ONLINE SHOPS

POPIA for online shops: checkout, cookies and customer data

An online shop's customer information moves through checkout, payment services, fulfilment, support and marketing. Your privacy notice should reflect those real flows. Start with one test order and trace what each platform, plugin and service provider receives.

By POPIA Check · AI-assisted practical guidance · Editorial update 18 October 2026 · General information, not legal advice

Start free assessment View sample report

Follow an order through your store

Stage	What to examine	Evidence to gather
Browse and enquire	Tracking tools, form fields, collection notices and what loads before a visitor makes a choice.	Plugin inventory, form screenshots and browser network checks.
Checkout and payment	Which details are necessary and where payment and account information is handled.	Checkout configuration, processor information and access roles.
Fulfilment	What the courier, warehouse and staff can see and how it is transferred.	Recipient list, export process and supplier terms.
Support and returns	Who receives conversations and attachments and how identity is checked proportionately.	Helpdesk access list, request process and restricted evidence references.
Marketing and closure	How abandoned-cart campaigns, newsletters, retention and opt-outs are managed.	Permission review, suppression tests and retention decisions.

Eight practical checks for your shop

Create an inventory of the storefront, payment provider, courier, helpdesk, email platform, analytics and installed plugins.
Check that checkout and enquiry notices are easy to find and describe the actual collection and sharing.
Review required checkout fields. Challenge information collected simply because a plugin offers the field.
Inspect third-party activity before and after visitor choices. A banner's presence alone does not establish how tracking behaves.
Keep transactional order messages distinct from promotional campaigns. Review the relevant rules before using checkout details for marketing.
Test account permissions, staff access removal and restricted order exports. Confirm suppliers' security and incident routes.
Record retention rules for orders, invoices, support tickets and abandoned checkouts separately, with applicable obligations and holds.
Test an opt-out, a rights request and a suspected exposure using fictional details. Give failures an owner and a review date.

Worked example: an abandoned-cart campaign

A shop collects an email address during checkout and a plugin later sends promotional reminders. Before enabling the campaign, record its purpose, the list source and applicable direct marketing conditions. Check what the shopper was told, the relevant evidence and the ability to stop further messages. Test whether an unsubscribed address is reintroduced by a later sync. A useful change is supported by both a reviewed decision and a working suppression test.

Use the website check with realistic expectations

The website tool can inspect visible privacy, terms, cookie and PAIA material where discoverable, together with selected technical signals. It cannot complete a purchase, verify every plugin, audit payment handling or establish that a cookie choice prevents tracking. Use the report as a list of observations to discuss with a web partner, then arrange manual checks for the live behaviour.

What to prepare for a legal or website partner

For legal review: the processing inventory, collection notices, supplier terms, marketing permission evidence and proposed retention rules.
For website work: the scan report, affected page URLs, screenshots of the issue and the intended behaviour, with private information removed.
For both: a named owner, priority, expected outcome and a way to verify the change.
If an incident is active: use your urgent response route immediately. Do not wait for an ordinary 48-hour referral reply.

Start with one order, then widen the review

Use the toolkit to map an order and your providers. Run the free website check for public evidence, then complete the 40-question self-assessment for the organisational controls. Consumer, payment, tax and other obligations may need separate advice. These tools do not certify your shop or guarantee legal compliance.

Common questions

Is installing a cookie banner enough?

No. Check which tools load, what they do and whether choices and withdrawal work as intended. The banner text, underlying behaviour and applicable legal requirements need to be considered together.

Can we add every customer to our newsletter?

A purchase is not blanket permission for every campaign. Review the applicable direct marketing conditions, any relevant exception and its limits, and the opt-out evidence.

Does the scanner inspect checkout or the customer database?

It inspects discoverable public pages within its stated scope. It does not place an order, log in, read your customer database or perform a payment security audit.

Sources and further reading

Editorial guidance from POPIA Check, with links to primary sources. Ask your selected legal partner how the law applies to your organisation. These AI-assisted materials have not been presented as a legal partner’s reviewed advice.