If your online store sells to people in the European Union, the General Data Protection Regulation (GDPR) applies to you, even if your business has no office in Europe. The law has applied since May 25, 2018, and enforcement is no longer theoretical: regulators have issued about €7.1 billion in GDPR fines through January 2026, according to the DLA Piper GDPR Fines and Data Breach Survey.
This guide explains, in plain English, when the GDPR covers a US ecommerce business, what it actually requires, and four practical steps to get compliant. It is general information, not legal advice. For your specific setup, talk to a privacy lawyer.
Quick Answers
- Does the GDPR apply to a US store? Yes, if you offer goods or services to people who are in the EU, or track their behavior there (Article 3(2)). It is about where the customer is, not their citizenship.
- What are the maximum fines? Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious violations. A lower tier allows up to €10 million or 2% (Article 83).
- Do I need consent for everything? No. Consent is one of six legal bases. Fulfilling an order is covered by “contract,” and keeping tax records by “legal obligation” (Article 6).
- Do I need a Data Protection Officer? Most small stores do not. It is only mandatory in three specific situations (more on that below).
What the GDPR Requires From an Online Store
The GDPR gives people control over their personal data: names, emails, shipping addresses, IP addresses, order history and anything else that can identify them. For an ecommerce business, the core duties are:
- Have a legal basis for every way you use customer data, and only collect what you need.
- Be transparent about what you collect, why, who you share it with and how long you keep it.
- Respect customer rights, including access, correction, deletion (the “right to be forgotten”) and objecting to marketing.
- Keep data secure and report breaches quickly. If a breach creates a risk to people, you must notify the regulator within 72 hours of becoming aware of it, and tell affected customers directly when the risk is high (Article 34).
- Control your vendors. Hosting, email, analytics and other providers that handle data for you need a written data processing agreement (Article 28).
Tip
Your payment stack touches some of the most sensitive data you hold. When you choose an ecommerce payment processor, ask for its data processing terms and how it handles EU customer data and transfers. PCI DSS compliance protects card data, but it does not make you GDPR compliant on its own.
4 Steps to Make Your Store GDPR Compliant
- Map and document the personal data you hold
- Update your privacy notice and internal processes
- Get consent right (especially for cookies and marketing)
- Decide on a DPO and an EU representative
1. Map and Document the Personal Data You Hold
You cannot protect data you have not found. Start with an inventory of every place customer data lives: your store platform, payment processor, email tool, CRM, analytics, ad pixels, support desk and spreadsheets. For each one, note what data it holds, why you collect it, the legal basis, who can access it, where it is stored and how long you keep it.
This inventory becomes your record of processing activities. Article 30 exempts organizations with fewer than 250 employees only when processing is occasional and low risk. Taking orders every day is not occasional, so most active stores should keep this record.
Tip
Delete what you do not need. Old abandoned-cart lists, exported spreadsheets and data from discontinued tools are pure risk with no upside.
2. Update Your Privacy Notice and Internal Processes
Your privacy notice should tell customers, in plain language:
- who you are and how to contact you about privacy;
- what data you collect and the legal basis for each use;
- which third parties receive it (payment, shipping, email, analytics, ads);
- whether data leaves the EU and what protects it;
- how long you keep it, and how customers can exercise their rights.
Behind the notice, you need working processes: a way to answer access and deletion requests (generally within one month), a breach response plan that can meet the 72-hour deadline, and signed data processing agreements with your vendors.
For transfers to the US, many vendors rely on the EU-US Data Privacy Framework, adopted on July 10, 2023. The EU General Court upheld it in September 2025, but it could still face further legal challenges, so check that your key vendors also offer standard contractual clauses as a backup.
3. Get Consent Right (Especially for Cookies and Marketing)
When you do rely on consent, such as for marketing emails, ad tracking or non-essential cookies, it must be a clear, active choice. The GDPR says plainly that “silence, pre-ticked boxes or inactivity” do not count. In the 2019 Planet49 case, the EU’s top court confirmed that a pre-ticked box is not valid consent for cookies.
In practice, that means:
- A cookie banner where “Reject” is as easy as “Accept,” with tracking scripts blocked until the customer opts in.
- Unticked boxes for newsletter signups at checkout, separate from accepting your terms.
- No “consent to marketing” bundled into placing an order (Article 7).
- A simple way to withdraw consent at any time, and a record showing when and how each person agreed.
Tip
You do not need consent to process an order, charge a card or send a shipping confirmation. Those rely on the contract with your customer. Asking for consent you do not need just creates a choice you then have to honor.
4. Decide on a DPO and an EU Representative
Under Article 37, a Data Protection Officer is only mandatory if you are a public authority, if your core business involves large-scale, regular and systematic monitoring of people, or if you process sensitive categories of data at large scale. Most small and mid-sized stores fall outside all three. If you do appoint one, the DPO can be an employee or an outside contractor.
A requirement that catches more US businesses is the EU representative. Under Article 27, a business outside the EU that falls under the GDPR must name a representative in the EU in writing, unless its processing is only occasional and low risk. Regular sales to EU customers usually mean you need one. Many firms offer this as an affordable subscription service.
What Has Changed Since 2018
- Enforcement is real. The largest fine so far is €1.2 billion against Meta in 2023, for transferring EU user data to the US. Fines reached about €1.2 billion in 2025 alone (DLA Piper).
- The UK has its own rules. After Brexit, UK customers are covered by the UK GDPR, which was updated by the Data (Use and Access) Act 2025, with most changes in force from February 2026.
- US states have caught up. 23 states had enacted comprehensive consumer privacy laws as of June 2026. A GDPR-grade privacy program puts you in a strong position for those too.
- More changes are proposed. In November 2025 the European Commission proposed a “Digital Omnibus” package that would adjust parts of the GDPR and move cookie rules into it. Until it is adopted, the current rules apply in full.
Final Thoughts
GDPR compliance is less about one big project and more about good habits: know your data, explain it honestly, ask for real consent where you need it and pick vendors that take privacy seriously. Those same habits build customer trust in every market you sell to.
Your payment setup is a big part of that. If you want a processor that fits your ecommerce business and your compliance needs, talk to Motile’s payment team. You can also explore our payment processing solutions or browse more guides on the Motile blog.
Sources
Statistics and legal references in this guide come from the sources below. We review them regularly and update the page when newer data is published.
- DLA Piper, DLA Piper GDPR Fines and Data Breach Survey: January 2026 (January 2026).
- IAPP, Vermont becomes 23rd state to enact consumer privacy law (June 17, 2026).
- Data Protection Commission (Ireland), Data Protection Commission announces conclusion of inquiry into Meta Ireland (May 22, 2023).
- Court of Justice of the European Union, Press Release No 125/19: Storing cookies requires internet users’ active consent (Case C-673/17, Planet49) (October 1, 2019).
- legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (2026).
- European Commission, EU-US data transfers.
- intersoft consulting (gdpr-info.eu), Art. 3 GDPR: Territorial scope.
- intersoft consulting (gdpr-info.eu), Art. 6 GDPR: Lawfulness of processing.
- intersoft consulting (gdpr-info.eu), Art. 7 GDPR: Conditions for consent.
- intersoft consulting (gdpr-info.eu), Art. 27 GDPR: Representatives of controllers or processors not established in the Union.
- intersoft consulting (gdpr-info.eu), Art. 28 GDPR: Processor.
- intersoft consulting (gdpr-info.eu), Art. 30 GDPR: Records of processing activities.
- intersoft consulting (gdpr-info.eu), Art. 33 GDPR: Notification of a personal data breach to the supervisory authority.
- intersoft consulting (gdpr-info.eu), Art. 34 GDPR: Communication of a personal data breach to the data subject.
- intersoft consulting (gdpr-info.eu), Art. 37 GDPR: Designation of the data protection officer.
- intersoft consulting (gdpr-info.eu), Art. 83 GDPR: General conditions for imposing administrative fines.
- intersoft consulting (gdpr-info.eu), Art. 99 GDPR: Entry into force and application.
- intersoft consulting (gdpr-info.eu), Recital 32: Conditions for Consent.
