer’s most recent order before it is anonymised. The default of 180 days covers typical chargeback windows with a buffer. Lower it if your exposure is shorter, raise it for products with long dispute windows (subscriptions, pre-orders), or set 0 to erase order details immediately with everything else.

8. Test it

Sign in to the storefront as a test customer and open My Account → My Profile. Confirm the Your Data card downloads a JSON file and the Delete My Account card shows the retention notice.
Open the storefront in a private window, confirm the banner appears in your chosen mode and position, accept it, and confirm it does not reappear on the next page.

What the banner does and does not do

The banner records the visitor’s choice in a cookie that TitanCart and other integrations can read before setting non-essential cookies or loading tracking scripts. It does not itself block or remove third-party tracking: if you add analytics or marketing pixels, you or that integration are responsible for honouring the recorded consent. Choose Explicit mode if your jurisdiction requires an opt-in before any non-essential cookie is set.

Troubleshooting

The Your Data or Delete My Account card is missing. The matching switch is off, or the extension is not enabled.
A deleted customer’s name still shows on old orders. Expected during the hold; it is anonymised when the hold elapses. The financial record stays.
The banner does not appear. Mode is Disabled, the extension is off, or this browser already chose; use a private window.
No Privacy Policy link in the banner or at checkout. The page URL is blank.
The checkout checkbox is missing. Require consent checkbox at checkout is off, or the extension is off.
An administrator cannot delete their own account from the storefront. Intended.