Pitfall 1: No Separate DPA with Payment Processor
The mistake: WooCommerce operators often assume the payment gateway (Stripe, PayPal, Square) automatically handles GDPR compliance. They add WooCommerce and a payment plugin, but never sign or review a Data Processing Agreement with the processor.
Why it happens with WooCommerce: Payment gateways are add-on plugins; operators treat them as "included" rather than third-party processors requiring formal contracts under GDPR Article 28. The payment processor becomes a Data Processor on your behalf, and you are jointly liable if a DPA is missing.
Consequence: GDPR fines up to €10 million or 2% of annual turnover (Article 83). Regulators (e.g., ICO, CNIL) consistently cite missing DPAs as a top violation. In practice: payment processor may suspend your account if you cannot produce a signed DPA during an audit.
---
Pitfall 2: Retaining Customer Data Indefinitely
The mistake: WooCommerce stores all orders, customer email addresses, and billing info in the WordPress database by default. Operators often do not set or document a data retention policy, leaving records in the database for years after the customer relationship ends.
Why it happens with WooCommerce: There is no built-in, user-friendly data deletion tool in WooCommerce's core. Operators assume "more data is safer" or forget to implement a retention schedule.
Consequence: GDPR Article 17 grants customers a right to erasure ("right to be forgotten"). If a customer requests deletion and you cannot comply, you face regulatory action. Additionally, GDPR Article 5(1)(e) requires data to be kept "no longer than necessary." Retaining customer data for 7+ years without a documented business reason violates this principle. Fines: €10 million or 2% of turnover (Article 83).
---
Pitfall 3: Misconfigured Consent Banner or Missing Cookie Disclosures
The mistake: Operators install a cookie consent plugin but either:
1. Pre-tick "Accept All" or hide the reject button (non-compliant with GDPR Article 7 and ePrivacy Directive Article 5(3)).
2. Fail to disclose WooCommerce's strictly necessary cookies separately, lumping them with marketing cookies.
3. Forget to link to the payment processor's cookie policy.
Why it happens with WooCommerce: The plugin ecosystem is fragmented. Consent banners (Cookiebot, OneTrust, etc.) are optional add-ons, so operators may use a generic banner not tuned to WooCommerce's specific cookies.
Consequence: GDPR enforcement. The ePrivacy Directive Article 5(3) requires informed, granular consent. If a customer cannot easily reject non-essential cookies, you are non-compliant. EDPB Guidelines 05/2020 on consent clarify: pre-ticking boxes or hiding opt-out is illegal. Regulators view this as a top-priority violation. Fines: up to €10 million or 2% of turnover.
