GDPR consents in the shop:which ones youreally need.
An online shop collects several different consents, and each has its own place and its own rules. We describe where each one sits, what a Torveo shop does with it by itself and what stays on your side.
in this article
Three matter most: cookie consent in the banner, acceptance of the terms when ordering and marketing consent when signing up for the newsletter. Each has a different place and none replaces the others. We describe how this works in a Torveo shop. This is not legal advice: have a lawyer review the content of your terms and privacy policy, and for an unusual business also the choice of legal bases.
Cookies: the consent banner
The cookie consent banner is on by default in the shop. Consent to analytics and marketing starts unticked and switches on only when the customer ticks it. The “Essential only” button sits next to “Accept all”, so refusing takes as much effort as agreeing.
Without consent, the Google Analytics 4, Microsoft Clarity, Hotjar, PostHog and Meta Pixel scripts do not load at all. When you add such a tool in the panel, the banner adds the matching consent category by itself.
The customer's decision is valid for 12 months. If you start using a new category in that time, the banner comes back for people who have not been asked about it yet. The customer withdraws consent with the cookie settings link in the shop footer. A link to the privacy policy appears in the banner once you enter its address in the panel.
Terms: acceptance when ordering
Until the customer ticks acceptance of the terms, the order button at checkout stays inactive. At account registration the button stays active, but the form will not go through without the tick, on the server side too. With the order we store the date of acceptance and the IP address.
The shop wizard prepares the terms and the privacy policy from a template and your company details. Once you accept it, the document is yours: you are responsible for its content, and the template no longer overwrites a page you have edited by hand.
Newsletter: a separate marketing consent
Below the sign-up form there is a consent checkbox. It is unticked, and without it the sign-up does not go through, on the server side as well.
Email confirmation of the sign-up (double opt-in) is on by default: the address joins the list only after the link is clicked. On sign-up we store the date, the IP address and the source of consent. Every campaign has an unsubscribe link that works with one click.
Abandoned cart reminders
By default, cart reminders go only to people with marketing consent, and we check the consent once more just before sending. A reminder text message goes only to a customer who has an account, has given a phone number and has given marketing consent.
We save a guest's address typed in at checkout only if you turn this option on in the panel. You then choose the basis from three: marketing consent from the cookie banner, a separate checkbox at checkout, or legitimate interest. The panel describes the last one as a risk on the shop's side, so choose it deliberately.
Customer rights: their data and account deletion
Customers download their data and delete their account themselves in their shop account, without writing to you. Deleting an account means anonymisation: the email address, phone, addresses and notes disappear, while amounts, numbers and dates of orders remain, because they are needed for tax records.
The contact is also removed from the connected mailing tool, and if that fails, the task shows up in the panel to do by hand. How long to keep contact form messages and panel logs is set in the panel. Older entries disappear in the nightly clean-up.
What you collect: a short list
Five consents and bases that should be in your shop, each in its place:
- Consent to analytics cookies: in the banner when the shop uses analytics tools, unticked at the start.
- Consent to marketing cookies: in the banner when the shop uses marketing tools, separate from analytics.
- Acceptance of the terms: at checkout and at registration, with date and IP address on the order.
- Newsletter consent: at the sign-up form, confirmed by email.
- Basis for cart reminders: chosen in the panel, marketing consent by default.
What the panel will not do for you: the privacy policy is your document. The wizard offers a template, but you are responsible for its content and you enter the link in the panel for the banner to show. If you use tools outside the list supported in the panel, check that they also wait for the customer's consent.