Ecommerce and the regulation meet in five specific places, and a store that handles those five is in a far better position than one that has read the whole text and applied none of it. The order below is the order they tend to cause problems: the checkout is fine in most stores, and the apps are where the real exposure sits.
One: the checkout, which is usually the easy part
Processing an order is necessary for the contract, so the basis is straightforward and nothing extra needs consenting to. What is needed is the notice at the point of collection: what is taken, why, who receives it, how long the order record lives. The common defect is a marketing checkbox pre-ticked or bundled into the purchase, which turns a clean contract basis into a contested consent for no commercial gain.
Two: the marketing list, three: the tags
The list needs a real record of what each subscriber agreed to and a withdrawal that works everywhere. The tags need more thought: advertising pixels, audience syncs and remarketing scripts process personal data about European visitors for a purpose the contract does not cover, and where consent is required they need it before they fire rather than after. This is the half of a store that is invisible on the page and set up by whoever ran the last campaign.
Four: the apps, which is where the exposure is
A typical store installs between ten and thirty apps over a couple of years, and most of them read customer data. Each is a processor, each needs an agreement, each has its own sub-processors and its own location, and each is a recipient your notice should describe. Nobody keeps this list unless somebody decides to. Making the app install checklist include the privacy questions is the single highest-value habit a store can adopt.
Five: the deletion request that arrives one day
A customer asks to be deleted. The order records are needed for tax and accounting, which is a legal obligation and a legitimate reason to keep them; the marketing profile, the abandoned cart data, the review and the support history are not. Answering properly means knowing which is which and being able to act on each system, including the apps. Stores that have never mapped their apps discover the problem with a clock already running.
Questions people ask about ecommerce GDPR
Does a US store selling a few EU orders have to comply?
If it offers to customers in the region, the regulation reaches those customers' data. Euro pricing, EU shipping options and translated pages all point at an offer.
Can we refuse a deletion request to keep the order record?
You can keep what you are legally required to keep and must delete the rest. The answer explains which is which rather than refusing outright.
Do we need a cookie banner?
For visitors in the region, non-essential storage generally needs consent before it is set, which a banner is one way to obtain. In the US the requirement is different and runs through the opt-out of sale or sharing instead.