The deadline for the compliance of your e-commerce site with the GDPR is coming, and it is surprising to note that despite the many articles and conferences on the subject, it is difficult to know exactly what needs to be changed on your site to comply with the law.
We are being told everywhere about the interpretation of texts, the impacts at the global level of the company, and the main principles of the GDPR. But no one seems to be able to say in concrete terms how to modify their e-commerce site, which does not facilitate the work of e-merchants who now have to manage this project in an emergency
You may have a Shopify website, A preasthop or Magento, be in dopshipping or not. Here are the points to be modified to bring your site into compliance with the GDPR:
You have now an obligation to provide a "Personal Information" page on the site, which is a content page explaining the entire personal information management policy in relation to the GDPR. It allows to list all the information that is collected from the site and its possible use by the company.
It is also mandatory to propose a dedicated contact form for any request related to the management of a customer's personal data. This form is sent to the GDPR Manager of the company who is responsible for processing the requests.
Every counrty has it own odata protection organisation. Here are some of the links for severals countries :
From now on, visitors must be given the opportunity to choose for themselves the type of cookies they wish to leave active when browsing. I'm quite sure you've already seen one of them on any website. This results in the appearance of a banner or a tassel that appears as soon as the visitor arrives on any page of the site, and which cannot disappear until the visitor has made an action among the choices offered. This banner contains a legal notice and allows access to the personalization of the site's cookies.
As an French e-commerce consultant, I'm refering a lot the CNIL . So For France, for the text of the banner, the CNIL proposes the following wording:
"By continuing to browse this site, you agree to the use of[Cookies or other tracking devices] to provide you with[For example, targeted advertising tailored to your interests] and[For example, to compile visit statistics]. »
In addition to this mention, it is ideal to add on this banner:
Due to popular demand, there are cookie management solutions available for E-commerce to managed GDPR and to enable several levels of settings.
For a detailed management of the cookie settings:
The CNIL specifies that "this banner must not disappear until the visitor has continued to navigate". If the visitor continues browsing without confirming, the default maximum privacy setting is required for the duration of the session.
From now on, the maximum lifetime of a cookie for audience measurement is 13 months maximum. At the end of this period, the visitor's consent must be obtained again. This involves setting up your Google Analytics account accordingly and any other tools that generate cookies/trackers.
The classification of cookies by type of use to comply with the GDPR is not clearly defined by the CNIL, but we can generally classify them into 3 categories of influence on the functioning of the site:
A customer must be able to modify all his personal information independently, via his customer account in particular. This is already the case on most of the Customer Centres of e-commerce sites.
The GDPR incorporates a new concept, the "Right to erasure", sometimes callef "right to forget" or " right for individuals to have personal data erased" :
In concrete terms, this applies in 3 ways in the site:
But you can add a lot more if you want to ! Like :
This applies to all forms that involve data collection:
Each registration will require informing the visitor of the personal data management policy and obtaining his or her consent. It must be ensured that on each page, the information next to the validation button is sufficiently explicit on this point, with a message such as :
By creating your account, you acknowledge that you have read our privacy policy (link) and agree to it.
By subscribing to our newsletter, you acknowledge that you have read our privacy policy (link) and accept it.
By validating your order, you accept our general terms and conditions of sale (link), you acknowledge that you have read our policy on the management of personal data (link).
The addition of a checkbox is not clearly expressed as mandatory, but there is no reason to change habits on this point. It is better to keep a checkbox for the acceptance of the T&Cs and the subscription to the newsletter.
The double opt-in consists of doubling the consent procedure for subscribing to a mailing list.
The 1st opt-in is done at the time of registration from the site, there is no change from the generally observed functioning. To subscribe to a mailing list, simply tick a box on the site page. However, it will be necessary to clearly explain how the collected data are used by adding appropriate text.
This 1st registration action automatically triggers an email that generates the 2nd optin. The message contains a confirmation request to receive the desired information. It is only from this click that the address can be added to the database.
It is therefore necessary to adapt the newsletter subscription procedure to these 2 elements.
With this list, you should be able to quickly modify your site to comply with the principles of the GDPR. As the GDPR will be deployed on e-commerce sites, you will probably find other ways to implement this recommendations
Contact Your GDPR Expert Now !
I will respond in the next 24 hours.
Regulation No 2016/679, known as the General Data Protection Regulation (GDPR), is a European Union regulation that constitutes the reference text for the protection of personal data. It strengthens and unifies data protection for individuals within the European Union.