PrestaShop is one of the most widely used open-source e-commerce platforms in Europe. But installing PrestaShop does not make your store GDPR-compliant. As the merchant, you are the data controller; your host and each module act as processors. Fines can reach €20 million or 4% of global annual turnover.
Start by scanning your store for free with our GDPR scanner to identify what needs fixing.
What PrestaShop does (and does not do)
PrestaShop ships an official GDPR module that helps with access and deletion requests, plus basic cookie settings. It does not make your store compliant on its own: PrestaShop writes neither your privacy policy, cookie policy, terms of use and terms of sale, nor does it provide a compliant cookie banner or Google Consent Mode v2. The Data Processing Agreement (Article 28) comes from your host and each module.
The 5 GDPR obligations for your PrestaShop store
- A complete privacy policy (Art. 13/14): controller, purposes, legal bases, recipients (host and all modules), retention periods.
- A compliant cookie banner: refusing as easy as accepting, no trackers before consent, with Consent Mode v2 for GA4/Ads. You can install our free GDPR cookie banner.
- Map your modules as processors: shipping, payment, email, reviews, analytics — every module handling customer data.
- A legal notice / imprint identifying the operator.
- Terms of sale with the right of withdrawal (14 days), legal guarantees and delivery terms.
Common mistakes
- Believing the GDPR module is enough — it replaces neither your legal documents nor a compliant banner.
- Installing Google Analytics without Consent Mode v2 (trackers before consent).
- Installing modules and forgetting them — each increases your attack surface.
- Ignoring non-EU transfers: many modules rely on US providers — check the Data Privacy Framework or standard contractual clauses (Schrems II).
How to make your PrestaShop store compliant
Four routes: a lawyer (€500–2,000, costly/slow), free templates (generic, risky), a generic AI like ChatGPT (missing clauses, inconsistencies), or a specialised legal generator (€19.90–€49.90): the WebLegal legal document generator produces your privacy policy, cookie policy, terms of use and terms of sale in under 10 minutes, consistent and tailored to your store.
Conclusion
Using PrestaShop does not exempt you from your GDPR obligations. The official module helps, but your privacy policy, cookie banner, legal documents and legal notice remain your responsibility — and no tracker may load before consent. Generate your compliant documents for PrestaShop.
