Which laws, which parts
Your markets decide the laws, and what’s in scope.
Magento GDPR and privacy compliance
Find out whether your store handles personal data the way GDPR, UK GDPR and US state laws expect, with every gap ranked by risk in a fix plan.
Adobe Commerce gold partner
#1 Adobe Commerce partner worldwide
Hyvä Platinum Partner
40+ projects delivered
ISO certification
9001 & 27001
Most certified Hyvä agency worldwide
200+ Adobe Commerce Certifications
Award-winning agency
3× eCommerce excellence award
Magento privacy compliance, GDPR to CCPA
We work out which laws apply, test the store against them, and give you a fix plan your team can run.
Cookie consent before any tracking tag
A privacy notice that matches the store
Access and deletion requests, end to end
US opt-out of sale and sharing
Data kept only as long as needed
Tested, not assumed
What loads before consent, and where deletions end up.
A fix plan ranked by risk
Every gap ranked by risk and effort, with the Magento fix.
We’re engineers, not lawyers. The plan is technical, and legal sign-off stays with your counsel.
A GDPR extension is not the same as being covered
An extension switches on a feature. It’s a reasonable first step, but it doesn’t tell you the things a regulator or a customer asks.
Whether tags still fire
Pixels and analytics loading before the visitor consents.
Where customer data goes
Extensions and integrations sending it to third parties.
Whether deletion reaches everything
The ERP, the email platform, backups, and how long anything is kept.
Whether US opt-outs are honored
Across every tool that shares a visitor’s data.
Which laws apply to your store
Where your customers are decides it, not where your company is registered.
GDPR and UK GDPR
Apply when you sell to people in the EU or the UK, with consent before non-essential cookies, a lawful basis for each use of data, and data kept no longer than needed.
- Consent before tracking
- Lawful basis
- Access, correct, erase
- Retention limits
CCPA/CPRA and US state laws
California residents can know, delete and opt out of the sale or sharing of their data. Other states have similar laws, each with its own thresholds.
- California
- Virginia
- Colorado
- Utah
- Connecticut
- Texas
A US store selling into Europe falls under GDPR for those customers, and a European store selling to Californians may fall under California’s law.
Where personal data lives in Magento
It’s spread further than most teams expect, and you can’t honor a request for data you don’t know you hold.
Customer accounts
Names, addresses and saved payment tokens.
Orders and invoices
Including guest orders and their addresses.
Carts and quotes
Often kept indefinitely, with contact details.
Subscribers
Newsletter sign-ups and their consent records.
Reviews and wishlists
Tied to a customer’s name and account.
Logs
Server and payment logs with emails or IPs.
Admin users
Staff accounts and their activity records.
Copies elsewhere
In your ERP, email, analytics and backups.
The audit maps each of these before anything else.
So an access or deletion request reaches every place the data sits.
Magento cookie consent that blocks the tags
Consent is a technical test. Open the store in a clean browser, don’t click anything, and see what loads.
Tags hard-coded into the theme
Outside the consent tool’s control.
A tag manager that loads everything
With consent checks missing from individual tags.
Extensions injecting their own scripts
Unaware of the consent setting.
Magento’s cookie restriction mode only holds back its own cookies, not your tag manager or extensions.
Trackers and the data you didn’t know you sent
Some extensions send customer data as part of their job. Others do it as a side effect, through tracking code nobody remembers adding.
Every script and extension listed
With what each sends, and where it goes.
An inventory to match
The one your privacy notice and contracts should reflect.
Tools you can remove
Some no longer earn their place on the store.
Data requests, retention and deletion
When a customer asks for their data or its deletion, the request has to reach every system that holds it.
Access requests
Producing everything you hold on one customer, across Magento and every system it feeds.
Customer account, orders and quotes
Newsletter and consent records
Copies held in the ERP, email platform and analytics
Deletion
A Magento deletion doesn’t reach every system, and some records must stay for tax.
Removed from Magento, the email platform and analytics
Orders kept where the law requires, and nothing else
Backups handled by a documented rule
US opt-out requests
A US customer’s opt-out of sale or sharing has to reach every tool that shares their data.
Advertising and analytics tags respect the opt-out
Browser-level signals checked where they apply
The opt-out recorded, so it survives the next visit
Retention rules
Most Magento stores keep everything forever, because nothing was ever set to clear it.
How long orders, accounts, quotes and logs are kept
Automatic clean-up where Magento allows it
Rules your counsel can review and approve
How we work, from consult to fix plan
Three steps, each ending in a document you keep.
Consult
Which laws apply, and which extensions are in scope.
A scope summary
Audit
What loads before consent, and where data goes.
A written audit report
Fix plan
Each gap ranked by risk, with the change that closes it.
A plan your team can run
Legal interpretation stays with your counsel, and the plan is written so they can review it.
Doing the fixes
If you’d like us to make the changes, we can, with the consent platform you’ve already chosen.
Through SOLVE
Tracked in the Magebit Client Portal, with every fix reviewed by a developer.
Through a dedicated team
For larger programs, a team that works alongside your own roadmap.
The same test afterwards
The clean-browser test again: whatever is installed, nothing loads before consent.
Writing your privacy policy is for your lawyer. Keeping the fixes in place after every release is for us.
Why ambitious brands choose Magebit
Magebit brings Magento expertise to businesses in every country. From Perth, Melbourne and Sydney to London, Dubai, New York, Los Angeles, Charlotte and Florida, we’re ready to help wherever you are.
#1 Adobe Commerce partner worldwide
The top-ranked Adobe Commerce agency on the planet by Adobe themselves.
55+ Hyvä Certificates
The most certified Hyvä agency in the world. Confirmed by Hyvä themselves, twice.
Explore Hyvä development
Award-winning solutions
Innovator, World Traveler, and eCommerce Excellence awards across Meet Magento NYC and HIVE London, and more.
Hyvä Platinum Partner
The most-certified Hyvä agency worldwide and the first Hyvä Platinum Partner in the USA. 55+ Hyvä certifications and 40+ projects delivered.
ISO certified
ISO 9001 & 27001 for quality and security.
Scrum Alliance certified team
Truly agile team that moves and adapts faster than your typical agency.
Baymard certified design team
UX grounded in large-scale ecommerce research.
Start with what loads before consent
Most stores we look at have a consent banner and tags firing behind it. Tell me where your customers are and what runs on your store, and we’ll show you what’s actually happening to their data.
Reviewed by Kristaps Rjabovs
Co-founder of Magebit, Forbes 30 Under 30
Frequently asked questions
If you can’t find the answer you’re looking for, feel free to reach out to us. We’re here to help.
No platform is compliant on its own, because compliance depends on how the store is configured and what runs on it. Magento includes a basic cookie restriction mode, but it doesn’t control third-party tags, handle data requests across your other systems, or manage retention.
Not necessarily. An extension adds features such as a consent banner or data export. It doesn’t confirm that tags are blocked before consent, that deletion reaches your other systems, or that your extensions aren’t sending data elsewhere. The audit checks those.
Whichever fits your stack and your markets. The important part is testing that it actually blocks tags until the visitor consents, which is the first thing we check.
It can, if you sell to California residents and meet its thresholds. We work out which US state laws are likely to apply during the consult, and your counsel confirms it.
Possibly. Virginia, Colorado, Utah, Connecticut, Texas and other states have their own laws, each with its own thresholds. The consult maps where your customers are against them.
It depends on the extension. The audit lists every extension and script that handles personal data, what it sends and where, so you can decide what to keep, configure or remove.
It has to reach every system that holds their data, not just Magento, while keeping the records you’re legally required to retain. We map how requests flow today and what needs to change.
No. We’re Magento engineers. We find the technical gaps and fix them; your counsel handles legal interpretation and sign-off.
Adobe Commerce (Magento 2) services
Explore the Magento services Magebit has to offer.
Book a privacy audit
Tell us where your customers are and what runs on your store. We’ll start with a short consult.
- 1
Consult
Which laws apply, and what’s in scope.
- 2
Audit
Consent, trackers, requests and retention.
- 3
Fix plan
Every gap ranked by risk, yours to keep.