David Vranicar | Ecommerce Tips & Tricks | 23 Apr, 2018

What Store Owners Can Do | Ecommerce store owners are busy enough as it is. SEO, social, design. You don’t need another to-do.  So we’ll apologize right away for adding one. It’s just that, well, GDPR compliance is too important to ignore.  This post will look at what GDPR says, what GDPR compliance means for you, and how you can use it to your advantage.

What is GDPR?

GDPR is short for General Data Protection Regulation. Adopted in April 2016, GDPR creates rules for how all European residents’ data must be managed. GDPR takes effect in May 2018 and will impact the handling of data pertaining to everything from medical history to financial records to internet activity.

In the process, GDPR will reshape what it means to do ecommerce in Europe, influencing how you engage with your customers, the tools you use, and how you use them.

GDPR is not a tech document. At all. In fact, ecommerce is only discussed once. And that’s in a footnote. And they call it “electronic commerce.” GDPR is less of a digital playbook than a statement on fundamental rights: “The processing of personal data should be designed to serve mankind.”

But there is still plenty for shop owners to be aware of. So let’s get familiar with GDPR.

Who Does GDPR Apply To?

Regardless of where you are based, GDPR applies to all companies that offer products or services to consumers in Europe.

“It doesn’t matter if the company is in Europe, outside of Europe, or on some island,” Dr. Christoph Bauer, CEO of ePrivacy, told Oberlo. “If the services are offered to European customers, they need to follow the law.”

So if your ecommerce shop is available in Europe, you probably have to comply with GDPR.

Just remember: GDPR compliance isn’t simply for European companies selling products to European customers. It covers any interaction with customers in Europe, period.

Of course, GDPR applies to more than just shop owners. GDPR compliance also applies to your favourite tools. Google, Facebook, MailChimp, and Shopify, to name a few, must also comply with GDPR. Later on we’ll look at how those tools and platforms are tackling GDPR compliance.

What’s up With GDPR for Small Businesses?

GDPR affects companies of all sizes. From one employee to 10,000 employees, if a company handles data about Europeans, then GDPR applies.  Most ecommerce stores are much closer to one employee than 10,000, so it’s important to understand how GDPR distinguishes between big companies and small ones.

Ecommerce stores owners should know that GDPR doesn’t treat them the same way it treats huge businesses. For example, certain record-keeping requirements in GDPR apply only to companies with more than 250 employees.

When you read advice like, “It is essential to plan your approach to GDPR compliance now and to gain ‘buy in’ from key people in your organization,” you can relax. If you’re an online store owner, then the “key people” and the “organization” are probably you. If that’s the case, GDPR is a bit simpler.

But! There are still plenty of GDPR requirements that apply to everyone, no matter what. Let’s dive in.

What Should Store Owners Do for GDPR Compliance?

GDPR is 88 pages and more than 50,000 words long, and the writing is as interesting as a long line at the post office. If you don’t want to read GDPR, you are forgiven.

But the rules laid out are applicable to all stores selling to consumers in Europe, and Europe accounts for about 25% of global GDP. So even if you can’t be bothered to read GDPR, there are some things to keep in mind about GDPR compliance.

Consent is king.

GDPR empowers Europeans to control exactly how their data is used. As a result, being GDPR compliant means you can’t assume what your users want.

For example, GDPR says, “Silence, pre-ticked boxes or inactivity should not constitute consent.” That means you should avoid stuff like this:

E-consultancy has a good post on what GDPR-compliant UX looks like when it comes to consent.

Only collect data that you need.

The heart of GDPR compliance is protecting people’s data. You can limit your exposure by not collecting data that you don’t need.

If there is no business value in knowing, say, what company your shopper works for, then GDPR gives you an incentive to not even ask.

If you use Shopify, you can adapt the questions you ask your visitors in the “Checkout” settings:

If you’re not going to use the information, then don’t ask for it. And if you are going to use it, be really clear about what you’ll use it for.

For example, sometimes you’ll see checkout pages that ask for a shopper’s phone number. Store owners need to ask themselves, “What am I going to use this person’s phone number for?”

There are definitely legitimate reasons to ask for a phone number. Could be for SMS campaigns, or as a safeguard against fraudulent orders. Shopify’s fraud detection mechanism flags orders if the shipping address and IP address are in different locations, and then uses the phone number to protect consumers and get confirmation. That is totally fine as far as GDPR compliance goes. Just make sure that you explain this stuff in the terms and conditions and privacy policy.

Make everything really clear.

Regulators in charge of GDPR compliance love transparency. You could put an “unsubscribe” link on your website next to “subscribe.” You could link directly to your terms and conditions from your footer. And your privacy policy.

Putting all of this stuff out in the open is one of the simplest ways to protect yourself from concerns about GDPR compliance. And if you have certified or verified processes, tell the world! This is how fashion giant Zalando does it:

Don’t do sneaky stuff.

For companies under 250 employees, so much of GDPR boils down to simply not being sneaky. If you are honest and transparent and implementing best practices, you won’t face the massive fines that come with GDPR.

In a blog post about GDPR, tech security provider Sophos put it this way:

Daunting as it all may seem, small businesses can take comfort in this: as long as they can demonstrate that they’ve put their best foot forward to meet the requirements of GDPR, regulators will work with them on any problems that might arise.

Which means…

Keep selling in Europe!

The European Union is not trying to shut down online stores. In fact, between the “Digital Single Market” and tens of billions pumped into broadband networks, the EU has been kind of obsessed with creating a more robust digital economy.

Plus regulators understand that some data storage is vital to keep the digital economy running.

So, even if GDPR seems a bit old school, it’s not part of a coordinated effort to sink ecommerce. Which means you can sell in Europe all you want!

Are There Benefits to GDPR Compliance for Ecommerce Shops?

Big time. GDPR isn’t just rules and headaches. It’s a huge opportunity: European customers will like you more if you are GDPR compliant.

No doubt, data privacy is a big deal in Europe. And you can see topics related to GDPR compliance pop up all over the web. In fact, European companies from every sector use data protection and data privacy as a selling point, and store owners can do the same.

Here, for example, is the home page of the German supermarket chain Edeka. When you arrive, you get a heads up that they use cookies, as well as a link to a “Privacy Policy” page (“Datenschutzhinweisen”).

This data privacy stuff is way bigger than the Edeka logo. It’s front and centre and huge:

Interested customers can also find a massive cookies section in the imprint, as well as yet another link to the data privacy section. Topics surrounding GDPR compliance are planted all over the website.

And this isn’t a financial institution or government body. It’s a supermarket.

This isn’t just a German thing. The French entertainment website tf1.fr has a floating banner about cookies — right below its dedicated “privacy policy” and “cookies” sections:

 

 

The Dutch might take the cake. Or take the cookie, as it were. Just look at this massive cookie notice that every visitor sees upon arrival at the popular site Marktplaats:

Meanwhile, top Dutch news site Telegraaf has no fewer than three data privacy-related sections in its footer:

Simply put, data privacy and data protection are huge topics in Europe. Sure, some countries require websites to give details about cookies and data protection. But these websites don’t just give details. They show it off. It’s marketing!

European consumers want to feel comfortable about GDPR compliance issues before making a purchase or engaging with a brand. That’s why websites ranging from supermarkets to news outlets make such a big deal about GDPR-related topics like cookies and data privacy.

You can leverage these attitudes to grow your ecommerce business. Let people know that you are GDPR compliant. Make GDPR compliance part of your Terms and Conditions page. Put it in the footer of your emails. Every little advantage helps.

If you’re GDPR compliant and your competitor isn’t — or even if both of you are GDPR compliant but you’re the only one who brags about it — then that might be a big selling point in the European market.

What About GDPR and Marketing?

Let’s say you do everything in your power to be GDPR compliant. You remove those pre-ticked boxes, you only collect vital data, your policies are clearly explained. Awesome.

There’s still the issue of your tools: Are they GDPR compliant?

After all, store owners typically use a handful of platforms and solutions to optimize their marketing, analytics, social, email, and so on. What’s more, most of those ecommerce tools are based outside of Europe — Google Analytics, Google AdWords, Facebook, MailChimp, and a whole lot more.

Can a store owner be GDPR compliant and still use these tools? Let’s take a look.

What About Google and GDPR?

Chances are that you interact with Google’s suite of products on a daily basis. Google Analytics is the world’s most used analytics solution, and Google AdWords is No. 1 in search marketing. You might even run your email with Google.

Store owners know Google. Does Google know GDPR?

Absolutely. In fact, Google has gone out of its way to reassure ecommerce store owners that it will be completely GDPR compliant by May 2018. As Google put it:

We are working hard to prepare for the EU’s General Data Protection Regulation (GDPR)…. We are committed to complying with the new legislation and will collaborate with partners throughout this process.

Google AdWords updated its terms and conditions in August 2017, unveiling data protection measures “related to the EU General Data Protection Regulation.”

Google also announced recently that it would stop scanning emails to deliver personalized ads and services. PageFair, a British group specializing in digital advertising, speculates that GDPR compliance “may be the real reason, or at least a contributing reason, why Google announced that it will stop mining people’s emails for ads.”

At Google’s dedicated URL for GDPR compliance — google.com/cloud/security/gdpr— you can find what amounts to a promise from Google about GDPR compliance and Google Cloud:

You can count on the fact that Google is committed to GDPR compliance across Google Cloud services. We are also committed to helping our customers with their GDPR compliance journey by providing robust privacy and security protections built into our services and contracts over the years.

In short, Google plans to be ready.

What About MailChimp and GDPR?

MailChimp, the world’s leading email tool for small businesses, has made repeated references to GDPR compliance.

For example, in October, MailChimp announced that it would get rid of its double opt-in requirement. However, they are keeping double opt-in as the default setting in Europe. Why? As MailChimp put it in a blog post,

We made this decision after receiving a lot of feedback from EU customers who told us that single opt-in does not align with their business needs in light of the upcoming GDPR and other local requirements.

So yeah, MailChimp has heard of GDPR. In fact, MailChimp published a 26,000-word PDF explainer called, GDPR: What it is, what we are doing, and what you can do.

Like Google, MailChimp is heavily invested in GDPR compliance.

What About Shopify and GDPR?

If your shop runs on Shopify, don’t worry. Shopify is a thoroughly global company. Its founder and CEO is from Germany; the company is based in Canada; they are currently hiring in San Francisco and Ireland; their users are scattered around the globe.

Shopify now even has a section in its user manual specifically tackling GDPR topics:

Shopify has dealt with international regulations since its inception, which is why the company can say, “Shopify expects to be GDPR compliant when it takes effect on May 25, 2018.”

What About Facebook and GDPR Compliance?

Facebook has definitely had its legal issues in Europe. The company was fined €110 million in May 2017 for linking user accounts and user data between Facebook and Facebook-owned messaging app WhatsApp. That is exactly the type of data privacy issue that GDPR addresses.

But even if Facebook has a history with European regulators, they know GDPR compliance is a requirement. And they want every shop owner who uses their marketing tools — Facebook Custom Audiences, Facebook Connect, Facebook Beacon, and so on — to keep on using them.

In August 2017, a Facebook spokesperson told The Financial Times,

We have now assembled the largest cross-functional team in the history of the Facebook family of companies. Dozens of people at Facebook Ireland are working full time on this [GDPR] effort.

The article goes on to say that Facebook Ireland’s data protection team will swell 250 percent this year to support efforts surrounding GDPR compliance.

Conclusions on GDPR Compliance for Store Owners

So what does all that mean for GDPR and your online store? Here is the tl;dr version:

• GDPR affects businesses that interact with consumers in Europe — or that mightinteract with Europeans — no matter where those companies are located.
• GDPR compliance is a bit simpler for small companies. Which means GDPR compliance is different for your ecommerce business than it is for a massive company.
• You can help your store with GDPR compliance by making sure your terms and conditions are clear; removing pre-ticked boxes; and generally respecting the privacy of your customers and potential customers.
• Your ecommerce business can take advantage of GDPR. Data privacy is a huge deal in Europe, so if you take steps toward GDPR compliance, you can let all your European shoppers know about it.
• The marketing tools and channels that you use in your online store will need to be GDPR compliant by the time GDPR takes effect in May 2018. You need to keep an eye on this, and contact them directly if you have questions. But GDPR is not a secret to anyone.

Resources

There are some great resources available for people wondering how GDPR impacts their online shop or dropshipping business. Here are a few goodies.

MailChimp’s explainer on General Data Protection Regulation

ePrivacy’s overview page, which includes a webinar, white paper, “quick check” and more

Econsultancy’s post, GDPR: 10 examples of best practice for obtaining marketing consent

The GDPR section of Microsoft’s “Trust Center”

The General Data Protection Regulation section of the Shopify manual

Boxcryptor’s overview of GDPR apps

And if you’re feeling brave, the actual text of the General Data Protection Regulation

This guide is for informational purposes only. By providing this guide, we are not acting as your lawyer or providing legal advice, and we are not responsible for how you use it. By using this guide, you agree to this disclaimer.

 

David Vranicar

David Vranicar is a Content Marketer for Oberlo. He wants to give store owners the tools they need to go from first sale to scale. Follow David on Twitter at @davidvranicar.

Article, Images & Content via Oberlo.com