Magento 2 GDPR: Consent, Data Export & Erasure Done Right
GDPR for Magento 2: what a store actually has to do
Magento 2 is not GDPR-ready out of the box: the only native tooling is a basic cookie notice, with nothing for per-category consent, consent records, customer data export or erasure requests. For a shop, GDPR and UK GDPR obligations reduce to four practical capabilities — obtain valid consent for non-essential cookies and marketing, show customers the data you hold on them, delete or anonymise it when they ask (where no legal basis requires keeping it), and be able to evidence all of the above.
This guide covers what Magento gives you natively, the four capabilities in detail, how a data request should actually be handled, and where the honest limits of any extension sit.
What Magento gives you natively
Magento's built-in consent feature is Cookie Restriction Mode. Enable it under Stores → Configuration → General → Web → Default Cookie Settings, and the storefront shows a cookie notice and withholds Magento's own non-essential cookies until the visitor clicks Allow. The same section controls cookie lifetime.
That is where native support ends. Cookie Restriction Mode offers no per-category choices (analytics vs marketing vs functional), keeps no auditable log of who consented to what and when, and does nothing about the third-party tags — analytics, advertising pixels, chat widgets — that you or your agency have added, which are precisely the scripts consent rules exist for. And there is no native workflow at all for data access or erasure requests: no export, no anonymisation, no request queue.
The four capabilities you need
| Obligation | What it means in Magento |
|---|---|
| Cookie consent | A banner that blocks non-essential scripts until consent is given, with per-category choices — not just an "OK" notice |
| Right of access | Export everything held on a customer — account, addresses, orders, subscriptions — in a portable format |
| Right to erasure | Delete or anonymise the customer's personal data on request, without destroying the order records your accounts depend on |
| Evidence | A log of consents given and requests handled, so you can show what was agreed and when |
The erasure row deserves emphasis, because it is where naive implementations go wrong. Deleting a customer must not delete order history — you are required to retain transactional records for accounting and tax purposes, and GDPR explicitly allows retention where a legal obligation demands it. The correct mechanic is anonymisation: the personal fields (name, email, address, phone) are irreversibly replaced while the order rows, totals and tax records survive intact.
How a data request should be handled, step by step
- Verify the requester. Confirm the request genuinely comes from the account holder before releasing or destroying anything — sending a data export to an impersonator is itself a breach.
- Log the request on arrival. The clock starts when the request lands, and the log entry is your evidence of timely handling.
- Gather everything. Account details, addresses, order history, newsletter subscription state, stored quotes and any personal data captured through forms — not just the customer record.
- Act on it. For access, export in a portable format the customer can actually use. For erasure, anonymise the personal fields and note any data retained under a legal obligation, telling the customer what and why.
- Close it in the log. What was requested, what was done, when, and by whom — the evidence trail that turns "we take privacy seriously" into something you can demonstrate.
How GDPR Pro covers it
Our GDPR Pro for Magento 2 module implements the full loop: a configurable cookie-consent banner with per-category controls, customer-account tools for data export and erasure or anonymisation requests, an admin queue for reviewing and actioning those requests, and consent logging throughout. Erasure anonymises order data rather than deleting it, so your accounting stays intact while the personal data goes.
Consent state and settings are exposed for headless storefronts to honour, and the banner works natively on Luma-based themes — the same consent mechanics either way.
The honest limits of any GDPR extension
A module implements the mechanics. What goes in your privacy policy, how long you retain data, and which lawful bases you rely on are decisions only you can make — and if you are in doubt about them, they are questions for a professional, not a plugin. No extension makes a store "GDPR compliant" by itself, and any vendor claiming otherwise is overselling. What the tooling does is make the compliant behaviours — real consent, real exports, real anonymisation, real records — practical to operate day to day.
Two neighbouring surfaces deserve the same scrutiny while you are here. If customers can register via social login, the data received from Google or Facebook is personal data you hold and must cover in exports and erasure. And every custom form on the site is a collection point — each one should state its purpose and feed the same access and erasure workflow as account data.
FAQ
Is Magento 2 GDPR compliant out of the box?
No. Magento ships a basic cookie notice (Cookie Restriction Mode) but no per-category consent, no consent records, and no workflow for data export or erasure requests. Those capabilities need an extension or custom development, plus your own policy decisions.
Does GDPR erasure delete order history?
It should not. Personal fields are anonymised while order records survive for accounting and tax purposes — retention that GDPR explicitly permits where a legal obligation requires it. That is how GDPR Pro implements erasure.
Does Magento's built-in cookie notice satisfy GDPR?
On its own, generally not. It withholds Magento's own non-essential cookies until the visitor allows them, but it offers no per-category choices, keeps no consent log, and does not control third-party tags such as analytics or advertising pixels — the scripts consent rules are chiefly aimed at.
Does a GDPR cookie banner work on a headless storefront?
With GDPR Pro, yes — consent state and settings are exposed so a headless frontend can honour them, while the banner works natively on Luma-based themes. Built against Magento Open Source 2.4.9, running on PHP 8.4 and 8.5.
GDPR Pro is a one-off purchase — no subscription — and is included in the AgenticEcom Suite.