Cookies and privacy on a SaaS e-commerce: what you control and what you don't

Honest disclaimer: I'm not a lawyer and this isn't legal advice. I'm the developer who has to make the things the lawyer wrote actually work. Right now I'm doing it for EcoToGo, on TeamSystem Commerce: first an analysis of what was there, now the fixes one by one. What follows is the method, not the advice.

The rules that actually matter

In Italy the basis is the GDPR plus the Italian DPA's cookie guidelines of June 2021, in force since January 2022. Translated into requirements a site has to meet: non-technical cookies (non-anonymized analytics, marketing, social pixels) fire only after consent; the banner needs a way to refuse that's equivalent to accepting; scrolling and "by continuing to browse" don't count as consent; boxes can't be pre-ticked; consent has to be recorded and the choice shouldn't be asked again for six months, unless something changes.

Looks like a simple list. The problem is that almost every e-commerce I've opened violates at least two of them without knowing, usually because a pixel was pasted into the theme three years ago and nobody remembers.

The checklist I use

• –A real inventory of scripts: I open the site with dev tools, in a private window, and note everything that fires before clicking anything. Not what the policy says fires.
• –Banner: one-click refusal, no pre-ticked boxes, preferences reopenable from a fixed link in the footer.
• –Prior blocking: every non-technical tag has to wait for consent. If the platform doesn't allow that at theme level, you go through a tag manager or remove the tag.
• –Forms: the marketing checkbox separate from the order one, never mandatory, with the privacy link right next to it.
• –A policy consistent with the actual vendors: logistics, payments, newsletter, hosting. If the policy lists a vendor you no longer use, or misses one, it gets rewritten.
• –Consent log: someone has to be able to prove that user accepted, when and what.

Where the platform decides for you

On a SaaS you don't hold the server. Session and cart technical cookies are set by the platform, and that's fine, but you can't change their name or duration. The checkout is a closed box: if it loads something inside, the vendor decides. Some native integrations (payments, reviews, chat) bring their own scripts and have to be checked one by one, because being "official" doesn't make them technical.

So part of the job is figuring out how far you can go. You document what's under your control and what isn't, fix the first group, and for the second you ask the vendor or accept the risk knowing what it is. Making a site "as compliant as possible" is an honest phrase; "100% compliant" on a platform you don't run is a promise I wouldn't make.

If you run an online shop and don't know what fires before consent, write to me: the first analysis is a few hours' work, and it tells you exactly where you stand.