Terms, privacy and cookies in a shop

Module 5: Obligations and terms · Reading time: 11 minutes

Learning objective: After this lesson you can offer terms and conditions so that they apply, add the processing that comes with selling to a shop's privacy statement, judge which cookies a shop may set without consent, and decide neutrally whether a trust mark suits you.

Key concepts: terms and conditions, providing the terms, making the terms available electronically, consent checkbox, privacy statement, processor, data processing agreement, retention period, functional cookies, tracking cookies, order attribution, consent, trust mark, disputes committee, ODR platform

This lesson explains the rules as they apply on 9 November 2026. It is not legal or tax advice. If you are unsure about your situation, ask a lawyer, your trade association or your accountant.

Terms and conditions: having them is not enough

Terms and conditions are the standard arrangements you use for every order: delivery, payment, warranty, liability, complaints. They are not mandatory, but almost every shop has them. The pitfall: terms the customer could not read in time may not apply.

In the Netherlands, article 6:234 of the Dutch Civil Code (BW) says you must give the terms to the customer before or when the contract is concluded. Online you may do that electronically, as long as the customer can save them and read them again later. If you don't, the customer can have the clauses annulled. In practice:

• a link to the terms close to the order button, with a checkbox that starts unticked ("I have read the terms and conditions");
• the terms as a PDF or text in or with the confirmation email, so the customer has them;
• a fixed page that is always reachable, for example via the footer.

Germany has a similar rule (the customer must be able to take note of the "Allgemeine Geschäftsbedingungen", AGB, in a reasonable way). In Belgium the terms apply if the customer could know them before the contract was concluded and has accepted them. The idea is the same everywhere: show them in time and let the customer keep them.

What must not be in them is at least as important. Terms may not restrict a consumer's statutory rights. "Returns only in the original, unopened packaging" or "no withdrawal for items on sale" conflicts with the right of withdrawal (lesson 5.2). A clause that only appears in your terms never replaces the mandatory information either (lessons 5.1 and 5.4). Trade associations and trust marks often have model terms; that is a safer start than writing your own or copying another shop's text (the latter is also not acceptable under copyright).

Privacy: what a shop processes on top

The basics of the GDPR for a website (personal data, legal basis, privacy statement, forms, processors) are in the WordPress course, lesson 9.3. A shop processes more, and involves more parties:

What you do with this:

1. Mention every processing in your privacy statement, with purpose, legal basis, retention period and recipients. WordPress has a helper template under Settings > Privacy; WooCommerce adds its own text suggestions for the shop. Use them as a start, not as the final text.
2. Conclude data processing agreements with parties that process data on your behalf (hosting provider, mailing service, accounting software). For payment providers and carriers the role differs per party; read what they say themselves.
3. Set retention periods under WooCommerce > Settings > Accounts Privacy (lesson 2.3): inactive accounts are deleted after a period, unpaid, failed and cancelled orders go to the bin, and the personal data of refunded and completed orders are anonymised. Keep the tax retention obligation in mind (lesson 5.6): keep invoice details in your bookkeeping if you remove them from the shop.
4. Know what to do in case of a data breach (KB 6749 and the Safe online course). A hacked shop with customer data almost always has to be reported.

Cookies in a shop

The rules for cookies themselves (in the Netherlands the Telecommunications Act (Telecommunicatiewet), in the EU the ePrivacy Directive) are also in the WordPress course, lesson 9.3. The rule of thumb: functional cookies, needed for the service the visitor asks for, are allowed without consent. For tracking and most statistics you need consent in advance.

For a shop that means:

• Functional: the WooCommerce cookies for the cart and the session (woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_...) and your payment provider's cookies during payment. These are allowed and belong in your cookie statement.
• Order attribution: WooCommerce has a feature that records through which channel an order came in (search engine, campaign, email). It uses cookies starting with sbjs_, by default only for the duration of the visit. Whether you need consent for it depends on how you use the data; it is measuring, not needed for the order. You can switch the feature off under WooCommerce > Settings > Advanced > Features. Find out what applies to you and put it in your cookie statement.
• Tracking and advertising: social media pixels, advertising networks and statistics that share data with third parties. Load them only after consent. A cookie banner that already loads everything before the visitor chooses does not comply.

Pitfall: a big green "Accept" button next to a "Deny" you have to search for. Regulators require that refusing is as easy as accepting.

Trust marks and disputes

A trust mark is a voluntary arrangement with an organisation that checks your shop, gives you model terms and often offers a dispute resolution scheme. Examples: Thuiswinkel Waarborg in the Netherlands, BeCommerce in Belgium, Trusted Shops in Germany; there are more. They differ in requirements, checks and costs. A trust mark is not mandatory and does not replace the law; it can build trust and helps you keep up with the rules. Compare them on what they check, what they ask of you and which dispute resolution scheme comes with them.

One more current point about disputes: until 2025, web shops had to link to the European ODR platform for online dispute resolution. That platform closed on 20 July 2025 (Regulation (EU) 2024/3228) and the obligation to link to it has lapsed. If the link is still in your terms or footer, remove it; it points to something that no longer exists. The European Commission now refers to a list of dispute resolution bodies per country.

In practice: this is how it looks in WooCommerce

At Theehuis Example:

1. Pages Terms and Conditions and Privacy statement; under WooCommerce > Settings > Advanced > Page setup the terms page is selected (consent checkbox at checkout) and under Settings > Privacy the privacy page.
2. Under Accounts Privacy: the privacy text WooCommerce shows at registration and checkout refers to the privacy statement.
3. A cookie banner that loads tracking only after consent; tested in a private window with the developer tools (Network and Storage tabs): no requests to advertising or statistics services before the choice.
4. Terms as a PDF with the confirmation email (using an extension) or a link in the additional content of the email.

Summary

• Terms and conditions only apply if you make them available electronically before or when the contract is concluded, so the customer can keep them (NL article 6:234 BW); they may not restrict consumer rights.
• A shop processes more personal data than an ordinary site; put every processing with legal basis, retention period and recipients in your privacy statement and set retention periods in WooCommerce.
• Cart and session cookies are functional; tracking and advertising only after consent; switch order attribution on or off deliberately.
• Trust marks are voluntary; compare them neutrally. The mandatory link to the ODR platform has lapsed since 20 July 2025.

Quiz

Exercise

Exercise A5.5: Terms, privacy and cookies. Enter your shop's address. The program requests the homepage without cookies, like a new visitor who has not chosen anything yet, and records only the names of the cookies the site sets. It looks for a link to your terms and conditions and a link to your privacy statement (also in German, English and French) and requests both pages. Green if both links are there and the pages return 200, there are no known statistics or advertising scripts in the HTML, and no statistics or advertising cookies (such as _ga, _fbp) are set before the visitor chooses. Orange if such a script is already in the HTML ("does it load only after consent?"), if order attribution cookies (sbjs_) are set (info), or if there is still a link to the ODR platform. Red if one of the two links is missing, a page cannot be reached, or tracking or advertising cookies are set without a choice. The program only sees the HTML without JavaScript; check scripts that load other scripts later yourself with your browser's Network tab.

A question for yourself (not checked): which processing activities from the table in this lesson are not yet in your privacy statement?

Further reading

• Free WordPress course 9.3: GDPR: cookies, forms and Privacy Policy
• Cookies (Dutch Data Protection Authority, Autoriteit Persoonsgegevens, Dutch): https://autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies
• Is this a data breach, and do I need to report it?
• Dutch Civil Code Book 6, article 6:234 (wetten.overheid.nl, Dutch): https://wetten.overheid.nl/BWBR0005289/
• Closure of the ODR platform and dispute resolution bodies per country (European Commission): https://consumer-redress.ec.europa.eu/site-relocation_en
• Thuiswinkel.org (Thuiswinkel Waarborg trust mark, Dutch): https://www.thuiswinkel.org/