# Pandectes: reference pages in full > Pandectes GDPR Compliance is a Shopify app for privacy-law compliance: a customizable consent banner, cookie scanning and declarations, automatic blocking of trackers until consent, customer data requests, Google Consent Mode v2 and IAB TCF v2.4. Pandectes is a Google-certified CMP and covers GDPR, CCPA/CPRA, LGPD, PIPEDA and the US state privacy laws. ## Product features Source: https://pandectes.io/features/auto-blocking-technology/ ### Auto-Blocking Technology Our application can automatically detect and prevent specific tracking technologies until visitors give their consent, without the need for additional coding or integrations. #### How it works ##### Scan your Store Scan your store against a large database of pre-categorized cookies and trackers to automate the identification and categorization of cookies on your store. ##### Review Cookies & Rules Review your scan results and categorize any unclassified cookie or other tracking technology record. Also, you can check custom rules for these services. ##### Enable Auto-blocker Enable auto-blocker in order to have all the selected technologies to be blocked before they fire any cookie. [Start for free](https://pandectes.io/pricing/) #### Auto-Blocker Guide #### Auto-blocker Features ##### Block any non strictly required service before consent - Automatically scan and block third-party scripts (such as Google Analytics, Facebook Pixel) until the user gives consent. - Use custom rules to configure script tags, iframes & pixels. - We provide a wide list of the most popular services that are detected automatically. #### Why Choose Pandectes GDPR Compliance? ##### Most popular Shopify's most popular and widely used GDPR app on the app store with thousands of happy stores and hundreds of positive reviews. ##### Flexible & Modular From small to large stores with millions of visitors per day Pandectes solution can serve visitors without any affect on stores performance. ##### Regulations Coverage Pandectes GDPR Compliance covers the most popular data privacy laws and regulations around the world including GDPR, CCPA, VCDPA, LGPD, PIPEDA, PDPA & APPI ##### Banner Modes Pandectes GDPR Compliance app provides different banner modes depending your needs. ##### Cookie Dictionary Cookie dictionary maintains a global cookie database. Each cookie is compared with the database for auto-categorization and information. ##### Consent Records Provides an audit trail of detailed consent records, easily downloadable to demonstrate compliance. ##### Multilingual Pandectes GDPR Compliance app supports more than 130 languages. It also offers Google Translate integration. ##### Insights & Reports Consent tracking, customer data requests, scan results are the main reports and insights to monitor your compliance in the best way. ##### 24/7 Support Our team of experts are always available to give you the best support with 24/7 coverage over chat and email. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/auto-blocking-technology&utm_id=pandectes) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- Source: https://pandectes.io/features/consent-banner/ ### Consent Banner A cookie consent banner is a pop-up message that appears on a Shopify Store when a user first visits, informing them about the use of cookies, tracking technologies, and the store's privacy policy. The banner will also include buttons, allowing users to choose whether or not to provide consent. **Independently audited.** The Pandectes cookie banner was audited by an external testing company against WCAG 2.2 Level AA, Section 508 and EN 301 549, with every criterion rated Supports or Not Applicable. [See the audit details](https://pandectes.io/accessibility-conformance/). #### How it works ##### Install the app Install our application to your store. The process just takes you some seconds and is ready to be used. ##### Select a banner type Select between many different banners depending your preferences. ##### Enable Banner Enable the banner, and it will be visible to your store. [Start for free](https://pandectes.io/pricing/) #### Supported Banners ##### Informative Notice-only banner. All cookies allowed at all times. ##### Decline Only Opt-out banner. All cookies allowed initially. ##### Accept Only Opt-in banner. Only strictly necessary cookies allowed initially. ##### Accept/Decline Opt-both banner. Only strictly necessary cookies allowed initially. ##### Strict with Preferences Custom banner with categorized cookies & preferences. Only strictly necessary cookies and script tags are allowed by default. The rest of the checkboxes start unchecked. ##### Loose with Preferences Custom banner with categorized cookies & preferences. All cookies and script tags are allowed by default. All checkboxes are checked by default. #### Consent Banner Features ##### Show the banner in some regions & countries - Collect valid consent from users by displaying a compliant cookie consent banner. - Customize the banner layout, colour, content, behaviour, branding and add CSS customization to match your Store's design. - Display category description, cookie declaration table and link cookie/privacy policy for informed consent. - Enable the ‘Reopen’ button and let users preview or withdraw their consent whenever they want. - Auto-translate the banner in many languages as per the user’s browser language or other detection methods. #### Why Choose Pandectes GDPR Compliance? ##### Most popular Shopify's most popular and widely used GDPR app on the app store with thousands of happy stores and hundreds of positive reviews. ##### Flexible & Modular From small to large stores with millions of visitors per day Pandectes solution can serve visitors without any affect on stores performance. ##### Regulations Coverage Pandectes GDPR Compliance covers the most popular data privacy laws and regulations around the world including GDPR, CCPA, VCDPA, LGPD, PIPEDA, PDPA & APPI ##### Banner Modes Pandectes GDPR Compliance app provides different banner modes depending your needs. ##### Cookie Dictionary Cookie dictionary maintains a global cookie database. Each cookie is compared with the database for auto-categorization and information. ##### Consent Records Provides an audit trail of detailed consent records, easily downloadable to demonstrate compliance. ##### Multilingual Pandectes GDPR Compliance app supports more than 130 languages. It also offers Google Translate integration. ##### Insights & Reports Consent tracking, customer data requests, scan results are the main reports and insights to monitor your compliance in the best way. ##### 24/7 Support Our team of experts are always available to give you the best support with 24/7 coverage over chat and email. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/consent-banner&utm_id=pandectes) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- Source: https://pandectes.io/features/consent-tracking/ ### Consent Tracking When a customer gives you consent, it is crucial to record it as an occurrence. This is significant because if the legal basis for handling the customer’s information is their consent, you may be requested to provide evidence of consent if the customer files a complaint with their regional data protection authority. #### How it works ##### Visitor Checks Banner A visitor that comes first time to your store will see a consent banner in your store. ##### Visitor Interacts After the visitor sees the banner will make a decision to accept or to decline the tracking. ##### Consent Stored The final decision of the visitor is saved both in the app backend and on the browser of the visitor. [Start for free](https://pandectes.io/pricing/) #### Consent Tracking Features ##### Track Users Consent - Record and store users’ cookie consent for proof of compliance. - Build a detailed trail of consent with the anonymised IP address, country, consent status, date and time of consent. - Monitor the consent ratio of your website easily on the visual dashboard. - Export the consent records whenever required and store your cookie consent log locally. #### Why Choose Pandectes GDPR Compliance? ##### Most popular Shopify's most popular and widely used GDPR app on the app store with thousands of happy stores and hundreds of positive reviews. ##### Flexible & Modular From small to large stores with millions of visitors per day Pandectes solution can serve visitors without any affect on stores performance. ##### Regulations Coverage Pandectes GDPR Compliance covers the most popular data privacy laws and regulations around the world including GDPR, CCPA, VCDPA, LGPD, PIPEDA, PDPA & APPI ##### Banner Modes Pandectes GDPR Compliance app provides different banner modes depending your needs. ##### Cookie Dictionary Cookie dictionary maintains a global cookie database. Each cookie is compared with the database for auto-categorization and information. ##### Consent Records Provides an audit trail of detailed consent records, easily downloadable to demonstrate compliance. ##### Multilingual Pandectes GDPR Compliance app supports more than 130 languages. It also offers Google Translate integration. ##### Insights & Reports Consent tracking, customer data requests, scan results are the main reports and insights to monitor your compliance in the best way. ##### 24/7 Support Our team of experts are always available to give you the best support with 24/7 coverage over chat and email. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/consent-tracking&utm_id=pandectes) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- Source: https://pandectes.io/features/cookie-scan-declaration/ ### Cookie Scan & Declaration Scan your store for cookies & other tracking technologies, such as local storage and pixels. Our scanner automatically detects and categorizes them. All the detected results are available with their purpose description based on our database records. #### How it works ##### Install the app Install our application to your store. The process just takes you some seconds and is ready to be used. ##### Initiate Scan After successful install an initial scan will be performed. The scan takes just some seconds. ##### View Report After the scan is completed you can see a notification with a link to the scan report. ##### Add Declaration Add your cookies and other technologies declaration to your cookie or privacy policy page. [Start for free](https://pandectes.io/pricing/) #### How to add a Cookie Declaration Page #### Supported Tracking Technologies ##### Cookies Cookies are small text files that are stored on a user's device by a website. They are used to store information about the user's preferences, browsing history, and login information, which the website can then access when the user visits again. Cookies are commonly used for tracking technology as they allow websites to keep track of a user's behavior across multiple visits and to personalize the content or advertising that they see. ##### Local Storage Local storage is a feature of web browsers that allows websites to store data on a user's device, such as their preferences or login information. This data is saved on the user's device and can be accessed by the website even after the user has closed their browser or turned off their device. Local storage can be used for tracking technology by allowing websites to track a user's behavior even if they don't have cookies enabled or if they have cleared their cookies. ##### Pixels Pixels are small, transparent images that are embedded on websites. They can be used for tracking technology by collecting information about website visitors, such as the pages they have visited, the actions they have taken on the website, and the device they are using. This information can then be used to track the visitor's behavior across multiple visits and to target them with personalized advertising or content. #### Store Scanning Features ##### Scan your Shopify store and obtain insight into the privacy status of it - Discover cookies, local storage & pixels - Results are checked against our database - Curated cookies are available to multiple languages - Scan your store again and check differences - Follow app's recommendations #### Why Choose Pandectes GDPR Compliance? ##### Most popular Shopify's most popular and widely used GDPR app on the app store with thousands of happy stores and hundreds of positive reviews. ##### Flexible & Modular From small to large stores with millions of visitors per day Pandectes solution can serve visitors without any affect on stores performance. ##### Regulations Coverage Pandectes GDPR Compliance covers the most popular data privacy laws and regulations around the world including GDPR, CCPA, VCDPA, LGPD, PIPEDA, PDPA & APPI ##### Banner Modes Pandectes GDPR Compliance app provides different banner modes depending your needs. ##### Cookie Dictionary Cookie dictionary maintains a global cookie database. Each cookie is compared with the database for auto-categorization and information. ##### Consent Records Provides an audit trail of detailed consent records, easily downloadable to demonstrate compliance. ##### Multilingual Pandectes GDPR Compliance app supports more than 130 languages. It also offers Google Translate integration. ##### Insights & Reports Consent tracking, customer data requests, scan results are the main reports and insights to monitor your compliance in the best way. ##### 24/7 Support Our team of experts are always available to give you the best support with 24/7 coverage over chat and email. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/cookie-scan-declaration&utm_id=pandectes) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- Source: https://pandectes.io/features/customer-data-requests/ ### Customer Data Requests Meeting a Data Subject Request (DSR) is a complex process that includes secure and timely verification of the requester’s identity, searching through large datasets to retrieve their personal information, and linking it back to the individual who made the request. Our application takes care of this. New to data requests? Read [how to handle GDPR data requests on Shopify](https://pandectes.io/blog/shopify-gdpr-data-requests/), step by step, from exporting a customer's data to erasing it. #### How it works ##### Customer Makes a Request A customer can access your data request pages that you can create with our application and make a request. ##### Request Verification The customer receives an email to verify the requests. After that, the application notifies the customer and the merchant about the request. ##### Merchant Fulfils Request Merchant checks the pending requests and proceeds to fulfill them. Then the customer is notified with an email. [Start for free](https://pandectes.io/pricing/) #### Customer Data Requests Features ##### Be compliant by fulfilling DSRs - Supports registered & guest customers - Customized requests content - Automated verification of requests - Custom styling to requests page #### Why Choose Pandectes GDPR Compliance? ##### Most popular Shopify's most popular and widely used GDPR app on the app store with thousands of happy stores and hundreds of positive reviews. ##### Flexible & Modular From small to large stores with millions of visitors per day Pandectes solution can serve visitors without any affect on stores performance. ##### Regulations Coverage Pandectes GDPR Compliance covers the most popular data privacy laws and regulations around the world including GDPR, CCPA, VCDPA, LGPD, PIPEDA, PDPA & APPI ##### Banner Modes Pandectes GDPR Compliance app provides different banner modes depending your needs. ##### Cookie Dictionary Cookie dictionary maintains a global cookie database. Each cookie is compared with the database for auto-categorization and information. ##### Consent Records Provides an audit trail of detailed consent records, easily downloadable to demonstrate compliance. ##### Multilingual Pandectes GDPR Compliance app supports more than 130 languages. It also offers Google Translate integration. ##### Insights & Reports Consent tracking, customer data requests, scan results are the main reports and insights to monitor your compliance in the best way. ##### 24/7 Support Our team of experts are always available to give you the best support with 24/7 coverage over chat and email. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/customer-data-requests&utm_id=pandectes) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- Source: https://pandectes.io/features/eu-withdrawal/ ### EU Withdrawal Button Under Directive (EU) 2023/2673, every online store selling to consumers in the EU must let them withdraw from a purchase through a clearly labelled withdrawal function, as easily as they placed the order. Pandectes adds that function to your Shopify store: a two-step withdrawal form, an automatic confirmation of receipt by email, and one dashboard to track every request until its deadline. The withdrawal function has been **mandatory since 19 June 2026**, with no transition period. It applies to any store selling online to EU consumers, wherever the business is based. #### How it works ##### Customer submits a withdrawal From a clearly labelled link in your footer (and, on Enterprise stores, the order status page), the customer enters their name, order number and email, then confirms the withdrawal in a separate step. ##### Receipt confirmed by email Pandectes emails an acknowledgement of receipt straight away, with the request ID and the date and time it was received, so the customer has a record on a durable medium. ##### You review and close it Every request lands in your dashboard with its status and deadline, with the ones ending soon flagged and a CSV export. You decide whether each is valid and handle the return or refund in Shopify. [Start for free](https://pandectes.io/pricing/) #### EU Withdrawal Features ##### Only valid orders get through - Set the withdrawal period, 14 days from delivery by default - Check that the order number exists in your store - Check that the email matches the order - Let customers pick which products they are withdrawing - Optional email verification of each request ##### Confirmation emails you control - Automatic acknowledgement of receipt for the customer - An optional notification to your team for each new request - Edit subject and body with Liquid variables and a live preview - A template for each of your store languages, picked with a language selector - Send a test email or revert to the default at any time ##### A form that looks like your store - Colors, font, radii and form width - Custom CSS for full control - Desktop, mobile and dark mode previews - Link to your own return policy page - Translate the form and success page into your store languages - Preview the whole flow as an admin before you go live #### What the law asks for, and how Pandectes covers it - **A clearly labelled withdrawal function.** A dedicated withdrawal page linked from your footer, and on Enterprise stores a withdrawal link on the order status page. - **Available for the whole withdrawal period.** The form stays open for as long as the period you set, and each request shows how long it has left. - **A two-step process.** The customer enters their details first, then confirms the withdrawal with a separate, explicit action. - **Acknowledgement of receipt on a durable medium.** An email with the request details and the date and time it was received, sent automatically. - **No extra hurdles.** Only the name, order number and email are required, with no account or login needed. Pandectes gives you the tools for a compliant withdrawal workflow. Whether your store complies still depends on how you configure, label, place and operate the function. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/eu-withdrawal&utm_id=pandectes) #### Frequently Asked Questions What is the EU withdrawal button? It is the withdrawal function that Directive (EU) 2023/2673 adds to the Consumer Rights Directive. Online stores must give consumers a clearly labelled way to withdraw from a contract, as easy to use as the checkout, and must confirm each withdrawal by email or another durable medium. When did the withdrawal button become mandatory? On **19 June 2026**, across the EU, with no transition period. Stores without one risk fines under national consumer law. Does my store need one if we are not based in the EU? Yes, if you sell online to consumers in the EU. The rule follows the customer, not the location of the business. Stores that sell only to businesses are not in scope. Which plan includes the EU withdrawal button? The Premium and Enterprise plans, and every paid plan starts with a 7-day free trial. Exporting requests is included on Enterprise. [Compare the plans](https://pandectes.io/pricing/#comparison-table). Does it change the 14-day withdrawal period? No. Customers still have 14 days to withdraw without giving a reason. The button only changes how they tell you. You can set the period in Pandectes to match your own policy if you offer longer. Where does the withdrawal button appear on my store? On a dedicated withdrawal page that you link from your footer menu, and on Enterprise stores also on the order status page in customer accounts. The [installation guide](https://help.pandectes.io/en/article/how-to-install-eu-withdrawal-button-g7jlk7/) walks through both. Does Pandectes process the return or refund? No. Pandectes collects the withdrawal, confirms receipt and tracks its deadline. You decide whether each request is valid and handle any return or refund in Shopify, as you do today. Can customers withdraw from only some of the products in an order? Yes. Turn on order number validation and product selection, and customers choose which items the withdrawal covers. The selected products appear on the request in your dashboard. #### Setup guides - [EU Withdrawal: overview and settings](https://help.pandectes.io/en/article/eu-withdrawal-151ncav/) - [How to install the EU withdrawal button](https://help.pandectes.io/en/article/how-to-install-eu-withdrawal-button-g7jlk7/) - [EU withdrawal email templates](https://help.pandectes.io/en/article/eu-withdrawal-email-templates-1bi7ih5/) - [Letting customers select products](https://help.pandectes.io/en/article/eu-withdrawal-products-selection-12kgwcr/) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- Source: https://pandectes.io/features/geolocation/ ### Geolocation Select in which regions to show the banner and run the app's functionality. Automatically detect visitor's location to decide what to do. With Pandectes geolocation service you can select the laws/regions for your store. #### How it works ##### Install the app Install our application to your store. The process just takes you some seconds and is ready to be used. ##### Select the regions Select either global visibility of specific regions for your visitors. ##### Enable Banner Enable the banner and will be visible to the selected areas. [Start for free](https://pandectes.io/pricing/) #### Supported Regions ##### Global Select to make your cookie consent banner visible to any visitor around the world. ##### EU/EEA UK Make the cookie consent banner visible only to visitors from EU, EEA, UK and Switzerland covering GDPR. ##### California Support California visitors about CCPA and CPRA. ##### Virginia (VCDPA) Support Virginia visitors about VCDPA. ##### Brazil Make the cookie consent banner visible only to visitors from Brazil about LGPD. ##### Canada Support Canada visitors about PIPEDA. ##### Japan Support Japan visitors about APPI. ##### Thailand Make the cookie consent banner visible only to visitors from Thailand about PDPA. #### Geolocation Features ##### Show the banner in some regions & countries - Display a compliant cookie consent banner - Make the app functionality work only in the selected regions - Select multiple regions - Meet regional law requirements #### Why Choose Pandectes GDPR Compliance? ##### Most popular Shopify's most popular and widely used GDPR app on the app store with thousands of happy stores and hundreds of positive reviews. ##### Flexible & Modular From small to large stores with millions of visitors per day Pandectes solution can serve visitors without any affect on stores performance. ##### Regulations Coverage Pandectes GDPR Compliance covers the most popular data privacy laws and regulations around the world including GDPR, CCPA, VCDPA, LGPD, PIPEDA, PDPA & APPI ##### Banner Modes Pandectes GDPR Compliance app provides different banner modes depending your needs. ##### Cookie Dictionary Cookie dictionary maintains a global cookie database. Each cookie is compared with the database for auto-categorization and information. ##### Consent Records Provides an audit trail of detailed consent records, easily downloadable to demonstrate compliance. ##### Multilingual Pandectes GDPR Compliance app supports more than 130 languages. It also offers Google Translate integration. ##### Insights & Reports Consent tracking, customer data requests, scan results are the main reports and insights to monitor your compliance in the best way. ##### 24/7 Support Our team of experts are always available to give you the best support with 24/7 coverage over chat and email. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/geolocation&utm_id=pandectes) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- Source: https://pandectes.io/features/google-certified-cmp/ ### Google Certified CMP Experience the Advantages of Pandectes GDPR Compliance – Your Google Certified Consent Management Platform (CMP) for Shopify Stores! At Pandectes, we're excited to share our Google certification, reinforcing our role as a reliable CMP for Shopify store owners. #### Google’s New CMP Requirements - Publishers located within the European Economic Area (EEA) or the UK are required to employ a Google-certified CMP for ad serving. - CMPs that achieve Google certification are evaluated based on criteria that primarily emphasize adherence to the Transparency and Consent Framework (TCF). - Publishers utilizing the TCF, who also engage with ad technology providers not affiliated with the TCF, receive support from Google via the Additional Consent specification. - Google ensures that CMPs capable of supporting the Additional Consent specification are properly implementing it through its CMP assessments. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/google-certified-cmp&utm_id=pandectes) #### Pandectes CMP and Google Consent Mode To assist publishers and developers in making these adjustments, Google has published a **[list of CMPs](https://support.google.com/adsense/answer/13554116?hl=en#certified-cmps&zippy=%2Ccertified-cmps)** that have been certified as compliant with its requirements. Pandectes is recognized as a certified Google CMP with**TCF CMP ID: [445](https://iabeurope.eu/cmp-list/)**. As industry standards and regulatory demands grow, platforms such as Pandectes offer the essential tools required for compliance and aid businesses in establishing trust with their users. Starting in **March 2024**, Google has mandated using Consent Mode to access measurement, ad personalization, and remarketing features for users in the European Economic Area and the UK. Pandectes supports Google Consent Mode both in Basic and in Advanced implementation. #### What businesses need to do Beginning **January 16, 2024**, all advertisers using Google AdSense, AdManager, or AdMob must employ a Google-certified CMP. Fulfilling Google's requirement means more than just compliance with Google; it involves adhering to a well-regarded framework that ensures data is processed in a compliant and transparent way. **Does this impact your business?** If you are serving ads in Europe through the Google ad network, this change affects you. If you haven't done so yet, now is the time to review your CMP, verify its certification, and consider switching providers if needed. #### Set up Google Consent Mode with ease ##### Install the app Install our application to your store. The process just takes you some seconds and is ready to be used. ##### Enable GCM Integration Turn on the Google Consent Mode integration to send proper signals to Google. ##### Publish Banner Make the banner visible, and it will be accessible to your store visitors to provide consent. [Start for free](https://pandectes.io/pricing/) #### Pandectes CMP - Recommended by **Google** - Included in the List of **Google-Certified CMPs** - **Certified CMP** for Google Consent Mode - Integrated with **Google Consent Mode** - Integrated with **Google Tag Manager** #### Frequently Asked Questions What is Google Consent Mode? Google Consent Mode is an **API framework developed by Google** that enables websites to adjust how Google services, such as **Google Analytics, Google Tag Manager, and Google Ads**, operate based on **user consent preferences**. This ensures compliance with privacy regulations while allowing businesses to retain valuable insights. With Google Consent Mode, all **Google tags and scripts** dynamically adapt to the consent choices provided through your **Consent Management Platform (CMP)**, ensuring that data collection aligns with user preferences. ✔ Stay compliant with privacy laws in the **EEA and UK** ✔ Maintain **accurate analytics and ad tracking** ✔ Ensure smooth integration with your website’s **CMP** [Try Pandectes free for 7 days and implement Google Consent Mode with ease!](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/google-certified-cmp&utm_id=pandectes) How does the Google Consent Mode work? Google Consent Mode **communicates the consent preferences** of your website visitors to Google services through your **Consent Management Platform (CMP)**. Instead of sending personal data, it only transmits **the user's consent choices**, such as whether they have opted out of marketing cookies. Based on these preferences, Google Consent Mode dynamically adjusts how services like **Google Analytics, Google Ads, and Google Tag Manager** function. For example: ✔ If a user **denies consent** to marketing cookies, Google will display **contextual ads** instead of personalized ones. ✔ If a user **grants consent**, tracking and analytics will function as expected, ensuring optimal performance. [Try Pandectes’ scanner to analyze your store’s cookies and trackers, ensuring compliance and transparency.](https://pandectes.io/cookie-scanner/) How does Conversion Modeling work in Google Consent Mode? Conversion modeling in **Google Consent Mode** allows businesses to gain **anonymous analytics insights** from users who have not consented to cookies. By analyzing **observable data** from users who have provided consent, Google can **estimate user journeys** for those who opted out, helping maintain visibility into website interactions while respecting privacy preferences. ✔ Provides **modeled insights** without tracking personal data ✔ Uses **aggregated trends** from consenting users to estimate conversions ✔ Helps businesses **understand user behavior** while staying compliant [Try Pandectes free for 7 days and implement Google Consent Mode effortlessly!](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/google-certified-cmp&utm_id=pandectes) Why does my store requires user consent for cookies? Under the **EU General Data Protection Regulation (GDPR)**, websites that serve users in **Europe** must obtain **explicit consent** before collecting or processing personal data. Since cookies and trackers used for **analytics and advertising** gather data such as **IP addresses, unique IDs, and browsing history**, websites are legally required to **inform users and request their consent** before activating them. ✔ Ensures **GDPR compliance** and protects user privacy ✔ Applies to **analytics, advertising, and tracking technologies** ✔ Helps build **trust and transparency** with your visitors [Check if your store meets GDPR compliance. Test it for free today!](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/google-certified-cmp&utm_id=pandectes) How can I implement Google Consent Mode on my store? You can set up **Google Consent Mode** by integrating a **Google-certified Consent Management Platform (CMP)** like **Pandectes**. Implementation can be done in a few ways: ✔ **Using Pandectes Integration** – Easily configure Consent Mode through **Pandectes settings**, ensuring compliance and seamless tracking. ✔ **Adding a Code Snippet** – Insert a **short script** above your or use **Pandectes Google Tag Manager Template** to enable consent-aware tracking. [Pandectes offers a simple setup process to help you stay compliant while maintaining valuable insights. Get started today!](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/google-certified-cmp&utm_id=pandectes) Does Google Consent Mode comply with GDPR? Google Consent Mode assists website owners in obtaining **GDPR-compliant user consent** for data collection. However, implementing **Consent Mode alone does not guarantee full GDPR compliance**. Websites must also adhere to additional **GDPR requirements**, such as: ✔ **Providing users with the right to object** to data processing ✔ **Ensuring the right to be forgotten** upon request ✔ **Maintaining an up-to-date cookie policy** with clear disclosures ✔ **Keeping detailed consent records** to demonstrate compliance To fully meet GDPR obligations, website owners should use **Google Consent Mode alongside a certified Consent Management Platform (CMP)** like **Pandectes** to ensure comprehensive compliance. How can I check if Google Consent Mode is Implemented on my website? To verify whether **Google Consent Mode** is properly integrated on your website, follow any of these steps: ##### **1. Use Google Tag Assistant** - Open [Google Tag Assistant](https://tagassistant.google.com/) and enter your website URL. - Browse your site while monitoring the tags being fired. - Navigate to the **"Consent"** tab and check if the following consent states are present: - **"ad_storage"** – Controls advertising-related cookies. - **"analytics_storage"** – Governs analytics-related cookies. - **"functionality_storage"** – Manages storage related to site functionality. - **"security_storage"** – Covers security-related storage mechanisms. - **"personalization_storage"** – Handles personalization cookies. - If any of these values are missing or showing **"Consent not configured"**, Consent Mode may not be fully implemented. ##### **2. Check via Google Tag Manager (GTM) Preview Mode** - Log into **Google Tag Manager** and activate **Preview Mode**. - Open your website, and a **debug panel** will appear. - Click on **"Consent"** to review the status of all expected consent parameters. - Ensure that tags are **only firing based on user consent choices**. ##### **3. Inspect the Data Layer in Developer Tools** - Open your browser’s **Developer Tools** (**F12** or right-click > Inspect). - Go to the **Console** tab and enter:dataLayer - Look for the consent-related parameters, such as: - "ad_storage": "granted" or "denied" - "analytics_storage": "granted" or "denied" - "functionality_storage": "granted" or "denied" - "security_storage": "granted" or "denied" - "personalization_storage": "granted" or "denied" - If these parameters are missing, Consent Mode may not be properly implemented. ##### **4. Validate in Google Analytics 4 (GA4)** - Open **Google Analytics 4** and go to **Admin > Data Streams**. - Select your **web data stream** and check the **Consent settings**. - Ensure that **Consent Mode is enabled** and aligns with your Pandectes CMP settings. How can I get support about Google Consent Mode? For technical support, please email [gcm-support@pandectes.io](mailto:gcm-support@pandectes.io) and cc [cmp-support-helper@google.com](mailto:cmp-support-helper@google.com). Remember to include your store URL in the email. Please use these support emails exclusively for GCM troubleshooting. --- Source: https://pandectes.io/features/google-consent-mode/ ### Google-certified CMP for Google Consent Mode V2 Effortlessly implement Google Consent Mode V2 with Pandectes, a Google-certified CMP, ensuring compliance while maintaining your ads and analytics performance across Europe and the UK. From **March 2024**, businesses in the EEA and UK must implement Google Consent Mode V2 to maintain access to Google Ads and Analytics. Pandectes, a Google-certified CMP, helps you stay compliant and retain data insights. #### Seamless Setup for Google Consent Mode V2 ##### Install the app Install our application to your store. The process just takes you some seconds and is ready to be used. ##### Enable GCM v2 From settings of the application you can enable this integration and make it available to the Shopify Store. ##### Activate the banner After you have customized your banner's layout and position, just enable it and you are done. [Start now for free](https://pandectes.io/pricing/) #### Google Consent Mode Features ##### Enhance Google Services with Google Consent Mode v2 - **Advanced User Consent Interface:** Google Consent Mode V2 offers an even more user-friendly interface, making it easier for users to understand and provide consent for services like Google Analytics and Google Ads. - **Refined Data Control:** V2 allows for more nuanced control over user data tracking by Google services, ensuring your website adheres to the latest data privacy regulations. - **Intelligent Data Reduction:** With enhanced algorithms, V2 reduces data collection more effectively when users opt out, safeguarding against non-compliance risks while respecting user privacy. #### Frequently Asked Questions What is Google Consent Mode? Google Consent Mode is an **API framework developed by Google** that enables websites to adjust how Google services, such as **Google Analytics, Google Tag Manager, and Google Ads**, operate based on **user consent preferences**. This ensures compliance with privacy regulations while allowing businesses to retain valuable insights. With Google Consent Mode, all **Google tags and scripts** dynamically adapt to the consent choices provided through your **Consent Management Platform (CMP)**, ensuring that data collection aligns with user preferences. ✔ Stay compliant with privacy laws in the **EEA and UK** ✔ Maintain **accurate analytics and ad tracking** ✔ Ensure smooth integration with your website’s **CMP** [Try Pandectes free for 7 days and implement Google Consent Mode with ease!](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/google-consent-mode&utm_id=pandectes) How does the Google Consent Mode work? Google Consent Mode **communicates the consent preferences** of your website visitors to Google services through your **Consent Management Platform (CMP)**. Instead of sending personal data, it only transmits **the user's consent choices**, such as whether they have opted out of marketing cookies. Based on these preferences, Google Consent Mode dynamically adjusts how services like **Google Analytics, Google Ads, and Google Tag Manager** function. For example: ✔ If a user **denies consent** to marketing cookies, Google will display **contextual ads** instead of personalized ones. ✔ If a user **grants consent**, tracking and analytics will function as expected, ensuring optimal performance. [Try Pandectes’ scanner to analyze your store’s cookies and trackers, ensuring compliance and transparency.](https://pandectes.io/cookie-scanner/) How does Conversion Modeling work in Google Consent Mode? Conversion modeling in **Google Consent Mode** allows businesses to gain **anonymous analytics insights** from users who have not consented to cookies. By analyzing **observable data** from users who have provided consent, Google can **estimate user journeys** for those who opted out, helping maintain visibility into website interactions while respecting privacy preferences. ✔ Provides **modeled insights** without tracking personal data ✔ Uses **aggregated trends** from consenting users to estimate conversions ✔ Helps businesses **understand user behavior** while staying compliant [Try Pandectes free for 7 days and implement Google Consent Mode effortlessly!](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/google-consent-mode&utm_id=pandectes) Why does my store requires user consent for cookies? Under the **EU General Data Protection Regulation (GDPR)**, websites that serve users in **Europe** must obtain **explicit consent** before collecting or processing personal data. Since cookies and trackers used for **analytics and advertising** gather data such as **IP addresses, unique IDs, and browsing history**, websites are legally required to **inform users and request their consent** before activating them. ✔ Ensures **GDPR compliance** and protects user privacy ✔ Applies to **analytics, advertising, and tracking technologies** ✔ Helps build **trust and transparency** with your visitors [Check if your store meets GDPR compliance. Test it for free today!](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/google-consent-mode&utm_id=pandectes) How can I implement Google Consent Mode on my store? You can set up **Google Consent Mode** by integrating a **Google-certified Consent Management Platform (CMP)** like **Pandectes**. Implementation can be done in a few ways: ✔ **Using Pandectes Integration** – Easily configure Consent Mode through **Pandectes settings**, ensuring compliance and seamless tracking. ✔ **Adding a Code Snippet** – Insert a **short script** above your or use **Pandectes Google Tag Manager Template** to enable consent-aware tracking. [Pandectes offers a simple setup process to help you stay compliant while maintaining valuable insights. Get started today!](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/google-consent-mode&utm_id=pandectes) Does Google Consent Mode comply with GDPR? Google Consent Mode assists website owners in obtaining **GDPR-compliant user consent** for data collection. However, implementing **Consent Mode alone does not guarantee full GDPR compliance**. Websites must also adhere to additional **GDPR requirements**, such as: ✔ **Providing users with the right to object** to data processing ✔ **Ensuring the right to be forgotten** upon request ✔ **Maintaining an up-to-date cookie policy** with clear disclosures ✔ **Keeping detailed consent records** to demonstrate compliance To fully meet GDPR obligations, website owners should use **Google Consent Mode alongside a certified Consent Management Platform (CMP)** like **Pandectes** to ensure comprehensive compliance. How can I check if Google Consent Mode is Implemented on my website? To verify whether **Google Consent Mode** is properly integrated on your website, follow any of these steps: ##### **1. Use Google Tag Assistant** - Open [Google Tag Assistant](https://tagassistant.google.com/) and enter your website URL. - Browse your site while monitoring the tags being fired. - Navigate to the **"Consent"** tab and check if the following consent states are present: - **"ad_storage"** – Controls advertising-related cookies. - **"analytics_storage"** – Governs analytics-related cookies. - **"functionality_storage"** – Manages storage related to site functionality. - **"security_storage"** – Covers security-related storage mechanisms. - **"personalization_storage"** – Handles personalization cookies. - If any of these values are missing or showing **"Consent not configured"**, Consent Mode may not be fully implemented. ##### **2. Check via Google Tag Manager (GTM) Preview Mode** - Log into **Google Tag Manager** and activate **Preview Mode**. - Open your website, and a **debug panel** will appear. - Click on **"Consent"** to review the status of all expected consent parameters. - Ensure that tags are **only firing based on user consent choices**. ##### **3. Inspect the Data Layer in Developer Tools** - Open your browser’s **Developer Tools** (**F12** or right-click > Inspect). - Go to the **Console** tab and enter:dataLayer - Look for the consent-related parameters, such as: - "ad_storage": "granted" or "denied" - "analytics_storage": "granted" or "denied" - "functionality_storage": "granted" or "denied" - "security_storage": "granted" or "denied" - "personalization_storage": "granted" or "denied" - If these parameters are missing, Consent Mode may not be properly implemented. ##### **4. Validate in Google Analytics 4 (GA4)** - Open **Google Analytics 4** and go to **Admin > Data Streams**. - Select your **web data stream** and check the **Consent settings**. - Ensure that **Consent Mode is enabled** and aligns with your Pandectes CMP settings. How can I get support about Google Consent Mode? For technical support, please email [gcm-support@pandectes.io](mailto:gcm-support@pandectes.io) and cc [cmp-support-helper@google.com](mailto:cmp-support-helper@google.com). Remember to include your store URL in the email. Please use these support emails exclusively for GCM troubleshooting. --- Source: https://pandectes.io/features/iab-tcf/ ### Secure your ad revenue with the IAB TCF v2.4 Effortlessly adopt TCF v2.4 using our IAB-certified consent management platform and stay proactive in managing compliance risks. Pandectes is a Google-certified CMP that supports IAB TCF v2.4. [Get started now](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/iab-tcf&utm_id=pandectes) #### What is the IAB Transparency and Consent Framework? The Transparency & Consent Framework (TCF) is a functional framework created by the Interactive Advertising Bureau (IAB) Europe. It assists website owners, publishers, vendors, and advertisers in adhering to the GDPR's transparency and consent requirements. TCF standardizes the process of obtaining user consent for the processing of personal data within the digital advertising ecosystem. Initially introduced in 2018, the IAB has released several updates, with the most recent, version 2.4, published in July 2026. #### Who does IAB TCF impact? ##### Consumers Visitors to your website will benefit from increased transparency and control regarding the processing of their personal data and how ad tech vendors utilize this information. ##### Publishers Website owners and operators who publish content will gain more control and flexibility in how they interact with ad tech vendors. ##### Vendors Third-party advertisers who collaborate with publishers such as yourself can legally process personal data for online advertising and associated activities. [Start for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/iab-tcf&utm_id=pandectes) #### Why you should use a CMP that integrates with the IAB TCF - Meet the required legal standards for data protection - Serve ads in the EU, EEA, and UK - Build trust with end-users - Generate ad revenue confidently #### Pandectes CMP features that enable IAB TCF compliance - Included in the List of **Google-Certified CMPs** - Easy to set up **IAB TCF v2.4** integration - Easy consent withdrawal procedure that aligns with IAB TCF v2.4 requirements - Supports **Google Additional Consent** to compliantly work with non-GVL advertisers - Enables you to obtain and record valid user consent for data processing purposes #### Pandectes CMP consent banner features for IAB TCF compliance - Detailed vendor disclosure on the cookie consent banner - Standard, non-editable, IAB-certified message displayed in the banner - Customization available for you to display your own link to your privacy policy or cookie policy - Ad settings tab for consumers to choose between IAB purposes and vendors before submitting their consent - Total number of parties data will be shared with is displayed on the first layer of the banner #### FAQs What does IAB stand for? IAB Europe, the regional association of the Interactive Advertising Bureau (IAB), supports the digital marketing and advertising ecosystem. It comprises national IABs and various marketing, media, and technology companies. The mission of IAB Europe is to provide political representation and foster industry collaboration through the development of frameworks, standards, and programs that help businesses prosper in the European market. What’s new about the TCF v2.4? IAB Europe amended the TCF Policies (version 5.0.b, replacing 5.0.a) in May 2026, and published the matching technical specifications v2.4 with a refreshed Global Vendor List (GVL) on 23 July 2026. The update is about how the framework is explained to your visitors and how their choices are carried between devices: - **Standard explanations for Features.** Consent banners must show a standard text next to each Feature, explaining that Features are means of processing used only in pursuit of the Purposes your visitors are given a choice about. Each Feature also gets an illustration, and the standard texts, with their translations, come from the GVL. - **No Features next to switches that cannot be turned off.** This avoids misleading visitors about what they can control. - **Choices across devices.** Following the CNIL’s recommendations on cross-device consent, publishers can persist a visitor’s choices across devices, for example when they are logged in to an account. Visitors must be told the scope of those choices, and publishers get flexibility to handle conflicts, such as a visitor who chooses differently before logging in than what their account already holds. - **Special Feature 2 has a new name.** It was “Actively scan device characteristics for identification” and is now “Identify devices based on information actively requested”. The vendor guidance now reflects the active request of Client Hints to create a fingerprint. - **A legacy workaround is gone.** Vendors that declare only Special Purposes are no longer listed under Legitimate Interest to mark them as disclosed. The Disclosed Vendors segment that TCF v2.3 made mandatory still applies. Pandectes supports TCF v2.4 in its consent banner. Is the TCF 2.4 mandatory? Yes, for any publisher or merchant that uses the IAB Transparency and Consent Framework. IAB Europe has set 23 October 2026 as the date by which consent management platforms must implement the new disclosures in web environments, and 23 February 2027 for mobile apps and connected TV. After those dates, consent signals that do not follow the current framework can be ignored by ad vendors and platforms such as Google, which can leave your ads in “Limited ads” mode and reduce your revenue. With a Google-certified CMP like Pandectes that supports TCF v2.4, you do not have to rebuild anything in your theme. When does the TCF 2.4 need to be implemented by? The deadlines set by IAB Europe are: - **29 May 2026:** updated TCF Policies (v5.0.b) released. - **23 July 2026:** TCF specifications v2.4 and the refreshed Global Vendor List published. - **23 October 2026:** CMPs must implement the new disclosures in web environments. - **23 February 2027:** the same for mobile apps and connected TV. IAB Europe can adjust cut-over dates and grace periods, so check its latest policy before you plan around them. For a Shopify store using the Pandectes banner, the web update is part of the app. Why do you need a CMP? If your business monetizes through online ads, you're acting as a publisher and require a Google-certified CMP like Pandectes, supporting IAB Europe's TCF v2.4. Gathering user consent for ad-related data processing is essential. **Pandectes** facilitates clear communication about data usage and offers easy consent management. What are your requirements? **1.** Adopt IAB's TCF v2.4 for a standardized approach to vendor collaboration, minimizing data privacy risks and ensuring compliance with GDPR and ePrivacy Directive. **2.** Publishers and developers using Google AdSense, Ad Manager, or AdMob to serve ads in the EU/EEA or UK must have a Google-certified CMP that integrates with IAB’s TCF v2.4. **3.** Utilize **Google’s Additional Consent** to manage and signal consent for ad tech providers not covered by IAB Europe’s TCF v2.4, but included in Google’s Ad Tech Providers (ATPs) list. Does the TCF 2.4 limit ad revenue? No. TCF 2.4 is meant to keep your consent signals valid, so that the ad platforms you sell through keep trusting them. **How TCF 2.4 affects revenue:** - **Helps you avoid “Limited ads”:** if your consent signals stop being accepted, ad platforms such as Google can restrict you to ads that are not personalized, and revenue falls with them. - **Keeps bidders confident:** advertisers bid on inventory whose consent they can verify. Clear disclosures about vendors and Features make that easier. - **Mostly a change to wording and signals:** the update adds standard explanations to the banner and changes some signals. It does not ask your customers for anything new, so opt-in rates should not suffer. - **Lowers compliance risk:** using the framework version that IAB Europe and Google currently expect reduces the chance of your signals being flagged. In short, TCF 2.4 is a safety net for your monetization: it keeps the consent you collect technically valid, so you can keep earning. --- Source: https://pandectes.io/features/multiple-languages-translations/ ### Multiple Languages & Translations Pandectes offers support for multiple languages throughout the application, which refers to any content you would see while navigating through the modules and their out-of-the-box, standard available screens, menus, and setting names. Also there are options to translate content to any language. #### How it works ##### Install the app Install our application to your store. The process just takes you some seconds and is ready to be used. ##### Add Languages Select the desired languages in which your banner will be presented. Also select among different ways to detect visitors location or language. ##### Translate Translate the content of your banner and of the related pages with our integrated translator that also works with Google Translate. [Start for free](https://pandectes.io/pricing/) #### Languages & Translations Features ##### Having your banner and compliance pages translated into 130+ languages can help to make your website more accessible and user-friendly for a global audience. - Manual translation - Translation with presets - Google Translate #### Why Choose Pandectes GDPR Compliance? ##### Most popular Shopify's most popular and widely used GDPR app on the app store with thousands of happy stores and hundreds of positive reviews. ##### Flexible & Modular From small to large stores with millions of visitors per day Pandectes solution can serve visitors without any affect on stores performance. ##### Regulations Coverage Pandectes GDPR Compliance covers the most popular data privacy laws and regulations around the world including GDPR, CCPA, VCDPA, LGPD, PIPEDA, PDPA & APPI ##### Banner Modes Pandectes GDPR Compliance app provides different banner modes depending your needs. ##### Cookie Dictionary Cookie dictionary maintains a global cookie database. Each cookie is compared with the database for auto-categorization and information. ##### Consent Records Provides an audit trail of detailed consent records, easily downloadable to demonstrate compliance. ##### Multilingual Pandectes GDPR Compliance app supports more than 130 languages. It also offers Google Translate integration. ##### Insights & Reports Consent tracking, customer data requests, scan results are the main reports and insights to monitor your compliance in the best way. ##### 24/7 Support Our team of experts are always available to give you the best support with 24/7 coverage over chat and email. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/multiple-languages-translations&utm_id=pandectes) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- Source: https://pandectes.io/features/shopify-customer-privacy/ ### Shopify Customer Privacy The Shopify API for customer privacy is a JavaScript API that can be accessed through the browser, allowing developers to read and write cookies that are associated with a buyer’s agreement to be tracked. It is integrated as a property on the window. Shopify object, which is globally available to all Shopify online stores. Our application is integrated with this API. #### How it works ##### Visitor Checks Banner A visitor that comes first time to your store will see a consent banner in your store. ##### Visitor Interacts After the visitor sees the banner will make a decision to accept or to decline the tracking. ##### Shopify is Notified Our application notifies Shopify’s Customer Privacy API. [Start for free](https://pandectes.io/pricing/) #### Shopify Customer Privacy Features ##### To use the Customer Privacy API, the merchant must limit data collection in their online store settings for the app’s target regions. - Consent collection - Visitor tracking #### Why Choose Pandectes GDPR Compliance? ##### Most popular Shopify's most popular and widely used GDPR app on the app store with thousands of happy stores and hundreds of positive reviews. ##### Flexible & Modular From small to large stores with millions of visitors per day Pandectes solution can serve visitors without any affect on stores performance. ##### Regulations Coverage Pandectes GDPR Compliance covers the most popular data privacy laws and regulations around the world including GDPR, CCPA, VCDPA, LGPD, PIPEDA, PDPA & APPI ##### Banner Modes Pandectes GDPR Compliance app provides different banner modes depending your needs. ##### Cookie Dictionary Cookie dictionary maintains a global cookie database. Each cookie is compared with the database for auto-categorization and information. ##### Consent Records Provides an audit trail of detailed consent records, easily downloadable to demonstrate compliance. ##### Multilingual Pandectes GDPR Compliance app supports more than 130 languages. It also offers Google Translate integration. ##### Insights & Reports Consent tracking, customer data requests, scan results are the main reports and insights to monitor your compliance in the best way. ##### 24/7 Support Our team of experts are always available to give you the best support with 24/7 coverage over chat and email. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/shopify-customer-privacy&utm_id=pandectes) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- Source: https://pandectes.io/features/web-accessibility/ ### Accessibility Widget for Shopify Give every visitor a way to adapt your store to their needs. The Pandectes accessibility widget adds a menu of 17 tools and 4 ready-made profiles, from larger text and higher contrast to paused animations and text to speech, styled to match your theme. **Independently audited.** The Pandectes accessibility widget was audited by an external testing company against WCAG 2.2 Level AA, Section 508 and EN 301 549. The audit covers the widget's own interface. [See the audit details](https://pandectes.io/accessibility-conformance/). #### How it works ##### Turn on the app embed In your Shopify theme editor, open App embeds and switch on Pandectes Core. The same embed runs the consent banner. ##### Make it yours Pick the icon, colors, font and position, choose which tools and profiles visitors see, and link your accessibility statement. ##### Enable it Start with Enable for admins to preview it on your live store, then switch it on for every visitor. [Start for free](https://pandectes.io/pricing/) #### 17 tools your visitors control ##### Pause animations Stops motion and moving content. ##### Text to speech Reads out what the visitor selects. ##### Contrast Raises contrast in two steps. ##### Highlight links Makes every link stand out. ##### Text size Enlarges text in four steps. ##### Letter spacing Opens up the space between letters. ##### Invert colors Reverses the page colors. ##### Hide images Removes images for a distraction-free read. ##### Readable font Switches to a font designed for legibility. ##### Large cursor A bigger, easier-to-track pointer. ##### Reading mask Dims everything but the line being read. ##### Reading guide A bar that follows the pointer line by line. ##### Tooltips Shows descriptions as visitors hover. ##### Page structure An outline of the page to jump around it. ##### Line height Adds space between lines of text. ##### Text alignment Changes how text lines up. ##### Saturation Lowers or removes color saturation. #### Accessibility profiles Presets that apply several adjustments at once, for the needs visitors mention most. ##### ADHD One click sets up the page for visitors with ADHD. ##### Dyslexia One click sets up the page for visitors with dyslexia. ##### Visually impaired One click sets up the page for visitors with low vision. ##### Seizure-sensitive One click sets up the page for visitors sensitive to motion and flashing. #### Built to fit your store ##### Match your theme on desktop and mobile - Four widget icons, and a custom trigger to open it from your own link or button - Blue, dark or custom colors, with the font family and size of your theme - Icon size, corner and distance from the edges - Show it on desktop and mobile, or on one of them only - On Enterprise: separate desktop and mobile settings, and custom CSS for a fully branded look ##### Decide how the menu behaves - Accessibility profiles that apply several adjustments with one click - An oversized layout with larger controls that are easier to target - Visitors can move the menu to the other side or hide it while they browse - A keyboard shortcut, Ctrl + M, to open the menu without a mouse - Stays closed until a visitor opens it, if you prefer - Optional "Powered by" attribution ##### Your statement, in your visitors' language - Link your accessibility statement from the menu, to a store page or any URL - The menu follows your store languages, with a language switcher for visitors - Text to speech reads in the language the visitor picks ##### Show it where accessibility laws apply - Show it worldwide, or only in the regions you choose - USA (ADA Title III), Europe (European Accessibility Act) and the UK (Equality Act 2010) - Canada (AODA and ACA), Australia and New Zealand (Disability Discrimination Acts) - Narrow any region down to single states or countries #### Frequently asked questions Does the accessibility widget make my store compliant with the ADA or the European Accessibility Act? No widget can do that on its own, and you should be wary of any that claims to. The widget gives visitors tools to adapt your pages to their needs. Compliance with laws such as the ADA or the European Accessibility Act also depends on your theme, content and checkout meeting the WCAG guidelines, for example alt text on images, enough color contrast and full keyboard navigation. Use the widget alongside that work, and publish an [accessibility statement](https://help.pandectes.io/en/article/how-to-write-an-accessibility-statement-for-your-store-3yvbxr/) that explains what you support and how visitors can reach you. Which plan includes the accessibility widget? The widget is available on the Premium and Enterprise plans, and every paid plan starts with a 7-day free trial. Enterprise adds separate desktop and mobile options and custom styling. [Compare the plans](https://pandectes.io/pricing/#comparison-table). How do I add the widget to my Shopify store? Switch on the Pandectes Core app embed in your theme editor, then open Web Accessibility in the app and set it to Enable. Choose Enable for admins first to preview it on your live store before visitors see it. The [setup guide](https://help.pandectes.io/en/article/accessibility-widget-94vfg0/) walks through every setting. How does text to speech work? Visitors click an element and the widget reads a short description of it aloud, highlighting it as it speaks, in the language selected in the menu. It uses the browser's built-in speech, so nothing needs installing. It helps visitors who prefer to listen, but it is not a replacement for dedicated screen readers such as NVDA, JAWS or VoiceOver. [How the screen reader works](https://help.pandectes.io/en/article/how-screen-reader-works-in-the-accessibility-widget-1ncts0j/). Can visitors open the menu from the keyboard? Yes. Ctrl + M opens and closes the accessibility menu, and the shortcut is shown inside it. Can I show the widget only in some countries? Yes. Show it worldwide, or pick regions such as the USA, Europe, the UK, Canada, and Australia and New Zealand, down to single states or countries. What should my accessibility statement include? Your commitment to accessibility, the standard you work towards (usually WCAG Level AA), any known limitations, a way for visitors to report problems, and the date you last reviewed it. [How to write an accessibility statement](https://help.pandectes.io/en/article/how-to-write-an-accessibility-statement-for-your-store-3yvbxr/). #### Why Choose Pandectes GDPR Compliance? ##### Most popular Shopify's most popular and widely used GDPR app on the app store with thousands of happy stores and hundreds of positive reviews. ##### Flexible & Modular From small to large stores with millions of visitors per day Pandectes solution can serve visitors without any affect on stores performance. ##### Regulations Coverage Pandectes GDPR Compliance covers the most popular data privacy laws and regulations around the world including GDPR, CCPA, VCDPA, LGPD, PIPEDA, PDPA & APPI ##### Banner Modes Pandectes GDPR Compliance app provides different banner modes depending your needs. ##### Cookie Dictionary Cookie dictionary maintains a global cookie database. Each cookie is compared with the database for auto-categorization and information. ##### Consent Records Provides an audit trail of detailed consent records, easily downloadable to demonstrate compliance. ##### Multilingual Pandectes GDPR Compliance app supports more than 130 languages. It also offers Google Translate integration. ##### Insights & Reports Consent tracking, customer data requests, scan results are the main reports and insights to monitor your compliance in the best way. ##### 24/7 Support Our team of experts are always available to give you the best support with 24/7 coverage over chat and email. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=features/web-accessibility&utm_id=pandectes) #### Recent Posts - [GDPR and Bot Traffic: A Guide for Website Owners](https://pandectes.io/blog/gdpr-and-bot-traffic-a-guide-for-website-owners/)19 October 2026 Bot detection processes visitor data, so GDPR applies. How to choose a lawful basis, handle bot-detection cookies and consent, and document it for your Shopify store. - [Shopify GDPR Compliance: The Complete 2026 Guide](https://pandectes.io/blog/shopify-gdpr/)15 October 2026 Is your Shopify store GDPR compliant? What Shopify covers, what you must do yourself, an 8-step checklist with admin paths, fines, and the 2026 changes. - [How to Handle GDPR Data Requests on Shopify, Step by Step](https://pandectes.io/blog/shopify-gdpr-data-requests/)15 October 2026 How to answer GDPR data requests (DSARs) on Shopify: verify the customer, export or erase their data in Shopify admin, cover your apps, and meet the one-month deadline. --- ## Privacy regulations Source: https://pandectes.io/regulations/apa/ ### Australian Privacy Act (APA) Compliance Pandectes GDPR Compliance helps Shopify stores meet Australian Privacy Act (APA) requirements by scanning for cookies, generating reports, and ensuring compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/apa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is APA? The Australian Privacy Act (APA) is Australia’s national data protection legislation. It was first enacted in 1988 and has been amended several times to address emerging privacy concerns. The APA aims to protect the personal information of individuals by regulating the collection, use, and disclosure of personal data by organizations. It establishes principles such as obtaining consent for the collection, use, and disclosure of personal information, providing individuals with access to their personal information, and protecting personal information through appropriate security measures. The APA applies to all organizations that handle personal information, including both public and private sector organizations. Under the APA, organizations are required to appoint a privacy officer, take necessary measures for personal information protection, establish a privacy management framework, and report to the Office of the Australian Information Commissioner (OAIC) when a data breach occurs. #### Who does the APA apply to? The APA applies to personal information that is collected, used, or disclosed within Australia, as well as personal information that is transferred from Australia to other countries. #### What happens if I don’t comply with the APA? Failing to comply with the Australian Privacy Act (APA) can result in various penalties and enforcement actions. The Office of the Australian Information Commissioner (OAIC), which is responsible for enforcing the APA, has the power to impose administrative fines for non-compliance. The fines can be significant, depending on the severity and nature of the violation. In addition to fines, the OAIC can also impose other penalties, such as ordering companies to stop processing personal data, requiring companies to rectify non-compliance, and issuing reprimands. The OAIC can also issue improvement orders or suspension of business orders to organizations that fail to comply with the APA. In some cases, non-compliance with the APA can also result in legal action being taken against a company by individuals whose personal data has been affected. It’s important to note that APA compliance is not only about avoiding fines and penalties, but also about protecting people’s personal information and respecting their rights. #### When will the APA go into effect? The Australian Privacy Act (APA) was first enacted in 1988 and came into effect on January 1st, 1989. However, it has been amended several times, with significant amendments coming into effect in 2014 and subsequent updates addressing emerging privacy concerns. #### Complying with the APA The Australian Privacy Act (APA) is Australia’s national data protection legislation. As businesses operate across multiple jurisdictions, it becomes increasingly difficult to navigate and adhere to the intricate network of international data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through national legislatures is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a Consent Management Platform (CMP) like [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/apa&utm_id=pandectes). A CMP relieves the burden on your team by offering customizable consent management, automation of data subject access requests, and tools for cookie & vendor management. Pandectes GDPR Compliance is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Privacy Act 1988, Federal Register of Legislation](https://www.legislation.gov.au/C2004A03712/latest/text) - [The Privacy Act, Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/privacy-legislation/the-privacy-act) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/apa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/appi/ ### Act on the Protection of Personal Information (APPI) Compliance Pandectes GDPR Compliance helps Shopify stores comply with Japan's APPI by scanning for cookies, generating reports, and providing updates to ensure compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/appi&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is APPI? The Act on the Protection of Personal Information (APPI) is Japan’s primary data protection law. Enacted in 2003 and effective from 2005, APPI regulates how organizations handle personal information. It sets out principles including: - Obtaining consent for the collection, use, and disclosure of personal information. - Providing individuals access to their personal information. - Implementing appropriate security measures to protect personal information. APPI applies to all organizations that process personal information in Japan, including both public and private sector entities. Organizations must appoint a personal information protection manager, establish a management system, and report data breaches to the Personal Information Protection Commission (PPC). #### Who does the APPI apply to? APPI applies to personal information collected, used, or disclosed within Japan, as well as data transferred from Japan to other countries. #### What happens if I don’t comply with the APPI? Failing to comply with APPI can result in: - **Administrative Monetary Penalties (AMPs):** Fines of up to JPY 1,000,000 (around 9,300 USD) per violation. - **Compliance Orders:** The PPC can require specific actions to correct non-compliance. - **Public Findings:** The PPC can make public findings of non-compliance and issue improvement orders or business suspensions. - **Legal Action:** Affected individuals may take legal action against organizations that violate their data protection rights. APPI compliance is crucial not only to avoid penalties but also to protect individuals’ personal information and respect their privacy rights. #### When will the APPI go into effect? The APPI was initially enacted in 2003 and came into effect on April 1, 2005. It was amended in 2015, and these amendments became effective on May 30, 2017. #### Complying with the APPI Navigating international data privacy laws can be complex. Staying informed about evolving legislation and consulting with legal experts is essential. To streamline the compliance process, consider using a Consent Management Platform (CMP) like Pandectes GDPR Compliance. Our CMP offers: - Customizable consent management - Automated data subject access requests - Tools for cookie and vendor management [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/appi&utm_id=pandectes) is specifically designed for Shopify stores to help you achieve and maintain compliance in a dynamic data privacy landscape. #### Official sources - [Act on the Protection of Personal Information, laws and policies, Personal Information Protection Commission](https://www.ppc.go.jp/en/legal/) - [Personal Information Protection Commission, Japan](https://www.ppc.go.jp/en/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/appi&utm_id=pandectes) --- Source: https://pandectes.io/regulations/ccpa-cpra/ ### CCPA, CPRA & CIPA Compliance for Shopify Stores Pandectes GDPR Compliance helps Shopify stores meet CCPA and CPRA requirements and reduce CIPA risk, with opt-outs, Global Privacy Control support, and opt-in consent before any tracking runs. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ccpa-cpra&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What are the CCPA, CPRA and CIPA? California has two kinds of privacy law that affect an online store. **California Consumer Privacy Act (CCPA)**: In effect since January 1, 2020, the CCPA gives California residents rights over the personal information businesses collect about them: - **Right to know**: Learn what personal information is collected, used, sold or shared. - **Right to delete**: Ask a business to delete their personal information. - **Right to opt out**: Opt out of the sale or sharing of their personal information, including sharing for cross-context behavioral advertising. - **Right to non-discrimination**: Exercise these rights without being treated differently. **California Privacy Rights Act (CPRA)**: The CPRA amended the CCPA from January 1, 2023. It added the right to correct inaccurate information and to limit the use of sensitive personal information, and created the California Privacy Protection Agency to enforce the law. Businesses must also honor opt-out preference signals such as Global Privacy Control (GPC) as a valid opt-out request. **California Invasion of Privacy Act (CIPA)**: CIPA is a 1967 law in the California Penal Code (Section 630 and following) written to stop wiretapping and eavesdropping. Courts and plaintiffs now apply it to websites. Its wiretapping section requires the consent of all parties to a communication, and claims argue that chat widgets, session replay tools and advertising pixels let third parties “listen in” on a visitor’s interaction with a store. Because CIPA allows statutory damages of $5,000 per violation, it has become one of the most common sources of privacy lawsuits and demand letters against online businesses. #### Who do the CCPA, CPRA and CIPA apply to? The CCPA applies to for-profit businesses that do business in California and either have annual gross revenue above $26,625,000 (adjusted from January 1, 2025), buy, sell or share the personal information of 100,000 or more California consumers or households, or earn half or more of their revenue from selling or sharing personal information. CIPA has no size threshold: any website that California residents visit can be targeted. #### What happens if I don’t comply with the CCPA, CPRA and CIPA? The consequences differ between the two laws: - **CCPA and CPRA fines**: Up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16 (amounts adjusted from January 1, 2025). The California Privacy Protection Agency and the Attorney General both enforce the law. - **CCPA data breach lawsuits**: Consumers can sue after certain data breaches for $107 to $799 per consumer per incident, or actual damages if greater. - **CIPA lawsuits**: Individuals can sue for $5,000 per violation, or three times actual damages. Most claims are filed as class actions, so exposure grows with the number of visitors. - **CIPA pen register claims**: From January 1, 2027, claims under Section 638.51 about tracking on websites and apps can only be brought by the Attorney General, not by private plaintiffs. Wiretapping claims under Section 631, for example over chat or session replay tools, are not affected. #### When did the CCPA, CPRA and CIPA go into effect? **CCPA**: January 1, 2020. **CPRA**: January 1, 2023. **CIPA**: 1967, with website tracking claims rising sharply since 2022. The change that limits private pen register claims takes effect on January 1, 2027. #### Complying with the CCPA, CPRA and CIPA For a Shopify store, most of the work is about controlling the cookies, pixels and scripts that run on your site: - **Offer a clear opt-out.** Add a “Do not sell or share my personal information” link and make sure advertising tags stop sharing data once a visitor opts out. - **Honor Global Privacy Control.** Treat a GPC signal from the visitor’s browser as an opt-out of sale and sharing. - **Ask for consent before tracking runs.** CIPA turns on consent, so the safest approach is opt-in for California visitors: block analytics, advertising pixels, session replay and chat tools that send data to third parties until the visitor agrees. - **Keep proof of consent.** Records of when and how each visitor consented are your best evidence if you receive a CIPA demand letter. - **Update your privacy notice.** Explain what you collect, why, who receives it, and how consumers can exercise their rights. - **Handle consumer requests.** Respond to requests to know, delete and correct within 45 days. A Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ccpa-cpra&utm_id=pandectes)** covers these steps on your storefront. It provides a cookie banner with a “Do not sell or share my personal information” link and Global Privacy Control support, and you can set it to require opt-in consent for California visitors, blocking analytics, pixels and session replay scripts until they agree. It automatically scans and classifies your cookies, generates a cookie declaration, keeps consent logs with timestamps and choices as proof of consent, and helps you handle data subject requests. CIPA case law changes quickly, so review your setup with legal counsel where appropriate. #### Official sources - [California Consumer Privacy Act, Civil Code § 1798.100 et seq.](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5) - [California Invasion of Privacy Act, Penal Code § 630 et seq.](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=PEN&division=&title=15.&part=1.&chapter=1.5.&article=) - [California Privacy Protection Agency](https://cppa.ca.gov/) - [California Consumer Privacy Act, California Attorney General](https://oag.ca.gov/privacy/ccpa) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ccpa-cpra&utm_id=pandectes) --- Source: https://pandectes.io/regulations/chile-lppd/ ### Chile Personal Data Protection Law (LPPD) Compliance Pandectes GDPR Compliance helps Shopify stores meet LPPD requirements by blocking non-essential cookies until visitors consent, scanning and classifying cookies, and keeping consent records. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/chile-lppd&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is LPPD? LPPD is a common name for Chile’s new personal data protection law, Law No. 21.719, which regulates the protection and processing of personal data and creates the Personal Data Protection Agency. It was published in the Official Gazette on 13 December 2024. Rather than replacing Chile’s 1999 privacy law, Law No. 19.628, it rewrites most of it, bringing Chilean rules much closer to the EU’s GDPR. Its key rules include: - Personal data may be processed with the consent of the data subject or on another legal basis set out in the law, such as performing a contract, meeting a legal obligation, or a legitimate interest. - Consent must be free, specific, unequivocal, and informed, given through a statement or a clear affirmative action. - Individuals have rights of access, rectification, erasure, objection, portability, and blocking of processing, as well as rights regarding automated decisions, including profiling. - Businesses must tell people how their data is processed, keep it secure, and report security breaches. - International transfers of personal data are allowed only under the conditions in the law, such as transfers to countries with adequate protection or with appropriate safeguards. - A new independent regulator, the Personal Data Protection Agency (Agencia de Protección de Datos Personales), supervises the law and can impose sanctions. #### Who does the LPPD apply to? The LPPD applies to public bodies and private organizations of every size that process personal data in Chile. It also applies to businesses outside Chile when their processing is aimed at offering goods or services to people in Chile, or at monitoring their behavior, including tracking and profiling, so a foreign online store selling to Chilean customers can fall within its scope. #### What happens if I don’t comply with the LPPD? The LPPD classifies infringements as minor, serious, or very serious, with fines set in UTM (unidad tributaria mensual), a Chilean inflation-indexed monetary unit: - **Minor infringements:** A written warning or a fine of up to 5,000 UTM. - **Serious infringements:** Fines of up to 10,000 UTM. - **Very serious infringements:** Fines of up to 20,000 UTM. - **Repeat infringements:** For companies that are not small businesses and repeat a serious or very serious infringement, fines can reach 2% or 4% of annual revenue, respectively. - **Uncorrected violations:** If the measures ordered by the Agency are not taken within 60 days, the fine increases by 50%. - **Public record:** Sanctions are recorded in a public National Register of Sanctions and Compliance kept by the Agency. During the first year the law is in force, the Agency may issue a written warning instead of a fine to smaller businesses. #### When will the LPPD go into effect? Law No. 21.719 is scheduled to come into force on 1 December 2026, 24 months after its publication. In September 2026, the government sent Congress a bill to postpone that date to 1 December 2027. Until such a change is approved and published, 1 December 2026 remains the legal date. #### Complying with the LPPD If your online store sells to customers in Chile, the LPPD can apply to the personal data you collect from them, including data collected through cookies and tracking tools that monitor how visitors behave on your storefront. For cookies and tracking, the main points are: - **Consent:** For analytics, advertising, and other non-essential cookies, ask for consent before they are set. Consent must come from a clear affirmative action, so pre-ticked boxes or simply continuing to browse are not enough, and visitors should be able to withdraw it at any time. - **Notice:** Tell visitors what data you collect, for what purposes, who receives it, and how they can exercise their rights, including details of the third-party tools that place cookies on your store. - **Cross-border transfers:** Many analytics and marketing tools process data outside Chile. Check that each provider offers a basis for the transfer that the law recognizes. - **Data subject requests:** Be ready to respond to requests for access, rectification, erasure, objection, and portability. To prepare, consider using a Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/chile-lppd&utm_id=pandectes)**. It shows a cookie banner that blocks non-essential cookies until the visitor consents, scans your store to detect and classify cookies automatically, and generates a cookie declaration for your policy page. It keeps consent logs as proof of each visitor’s choice, helps you handle data subject requests, and uses geolocation to show region-specific banner settings to visitors from different countries. Pandectes GDPR Compliance is designed specifically for Shopify stores. The Agency’s guidance and the law’s start date may still change, so review your setup with legal counsel where appropriate. #### Official sources - [Ley 21.719, Biblioteca del Congreso Nacional de Chile](https://www.bcn.cl/leychile/navegar?idNorma=1209272) - [Ley 21.719, Diario Oficial (13 December 2024)](https://www.diariooficial.interior.gob.cl/publicaciones/2024/12/13/44023/01/2583630.pdf) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/chile-lppd&utm_id=pandectes) --- Source: https://pandectes.io/regulations/cpa/ ### Colorado Privacy Act (CPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet CPA regulations by scanning for cookies, providing reports, and ensuring compliance with privacy standards. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/cpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is CPA? The Colorado Privacy Act provides Colorado residents with certain rights pertaining to their data and imposes obligations on those who control and process data. It shares some similarities with other state laws such as the California Privacy Rights Act (CPRA) and Virginia’s Consumer Data Protection Act (CDPA), as well as draws inspiration from the EU’s General Data Protection Regulation (GDPR). While there are resemblances, such as the inclusion of opt-out provisions for data collection and processing, safeguards for sensitive data, and the integration of privacy-by-design principles, the significant divergences lie in the specific details. This insight comes from Kirk Nahra, a seasoned privacy attorney and co-chair at Wilmer Hale. For instance, the CPRA (California) and CPA (Colorado) diverge in their definitions of “sensitive data.” As Nahra pointed out, complying with the law will require careful consideration of these distinctions. In the following discussion, we will delve into the definition of sensitive data under the CPA, along with its other stipulations. #### Who does the CPA apply to? The Colorado Privacy Act applies to “controllers” that conduct business in Colorado or produce or deliver commercial products or services that are intentionally targeted to Colorado residents. #### What happens if I don’t comply with the CPA? The CPA doesn’t specify the penalties or fines that violators will have to pay. However, violations of the regulation are considered a deceptive trade practice. This means that violations will be dealt with as per the Colorado Consumer Protection Act. Fines per violation can range from $2,000 to $20,000. CPA violations could also result in criminal charges. Enforcement of the CPA is entrusted to the Colorado attorney general and district attorneys, who bear the responsibility of implementing injunctions, penalties, and settlements. It is important to note, however, that the CPA does not provide a private right of action, meaning that individuals cannot file lawsuits against businesses for violating their rights. Before the attorney general or district attorneys can initiate any enforcement measures, they are obliged to issue a notice of violation to the relevant business. This notice grants the violators a 60-day cure period, during which they can rectify the violations. If the business remains non-compliant after the cure period, the district attorneys or attorney general can proceed with enforcement actions. As of January 1, 2025, the 60-day cure period will no longer be in effect. Instead, violators will have the option to request interpretative guidance and opinion letters from the office of the attorney general. #### When will the CPA go into effect? The CPA tasked the Colorado Attorney General with implementing and enforcing the CPA, including adopting new rules. The CPA is a part of the State of Colorado’s Consumer Protection Act and goes into effect July 1, 2023. #### Complying with the CPA The CPA stands as one of the comprehensive data privacy laws, and other states, such as Indiana, Iowa, Tennessee, and Montana, are also introducing their own privacy bills. As businesses operate across multiple states, it becomes increasingly difficult to navigate and adhere to the intricate network of state data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through state legislatures is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a **[Consent Management Platform](https://pandectes.io/features/)** (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/cpa&utm_id=pandectes)**. A CMP relieves the burden on your team by offering customizable consent management, automation of **[data subject access requests](https://pandectes.io/features/customer-data-requests/)**, and tools for cookie & vendor management. **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/cpa&utm_id=pandectes)** is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Colorado Privacy Act, Colorado Attorney General](https://coag.gov/resources/colorado-privacy-act/) - [SB21-190, Colorado General Assembly](https://leg.colorado.gov/bills/sb21-190) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/cpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/ctdpa/ ### Connecticut Data Privacy Act (CTDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet CTDPA requirements by scanning cookies, generating detailed reports, and ensuring data privacy compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ctdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is CTDPA? Effective from May 10, 2022, the CTDPA (Connecticut Data Privacy Act) grants Connecticut residents increased control over their personal data. Under this act, a consumer is defined as a resident of the state who acts on their own behalf and not in a commercial or employment context. This distinguishes it from states like California, where employees receive data privacy protection under the CPRA (California Privacy Rights Act). While the CTDPA incorporates many similar provisions found in data privacy acts of other states, it closely resembles the regulations in Colorado (CPA) and Virginia (CDPA). Like other data privacy laws, the CTDPA affords consumers the following rights: - Access to their data - Correction of inaccuracies - Deletion of personal data - Receipt of a copy of their data in a format enabling transmission to another controller - Opting out of the sale and processing of data. #### Who does the CTDPA apply to? The act applies to businesses operating in the state or targeting Connecticut residents. To be subject to the act, businesses must have either controlled or processed personal data of 100,000 or more consumers (excluding payment transactions), or controlled or processed personal data of at least 25,000 consumers while deriving more than 25% of their gross revenue from the sale of personal data. #### What happens if I don’t comply with the CTDPA? The Connecticut Attorney General possesses the power to enforce violations and impose fines of up to $5,000 per violation. Furthermore, the Attorney General can issue orders to prevent offenders from breaking the law, require them to compensate victims, and demand disgorgement of any profits obtained through illegal activities. #### When will the CTDPA go into effect? As state-level data protection legislation steadily expands, one of the country’s early comprehensive privacy laws to be enacted, the Connecticut Data Privacy Act (CTDPA), will take effect on **July 1, 2023**. #### Complying with the CTDPA The CTDPA represents one of the comprehensive data privacy laws, and more states are following suit with their own privacy bills, including Indiana, Iowa, Tennessee, and Montana. As businesses serve multiple states, it becomes challenging to navigate and comply with this complex patchwork of state data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through state legislatures is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a **[Consent Management Platform](https://pandectes.io/features/)** (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ctdpa&utm_id=pandectes)**. A CMP relieves the burden on your team by offering customizable consent management, automation of **[data subject access requests](https://pandectes.io/features/customer-data-requests/)**, and tools for cookie & vendor management. **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ctdpa&utm_id=pandectes)** is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [The Connecticut Data Privacy Act, Connecticut Attorney General](https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act) - [Public Act 22-15 (SB 6), Connecticut General Assembly](https://www.cga.ct.gov/2022/ACT/PA/PDF/2022PA-00015-R00SB-00006-PA.PDF) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ctdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/dpdpa/ ### Delaware Personal Data Privacy Act (DPDPA) Understand the Delaware Personal Data Privacy Act (DPDPA), empowering residents with enhanced data privacy rights and setting clear compliance obligations for businesses. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/dpdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is the Delaware Personal Data Privacy Act (DPDPA)? The Delaware Personal Data Privacy Act (DPDPA) is a comprehensive data privacy law designed to safeguard the personal information of Delaware residents. This legislation enhances transparency and accountability in data handling, granting individuals significant rights over their personal data while imposing strict compliance obligations on businesses. #### Who Does the DPDPA Apply To? The DPDPA applies to businesses operating in Delaware or processing personal data of its residents. It primarily targets entities that meet specific thresholds, such as processing substantial volumes of personal data or deriving significant revenue from data-related activities. These criteria focus the law on businesses with a meaningful impact on consumer data handling. #### What happens if I don’t comply with the DPDPA? Non-compliance with the DPDPA can result in significant penalties: - **Fines**: Up to $7,500 per violation. - **Legal Remedies**: Consumers may seek damages for violations. - **Reputational Risks**: Businesses may face public scrutiny and loss of consumer trust. #### When will the DPDPA go into effect? The Delaware Personal Data Privacy Act (DPDPA) is scheduled to take effect on January 1, 2025. #### Complying with the DPDPA - **Update Privacy Practices** Ensure your business’s privacy policies meet DPDPA requirements. - **Enable Consumer Rights** Implement systems to handle requests for data access, deletion, and opt-outs effectively. - **Strengthen Security** Adopt advanced data protection measures to prevent breaches and unauthorized access. - **Leverage Compliance Solutions** The **Pandectes GDPR Compliance App** helps Shopify stores achieve compliance with features like automated data request management, consent tracking, and customizable privacy notices. #### Official sources - [Personal Data Privacy Portal, Delaware Department of Justice](https://attorneygeneral.delaware.gov/fraud/personal-data-privacy-portal/business/) - [House Bill 154, Delaware General Assembly](https://legis.delaware.gov/BillDetail?LegislationId=140388) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/dpdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/fadp/ ### Federal Act on Data Protection (FADP) Compliance Pandectes GDPR Compliance helps Shopify Stores comply with the Federal Act on Data Protection (FADP) by scanning them and identifying the cookies and tracking technologies in use. The scan generates a report that classifies these technologies based on regulatory guidelines and provides options for updates to ensure compliance with APPI. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/fadp&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is FADP? The Federal Act on Data Protection (FADP) in Switzerland has been updated to address modern digital challenges. Introduced in 1992, it was revised in 2020 with the New Federal Act on Data Protection (nFADP), which came into effect on 1 September 2023. The nFADP focuses on protecting individual data, classifying genetic and biometric information as sensitive, and emphasizes principles like “Privacy by Design”. It aligns closely with the European GDPR, ensuring seamless data exchange between Switzerland and the EU. #### Who does the FADP apply to? The Federal Act on Data Protection (FADP) applies to organizations that process data of Swiss data subjects. #### What happens if I don’t comply with the FADP? If you don’t comply with the Federal Act on Data Protection (FADP), there are several consequences: **Enforcement by FDPIC**: The powers of the Federal Data Protection and Information Commissioner (FDPIC) have been expanded. The FDPIC can initiate an investigation into a company either on its own initiative or upon notification. In the event of breaches of data protection regulations, the FDPIC can order measures such as the adjustment or suspension of data processing, or even the deletion of data. **Civil Law Remedies**: Under the revised FADP, data subjects have civil law remedies to enforce their claims. Changes made to the Civil Procedure Code stipulate that the relevant court proceedings are to be free of charge. **Fines**: In the event of intentional breaches of the revised FADP, such as failures to provide information, cooperate, or exercise due diligence: - Private individuals may be fined up to CHF 250,000. - In business operations, if identifying the offending persons would involve disproportionate effort, companies can be fined up to CHF 50,000. If a fine of no more than CHF 50,000 would be considered for such persons, they can also be fined. #### When did the FADP go into effect? The revised **Federal Act on Data Protection (FADP)**, adopted by the Swiss Parliament on 25 September 2020, came into effect on **September 1, 2023**, together with its Data Protection Ordinance, which the Federal Council issued on 31 August 2022. There was no transition period, so its rules have applied in full since that date. #### Complying with the FADP The FADP stands as one of the comprehensive data privacy laws, and other countries, such as Germany, France, and Italy, are also introducing their own privacy regulations. As businesses operate across multiple jurisdictions, it becomes increasingly difficult to navigate and adhere to the intricate network of international data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through national legislatures is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a Consent Management Platform (CMP) like [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/fadp&utm_id=pandectes). A CMP relieves the burden on your team by offering customizable consent management, automation of data subject access requests, and tools for cookie & vendor management. Pandectes GDPR Compliance is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Federal Act on Data Protection (FADP), Fedlex](https://www.fedlex.admin.ch/eli/cc/2022/491/en) - [Federal Data Protection and Information Commissioner (FDPIC)](https://www.edoeb.admin.ch/en) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/fadp&utm_id=pandectes) --- Source: https://pandectes.io/regulations/gdpr/ ### Achieve compliance with the General Data Protection Regulation Pandectes GDPR Compliance helps Shopify stores scan for cookies, classify them, and ensure compliance with GDPR guidelines through actionable reports. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/gdpr&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is GDPR? GDPR stands for General Data Protection Regulation. It is a regulation put in place by the European Union (EU) to protect the personal data of individuals within the EU. It went into effect on May 25, 2018, and applies to any company that processes the personal data of EU citizens, regardless of where the company is based. It gives individuals more control over their personal data and how it is used, and it also imposes strict penalties on companies that fail to comply with the regulation. Shopify is an e-commerce platform that allows businesses to create and run an online store. As a company that processes the personal data of EU citizens, Shopify is required to comply with the GDPR. However, it is important to note that while Shopify can help with compliance, it is ultimately the responsibility of the merchant to ensure that they are fully compliant with GDPR. They should also consult with legal advisors to ensure that they are taking all necessary steps to protect their customers’ personal data and comply with the regulation. #### Who does the GDPR apply to? The GDPR applies to Stores operating within the EU, EEA, UK, and Switzerland that process personal data and organizations outside the EU, EEA, UK, and Switzerland that offer goods or services to individuals within the EU, EEA, UK and Switzerland. #### What happens if I don’t comply with the GDPR? Failing to comply with the General Data Protection Regulation (GDPR) can result in significant fines and penalties. The GDPR gives supervisory authorities the power to impose administrative fines for non-compliance. The fines can be up to 4% of a company’s global annual revenue or €20 million (whichever is greater). Fines can be imposed for a variety of reasons, including failure to comply with the principles of data protection by design and by default, failure to appoint a Data Protection Officer (DPO), failure to conduct a Data Protection Impact Assessment (DPIA), and failure to report a data breach. In addition to fines, supervisory authorities can also impose other penalties, such as ordering companies to stop processing personal data, requiring companies to rectify non-compliance, and issuing reprimands. In some cases, non-compliance with GDPR can also result in legal action being taken against a company by individuals whose personal data has been affected. It’s important to note that GDPR compliance is not only about avoiding fines and penalties, but also about protecting people’s personal data and respecting their rights. #### When will the GDPR go into effect? The General Data Protection Regulation (GDPR) went into effect on May 25th, 2018. #### Complying with the GDPR The GDPR stands as one of the comprehensive data privacy laws, and other regions, such as the United States, Canada, and Australia, are also introducing their own privacy regulations. As businesses operate across multiple jurisdictions, it becomes increasingly difficult to navigate and adhere to the intricate network of international data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through national and international legislative bodies is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. If you sell on Shopify, our [Shopify GDPR compliance guide](https://pandectes.io/blog/shopify-gdpr/) walks through the eight steps a store needs, with the admin path for each, and our guide to [handling GDPR data requests on Shopify](https://pandectes.io/blog/shopify-gdpr-data-requests/) covers access and erasure requests step by step. To streamline the data compliance process, consider utilizing a Consent Management Platform (CMP) like [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/gdpr&utm_id=pandectes). A CMP relieves the burden on your team by offering customizable consent management, automation of data subject access requests, and tools for cookie & vendor management. Pandectes GDPR Compliance is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Regulation (EU) 2016/679 (GDPR), official text on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - [European Data Protection Board (EDPB)](https://www.edpb.europa.eu/) - [UK GDPR guidance and resources, Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/gdpr&utm_id=pandectes) --- Source: https://pandectes.io/regulations/icdpa/ ### Iowa Consumer Data Protection Act (ICDPA) Discover how the Iowa Consumer Data Protection Act (ICDPA) empowers Iowa residents with greater control over their personal data while mandating transparency and accountability for businesses. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/icdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is the Iowa Consumer Data Protection Act (ICDPA)? The Iowa Consumer Data Protection Act (ICDPA) is a landmark data privacy law aimed at protecting the rights of Iowa residents. The law grants individuals rights over their personal data and establishes clear guidelines for businesses regarding the collection, use, and sharing of personal information. It reflects Iowa’s commitment to enhancing consumer privacy and aligning with national and global data protection trends. #### Who Does the ICDPA Apply To? The ICDPA applies to businesses operating in Iowa or processing data from its residents. These include entities meeting specific thresholds, such as processing large volumes of personal data or generating substantial revenue from data-related activities. The act focuses on businesses that significantly influence consumer data handling in Iowa. #### What happens if I don’t comply with the ICDPA? Businesses failing to comply with the ICDPA face significant consequences: - **Fines**: Up to $7,500 per violation. - **Legal Remedies**: Consumers may pursue damages for violations. - **Reputational Risks**: Non-compliance can harm trust and business credibility. #### When will the ICDPA go into effect? The Iowa Consumer Data Protection Act (ICDPA) is scheduled to take effect on January 1, 2025. #### Complying with the ICDPA - **Update Privacy Policies** Ensure data collection and processing practices are transparent and compliant. - **Implement Consumer Request Mechanisms** Adopt systems to facilitate access, deletion, and portability requests efficiently. - **Strengthen Data Security** Enhance measures to safeguard personal data and prevent breaches. - **Use Compliance Tools** The **Pandectes GDPR Compliance App** provides Shopify stores with tools to streamline ICDPA compliance, manage consumer data requests, and maintain transparency. #### Official sources - [Iowa Code Chapter 715D, Consumer Data Protections](https://www.legis.iowa.gov/docs/code/715D.pdf) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/icdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/india-dpdpa/ ### India Digital Personal Data Protection Act (DPDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet DPDPA requirements by collecting consent before non-essential cookies, scanning and classifying cookies, and keeping consent records. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/india-dpdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is DPDPA? The Digital Personal Data Protection Act, 2023 (DPDPA) is India’s first comprehensive data protection law. It governs how businesses, which the Act calls “Data Fiduciaries”, process the digital personal data of individuals, called “Data Principals”. The Digital Personal Data Protection Rules, 2025 (DPDP Rules) set out the practical details, such as what a consent notice must contain and how to respond to requests. Key requirements of the DPDPA include: - Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. - Each request for consent must come with a clear notice explaining what data is collected and why. Individuals can ask for the notice in English or in any of the languages listed in the Eighth Schedule to the Constitution. - Individuals can withdraw consent at any time, and withdrawing must be comparably easy to giving consent. - Processing a child’s data (anyone under 18) needs verifiable consent from a parent or guardian, and tracking, behavioral monitoring and targeted advertising directed at children are prohibited. - Individuals have rights to access, correct, update and erase their data, and requests must be answered within 90 days. - Data Fiduciaries must protect data with reasonable security safeguards and report personal data breaches. #### Who does the DPDPA apply to? The DPDPA applies to digital personal data processed in India. It also applies to processing outside India when it is connected to offering goods or services to people in India, so an online store based elsewhere that sells to customers in India is covered. #### What happens if I don’t comply with the DPDPA? The DPDPA is enforced by the Data Protection Board of India, which can inquire into breaches of the law and impose financial penalties. The maximum penalties are set in a schedule to the Act: - **Up to ₹250 crore** for failing to take reasonable security safeguards to prevent a personal data breach. - **Up to ₹200 crore** for failing to notify the Board and affected individuals of a personal data breach. - **Up to ₹200 crore** for breaching the additional obligations for children’s data. - **Up to ₹50 crore** for other breaches of the Act or the Rules by a Data Fiduciary. The Board decides each penalty based on factors such as the nature, gravity and duration of the breach. Appeals against its decisions go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). #### When will the DPDPA go into effect? The DPDPA received presidential assent on August 11, 2023, and the DPDP Rules were notified in November 2025. The provisions setting up the Data Protection Board took effect immediately, the rules for registered Consent Managers apply from November 2026, and the main obligations on businesses, including notice, consent, children’s data and data subject rights, apply from May 2027. #### Complying with the DPDPA Shopify stores that sell to customers in India should use the remaining time before May 2027 to prepare. Where cookies and tracking tools process personal data, the visitor’s consent must be a clear affirmative action, so pre-ticked boxes or treating continued browsing as consent will not meet the standard. The consent notice must stand on its own, list the data collected and each specific purpose in plain language, and visitors must be able to withdraw it as easily as they gave it. If your store may be used by children, take particular care with tracking and targeted advertising. The DPDPA does not require a specific mechanism for transferring data abroad, but the government can restrict transfers to countries it notifies, so keep an eye on any such list. You should also publish contact details for privacy questions and set up a process to answer access, correction and erasure requests on time. A Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/india-dpdpa&utm_id=pandectes)** helps with the parts of this that happen on your storefront. It shows a cookie banner and blocks non-essential cookies until the visitor consents, automatically scans and classifies the cookies on your store, and generates a cookie declaration for your policy. It keeps consent logs as proof of consent, helps you handle data subject requests, and lets you configure banner settings by region using geolocation, so visitors from India can see a banner suited to the DPDPA. Because the DPDPA is new and guidance from the Board is still developing, review your setup with legal counsel where appropriate. #### Official sources - [Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Ministry of Electronics and Information Technology](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, Ministry of Electronics and Information Technology](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) - [DPDP Rules, 2025 Notified, Press Information Bureau](https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/india-dpdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/indiana-icdpa/ ### Indiana Consumer Data Protection Act (ICDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet Indiana ICDPA requirements by managing cookie consent, opt-outs of targeted advertising and sale, and consumer privacy requests. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/indiana-icdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is ICDPA? The Indiana Consumer Data Protection Act (ICDPA) is Indiana’s comprehensive consumer privacy law. It was enacted in 2023 as Senate Enrolled Act 5 and is codified at Indiana Code 24-15. It closely follows the Virginia Consumer Data Protection Act, giving Indiana residents rights over their personal data and setting rules for the businesses that collect it. Under the ICDPA, Indiana consumers have the right to: - Confirm whether a business processes their personal data and get a copy or representative summary of the data they provided - Correct inaccuracies in the personal data they provided - Delete personal data provided by or obtained about them - Receive their personal data in a portable, readily usable format - Opt out of targeted advertising, the sale of their personal data, and profiling that produces legal or similarly significant effects The law also defines sensitive data, which includes racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, precise geolocation, and personal data of a known child. #### Who does the ICDPA apply to? The ICDPA applies to businesses that operate in Indiana or target products or services to Indiana residents and, in a calendar year, either process the personal data of at least 100,000 Indiana consumers, or process the personal data of at least 25,000 Indiana consumers and derive more than 50% of gross revenue from selling personal data. Government bodies, financial institutions, HIPAA covered entities, nonprofits, institutions of higher education, and public utilities are among those exempt. #### What happens if I don’t comply with the ICDPA? The Indiana Attorney General has exclusive authority to enforce the ICDPA. The main points are: - **Cure period**: before bringing an action, the Attorney General must give written notice and 30 days to cure the violation and confirm in writing that it will not happen again. This cure period is permanent and does not expire. - **Civil penalties**: up to $7,500 for each violation, along with an injunction to stop the violation. - **Costs**: the Attorney General may recover reasonable investigation expenses and attorney’s fees. - **No private right of action**: consumers cannot sue a business directly under the ICDPA. They can file a complaint with the Attorney General. #### When did the ICDPA go into effect? The ICDPA took effect on January 1, 2026. Businesses that meet its thresholds must comply now. #### Complying with the ICDPA If your online store meets the ICDPA’s thresholds, the work that matters most for cookies and tracking looks like this: - **Offer an opt-out of targeted advertising and sale.** Advertising pixels and tags that track visitors across other websites are typically targeted advertising. If you sell personal data or use it for targeted advertising, you must clearly and conspicuously disclose this and explain how consumers can opt out. A visible opt-out link and a cookie banner with clear choices are the usual way to do this. The ICDPA does not require businesses to honor universal opt-out signals such as Global Privacy Control. - **Get opt-in consent for sensitive data.** You must not process sensitive data, such as precise geolocation, without the consumer’s consent. Data from a known child must be handled under the federal Children’s Online Privacy Protection Act. - **Publish a clear privacy notice.** It must describe the categories of personal data you process, why you process it, the categories you share with third parties and who those third parties are, and how consumers can exercise their rights and appeal your decisions. - **Handle consumer requests on time.** Provide at least one secure and reliable way to submit requests, without requiring a new account. Respond within 45 days, extendable once by another 45 days when reasonably necessary, and answer appeals within 60 days. - **Keep collection to what you need.** Limit personal data to what is adequate, relevant, and reasonably necessary for the purposes you disclose, and protect it with reasonable security practices. To make this easier, consider a Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/indiana-icdpa&utm_id=pandectes)**. It is built for Shopify stores and provides a cookie banner with opt-out options for US states, a “Do not sell or share my personal information” link, automatic cookie scanning and classification, a cookie declaration, consent logs, and data subject request handling. Region-specific banner settings let you show Indiana visitors the right experience based on their location. Every business is different, so review your obligations under the ICDPA with legal counsel where appropriate. #### Official sources - [Indiana Code 24-15, Consumer Data Protection, Indiana General Assembly](https://iga.in.gov/ic/2024/Title_24/Article_15.pdf) - [Indiana Consumer Data Protection Bill of Rights, Indiana Attorney General](https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf) - [Senate Enrolled Act 5 (2023), Indiana General Assembly](https://iga.in.gov/legislative/2023/bills/senate/5) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/indiana-icdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/kcdpa/ ### Kentucky Consumer Data Protection Act (KCDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet Kentucky KCDPA requirements by managing cookie consent, opt-outs of targeted advertising and sale, and consumer privacy requests. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/kcdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is KCDPA? The Kentucky Consumer Data Protection Act (KCDPA) is Kentucky’s comprehensive consumer privacy law. It was enacted in 2024 as House Bill 15 and added to Chapter 367 of the Kentucky Revised Statutes. It closely follows the Virginia Consumer Data Protection Act, giving Kentucky residents rights over their personal data and setting rules for the businesses that collect it. Under the KCDPA, Kentucky consumers have the right to: - Confirm whether a business processes their personal data and access it - Correct inaccuracies in their personal data - Delete personal data provided by or obtained about them - Obtain a portable copy of the personal data they provided - Opt out of targeted advertising, the sale of their personal data, and profiling that produces legal or similarly significant effects The law also defines sensitive data, which includes racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, precise geolocation, and personal data collected from a known child. #### Who does the KCDPA apply to? The KCDPA applies to businesses that operate in Kentucky or target products or services to Kentucky residents and, in a calendar year, either process the personal data of at least 100,000 consumers, or process the personal data of at least 25,000 consumers and derive more than 50% of gross revenue from selling personal data. Government bodies, financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofits, and institutions of higher education are among those exempt. #### What happens if I don’t comply with the KCDPA? The Kentucky Attorney General has exclusive authority to enforce the KCDPA. The main points are: - **Cure period**: before bringing an action, the Attorney General must give written notice and 30 days to cure the violation and confirm in writing that it will not happen again. This cure period is permanent and does not expire. - **Penalties**: if the violation continues after the cure period, or the written statement is breached, the Attorney General may seek up to $7,500 for each continued violation. - **Costs**: the Attorney General may recover reasonable investigation expenses, court costs, and attorney’s fees. - **No private right of action**: consumers cannot sue a business directly under the KCDPA. They can file a complaint with the Attorney General. #### When did the KCDPA go into effect? The KCDPA took effect on January 1, 2026. Businesses that meet its thresholds must comply now. #### Complying with the KCDPA If your online store meets the KCDPA’s thresholds, the work that matters most for cookies and tracking looks like this: - **Offer an opt-out of targeted advertising and sale.** Advertising pixels and tags that track visitors across other websites are typically targeted advertising. If you sell personal data or use it for targeted advertising, you must clearly and conspicuously disclose this and explain how consumers can opt out. A visible opt-out link and a cookie banner with clear choices are the usual way to do this. The KCDPA does not require businesses to honor universal opt-out signals such as Global Privacy Control. - **Get opt-in consent for sensitive data.** You must not process sensitive data, such as precise geolocation, without the consumer’s consent. Data collected from a known child must be handled under the federal Children’s Online Privacy Protection Act. - **Publish a clear privacy notice.** It must describe the categories of personal data you process, why you process it, the categories you share with third parties and who those third parties are, and how consumers can exercise their rights and appeal your decisions. - **Handle consumer requests on time.** Provide at least one secure and reliable way to submit requests, without requiring a new account. Respond within 45 days, extendable once by another 45 days when reasonably necessary, and answer appeals within 60 days. - **Keep collection to what you need.** Limit personal data to what is adequate, relevant, and reasonably necessary for the purposes you disclose, and protect it with reasonable security practices. To make this easier, consider a Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/kcdpa&utm_id=pandectes)**. It is built for Shopify stores and provides a cookie banner with opt-out options for US states, a “Do not sell or share my personal information” link, automatic cookie scanning and classification, a cookie declaration, consent logs, and data subject request handling. Region-specific banner settings let you show Kentucky visitors the right experience based on their location. Every business is different, so review your obligations under the KCDPA with legal counsel where appropriate. #### Official sources - [Kentucky Consumer Data Protection Act, Acts Chapter 72 (HB 15), Kentucky General Assembly](https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf) - [HB 15 (2024), Kentucky General Assembly](https://apps.legislature.ky.gov/record/24rs/hb15.html) - [Rights of Kentuckians under the Kentucky Consumer Data Protection Act, Kentucky Attorney General](https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/kcdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/kvkk/ ### Turkey Personal Data Protection Law (KVKK) Compliance Pandectes GDPR Compliance helps Shopify stores meet KVKK requirements by blocking non-essential cookies until visitors consent, scanning and classifying cookies, and keeping consent records. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/kvkk&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is KVKK? KVKK is Turkey’s Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu), often called the PDPL in English. It was published in the Official Gazette on 7 April 2016 and sets the rules for how personal data of individuals may be collected, used, stored, and transferred. It is enforced by the Personal Data Protection Authority and its decision-making body, the Personal Data Protection Board. KVKK was modeled on EU data protection law and shares many ideas with the GDPR. Its main principles include: - Processing personal data only on a legal basis, with explicit consent as the central one. Explicit consent must be freely given, specific, and informed. - Informing people, at the time their data is collected, who the data controller is, why the data is processed, who it is shared with, and what their rights are. - Giving individuals the right to learn whether their data is processed, to access it, to have it corrected or erased, and to object to certain results of automated analysis. - Keeping personal data secure and reporting data breaches to the Board and to the people affected. - Transferring personal data abroad only under the conditions set by the law. Law No. 7499 amended KVKK from 1 June 2024, bringing its cross-border transfer rules closer to the GDPR. Transfers can now rely on an adequacy decision, on appropriate safeguards such as the Board’s standard contracts (which must be notified to the Authority within five business days of signing) or binding corporate rules, or on limited occasional exceptions. The amendments also widened the legal grounds for processing sensitive data. #### Who does the KVKK apply to? KVKK applies to individuals and organizations that process the personal data of natural persons, whether by automated means or as part of a filing system. The law has no explicit extraterritorial clause, but the Authority applies it to the processing of personal data of people in Turkey, and data controllers based abroad may need to appoint a representative in Turkey and register with the Data Controllers’ Registry (VERBIS). #### What happens if I don’t comply with the KVKK? Breaches of KVKK can lead to: - **Administrative fines:** The fines in Article 18 are revalued every year. For 2026, the highest fines reach TRY 17,092,242, for example for failing to meet data security obligations, ignoring Board decisions, or not registering with VERBIS. - **Fines for transparency failures:** Failing to meet the obligation to inform people can be fined up to TRY 1,709,200 in 2026. - **Fines for unreported transfers:** Since the 2024 amendments, failing to notify the Authority of a standard contract used for a cross-border transfer is also subject to a fine. - **Board decisions:** The Board can order a controller to remedy a violation or stop unlawful processing. - **Criminal liability:** Unlawfully recording, disclosing, or failing to delete personal data can be prosecuted under the Turkish Penal Code. #### When did the KVKK go into effect? KVKK came into force on 7 April 2016, the day it was published. The provisions on transfers, data subject rights, complaints, the registry, and penalties applied from 7 October 2016, six months later. The 2024 amendments took effect on 1 June 2024. #### Complying with the KVKK If your online store sells to customers in Turkey, KVKK can apply to the personal data you collect from them, including data collected by cookies and tracking tools. For cookies and tracking, the main points are: - **Consent:** The Authority’s 2022 guideline on cookies expects explicit consent before using cookies for purposes such as advertising, marketing, and behavioral tracking. Strictly necessary cookies, such as those that keep a shopping cart working, can be used without consent. Consent should be an active choice, so pre-ticked boxes or continued browsing do not count. - **Notice:** Tell visitors which cookies you use, what each one does, how long it lasts, and whether it is set by you or a third party. - **Cross-border transfers:** Many analytics and advertising tools send data to servers outside Turkey. Check how each provider handles transfers under the amended Article 9, for example through standard contracts. - **Data subject requests:** Be ready to answer requests to access, correct, or erase personal data. The law requires controllers to respond within 30 days. To make this manageable, consider using a Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/kvkk&utm_id=pandectes)**. It shows a cookie banner that blocks non-essential cookies until the visitor consents, scans your store to detect and classify cookies automatically, and generates a cookie declaration for your policy page. It keeps consent logs as proof of each visitor’s choice, helps you handle data subject requests, and uses geolocation to show region-specific banner settings to visitors from different countries. Pandectes GDPR Compliance is designed specifically for Shopify stores. KVKK has its own definitions and procedures, so review your setup with legal counsel where appropriate, especially for cross-border transfers and VERBIS registration. #### Official sources - [Law No. 6698 on the Protection of Personal Data (English), Personal Data Protection Authority](https://www.kvkk.gov.tr/Icerik/6649/Personal-Data-Protection-Law) - [Law No. 6698 (Turkish, consolidated), Mevzuat Bilgi Sistemi](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf) - [Personal Data Protection Authority (KVKK)](https://www.kvkk.gov.tr/en/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/kvkk&utm_id=pandectes) --- Source: https://pandectes.io/regulations/lgpd/ ### Lei Geral de Proteção de Dados Pessoais (LGPD) Compliance Pandectes GDPR Compliance helps Shopify stores meet LGPD requirements by scanning for cookies, generating reports, and providing updates to ensure compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/lgpd&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is LGPD? The Lei Geral de Proteção de Dados Pessoais (LGPD) is Brazil’s data protection law that regulates the collection, use, and storage of personal data of Brazilian citizens. Effective August 2020, it aligns closely with the EU’s General Data Protection Regulation (GDPR). The LGPD applies to any organization processing personal data related to Brazilian citizens, regardless of the organization’s location. It establishes principles such as data minimization, quality, purpose limitation, transparency, and security. The LGPD also provides rights for data subjects, including access, correction, deletion, and data portability. Additionally, it requires organizations to appoint a Data Protection Officer (DPO) and conduct Data Protection Impact Assessments (DPIA) for new processing activities. #### Who does the LGPD apply to? The LGPD applies to any organization processing personal data, whether or not based in Brazil, as long as the data pertains to Brazilian citizens. #### What happens if I don’t comply with the LGPD? Non-compliance with the LGPD can result in significant fines and penalties. The National Data Protection Authority (ANPD) can impose administrative fines up to 2% of the company’s annual gross revenue or up to 50 million reais (approximately 8.5 million US dollars), whichever is higher. Fines may be imposed for failing to adhere to data protection principles, not appointing a DPO, neglecting DPIAs, not reporting data breaches, or failing to provide data subject rights under the LGPD. Additional penalties can include orders to cease data processing, rectifying non-compliance, and reprimands. Legal actions from affected individuals are also possible. #### When will the LGPD go into effect? The LGPD came into effect on August 14, 2020. However, the ANPD implemented a transitional period until August 2021, focusing on guidance and education rather than immediate fines and penalties. #### Complying with the LGPD The LGPD is among a growing set of global data privacy laws, with countries like Argentina, Chile, and Mexico also introducing privacy regulations. Navigating these laws can be complex, especially for businesses operating across multiple jurisdictions. To maintain compliance, stay informed about evolving legislation and consult with legal counsel when new laws are enacted. A Consent Management Platform (CMP) like Pandectes GDPR Compliance can simplify the process by offering customizable consent management, automating data subject access requests, and managing cookies and vendors. [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/lgpd&utm_id=pandectes) is specifically designed for Shopify stores, helping you achieve and maintain compliance amidst the dynamic data privacy landscape. #### Official sources - [Lei nº 13.709/2018 (LGPD), Presidência da República](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm) - [Autoridade Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/pt-br) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/lgpd&utm_id=pandectes) --- Source: https://pandectes.io/regulations/mcdpa/ ### Montana Consumer Data Protection Act (MCDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet MCDPA requirements by scanning for cookies, generating reports, and ensuring data privacy compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/mcdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is MCDPA? The Montana Consumer Data Protection Act (MCDPA) provides Montana residents with certain rights pertaining to their data and imposes obligations on those who control and process data. It shares some similarities with other state laws such as the California Privacy Rights Act (CPRA) and Virginia’s Consumer Data Protection Act (CDPA), as well as draws inspiration from the EU’s General Data Protection Regulation (GDPR). While there are resemblances, such as the inclusion of opt-out provisions for data collection and processing, safeguards for sensitive data, and the integration of privacy-by-design principles, the significant divergences lie in the specific details. This insight comes from Kirk Nahra, a seasoned privacy attorney and co-chair at Wilmer Hale. For instance, the CPRA (California) and MCDPA (Montana) diverge in their definitions of “sensitive data.” As Nahra pointed out, complying with the law will require careful consideration of these distinctions. In the following discussion, we will delve into the definition of sensitive data under the MCDPA, along with its other stipulations. #### Who does the MCDPA apply to? The Montana Consumer Data Protection Act (MCDPA) applies to “controllers” that conduct business in Montana or produce or deliver commercial products or services that are intentionally targeted to Montana residents. #### What happens if I don’t comply with the MCDPA? The MCDPA doesn’t specify the penalties or fines that violators will have to pay. However, violations of the regulation are considered a deceptive trade practice. This means that violations will be dealt with as per the Montana Consumer Protection Act. Fines per violation can range from $2,000 to $20,000. MCDPA violations could also result in criminal charges. Enforcement of the MCDPA is entrusted to the Montana attorney general and district attorneys, who bear the responsibility of implementing injunctions, penalties, and settlements. It is important to note, however, that the MCDPA does not provide a private right of action, meaning that individuals cannot file lawsuits against businesses for violating their rights. Before the attorney general or district attorneys can initiate any enforcement measures, they are obliged to issue a notice of violation to the relevant business. This notice grants the violators a 60-day cure period, during which they can rectify the violations. If the business remains non-compliant after the cure period, the district attorneys or attorney general can proceed with enforcement actions. As of January 1, 2025, the 60-day cure period will no longer be in effect. Instead, violators will have the option to request interpretative guidance and opinion letters from the office of the attorney general. #### When will the MCDPA go into effect? The MCDPA tasks the Montana Attorney General with implementing and enforcing the MCDPA, including adopting new rules. The MCDPA is a part of the State of Montana’s Consumer Protection Act and goes into effect on July 1, 2025. #### Complying with the MCDPA The MCDPA stands as one of the comprehensive data privacy laws, and other states, such as Indiana, Iowa, Tennessee, and Colorado, are also introducing their own privacy bills. As businesses operate across multiple states, it becomes increasingly difficult to navigate and adhere to the intricate network of state data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through state legislatures is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/mcdpa&utm_id=pandectes)**. A CMP relieves the burden on your team by offering customizable consent management, automation of data subject access requests, and tools for cookie & vendor management. Pandectes GDPR Compliance is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Montana Code Annotated, Title 30, Chapter 14, Part 28 (Consumer Data Privacy Act)](https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/mcdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/minnesota-mcdpa/ ### Minnesota Consumer Data Privacy Act (MCDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet Minnesota MCDPA requirements by managing cookie consent, honoring opt-out signals and handling consumer privacy requests. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/minnesota-mcdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is MCDPA? The Minnesota Consumer Data Privacy Act (MCDPA) is Minnesota’s comprehensive consumer privacy law. It gives Minnesota residents rights over their personal data and sets obligations for the businesses that collect and process it. Montana’s privacy law shares the same acronym, but this page covers the Minnesota law only. The Minnesota law follows the general model of other US state privacy laws, with a few features that go further. Minnesota residents have the right to: - Confirm whether a business processes their personal data, and access that data - Correct inaccurate personal data - Delete personal data - Obtain a portable copy of their personal data - Opt out of targeted advertising, the sale of their personal data, and certain types of profiling - Obtain a list of the specific third parties to which the business has disclosed their personal data - Question the result of a profiling decision that has legal or similarly significant effects, learn the reasons behind it, and have it reevaluated if it was based on inaccurate data Businesses also have to obtain consent before processing sensitive data, such as health data, precise geolocation, biometric data, or data revealing racial or ethnic origin. They must limit data collection to what is adequate, relevant, and reasonably necessary for the purposes they disclose, and keep an inventory of the personal data they manage as part of their data security practices. #### Who does the MCDPA apply to? The Minnesota law applies to businesses that operate in Minnesota or offer products or services targeted to Minnesota residents, and that in a calendar year control or process the personal data of at least 100,000 Minnesota consumers (not counting data used only to complete a payment), or of at least 25,000 consumers while earning more than 25% of gross revenue from selling personal data. Small businesses as defined by the US Small Business Administration are exempt, but they still may not sell a consumer’s sensitive data without prior consent. #### What happens if I don’t comply with the MCDPA? The Minnesota Attorney General enforces the law. Key points about enforcement: - A business that violates the law can face an injunction and a civil penalty of up to $7,500 per violation. - The law does not create a private right of action, so consumers cannot sue businesses directly under it. - Until January 31, 2026, the Attorney General had to send a warning letter and allow 30 days to fix a violation before taking action. That cure period has expired, so the Attorney General can now bring enforcement actions without prior notice. #### When did the MCDPA go into effect? Minnesota’s law took effect on July 31, 2025. Postsecondary institutions were given until July 31, 2029 to comply, but online stores and other businesses that meet the thresholds are already covered. #### Complying with the MCDPA If your online store sells to Minnesota residents and meets the thresholds above, most of your practical work involves cookies and tracking. Marketing pixels, analytics tags, and advertising cookies often count as targeted advertising or a “sale” of personal data under state privacy laws, so they need to respect each visitor’s choices. Practical steps for a Shopify store include: - **Offer a clear opt-out.** Give visitors an easy way to opt out of targeted advertising and the sale of their personal data, such as a “Do not sell or share my personal information” link, and make sure tracking stops once they do. - **Honor universal opt-out signals.** The Minnesota law requires businesses to let consumers opt out through a universal opt-out mechanism sent by their browser or device, such as Global Privacy Control (GPC). - **Get consent for sensitive data.** Do not process sensitive data without the consumer’s consent, and review your apps and forms for anything that collects it. - **Keep a data inventory.** Document what personal data your store collects, where it is stored, and which apps and partners receive it. This also makes it easier to give customers the list of specific third parties they are entitled to request. - **Update your privacy notice.** Explain what personal data you collect, why, who receives it, how long you keep it, and how consumers can exercise their rights, including their right to question profiling decisions. - **Handle consumer requests.** Set up a reliable way for customers to request access, correction, deletion, or a copy of their data, and respond within the required timeframe. A consent management platform makes these steps much easier to maintain. **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/minnesota-mcdpa&utm_id=pandectes)** is built for Shopify stores and provides a cookie banner with opt-out options for US states, a “Do not sell or share my personal information” link, and support for the Global Privacy Control signal. It automatically scans and classifies the cookies on your store, generates a cookie declaration, keeps consent logs, and helps you handle data subject requests. Region-specific banner settings use geolocation to show the right experience to visitors from Minnesota and other states. Privacy laws differ in their details and continue to change, so review your setup with legal counsel where appropriate. #### Official sources - [Minnesota Statutes Chapter 325M, Minnesota Office of the Revisor of Statutes](https://www.revisor.mn.gov/statutes/cite/325M) - [Minnesota Consumer Data Privacy Act, Minnesota Attorney General](https://www.ag.state.mn.us/Data-Privacy/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/minnesota-mcdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/modpa/ ### Maryland Online Data Privacy Act (MODPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet MODPA requirements by managing cookie consent, honoring opt-out signals and handling consumer privacy requests. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/modpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is MODPA? The Maryland Online Data Privacy Act (MODPA) is Maryland’s comprehensive consumer privacy law. It gives Maryland residents rights over their personal data and sets rules for the businesses that collect and use it. MODPA follows the general model of other US state privacy laws, but it is widely seen as one of the strictest, mainly because of its data minimization rules and its limits on sensitive data. Under MODPA, Maryland residents have the right to: - Confirm whether a business processes their personal data, and access that data - Correct inaccurate personal data - Delete personal data - Obtain a portable copy of their personal data - Obtain a list of the categories of third parties to which their data has been disclosed - Opt out of targeted advertising, the sale of their personal data, and certain types of profiling The law also sets stricter rules than most states in several areas. A business must limit the personal data it collects to what is reasonably necessary and proportionate to provide the product or service the consumer asked for. Sensitive data, such as health data, precise geolocation, biometric data, or data revealing racial or ethnic origin, may only be collected or processed when it is strictly necessary for the requested product or service, and selling sensitive data is prohibited outright. Businesses may not sell personal data or use it for targeted advertising when they know, or should have known, that the consumer is under 18. #### Who does the MODPA apply to? MODPA applies to businesses that operate in Maryland or offer products or services targeted to Maryland residents, and that in the previous calendar year controlled or processed the personal data of at least 35,000 Maryland consumers (not counting data used only to complete a payment), or of at least 10,000 Maryland consumers while earning more than 20% of gross revenue from selling personal data. Some entities and data types are exempt, such as government bodies and data covered by the federal Gramm-Leach-Bliley Act. #### What happens if I don’t comply with the MODPA? A violation of MODPA is treated as an unfair, abusive, or deceptive trade practice under the Maryland Consumer Protection Act. Key points about enforcement: - The Maryland Attorney General, through its Consumer Protection Division, enforces the law. - Civil penalties under the Consumer Protection Act can reach $10,000 per violation, and up to $25,000 for each repeated violation. - MODPA does not give consumers a private right of action to sue under the law itself. - For violations that occur on or before April 1, 2027, the Attorney General may send a notice of violation and allow at least 60 days to fix the problem, if it decides a cure is possible. This is discretionary, not guaranteed, and it ends after that date. #### When did the MODPA go into effect? MODPA took effect on October 1, 2025. Its obligations apply to personal data processing activities that take place on or after April 1, 2026, so stores selling to Maryland residents should already be in compliance. #### Complying with the MODPA If your online store sells to Maryland residents and meets the thresholds above, most of your practical work involves cookies and tracking. Marketing pixels, analytics tags, and advertising cookies often count as targeted advertising or a “sale” of personal data under state privacy laws, so they need to respect each visitor’s choices. Practical steps for a Shopify store include: - **Offer a clear opt-out.** Give visitors an easy way to opt out of targeted advertising and the sale of their personal data, such as a “Do not sell or share my personal information” link, and make sure tracking stops once they do. - **Honor opt-out preference signals.** MODPA recognizes opt-out preference signals sent by a browser or device, such as Global Privacy Control (GPC). Treating a GPC signal as a valid opt-out is the safest approach for Maryland visitors. - **Collect less data.** Review your apps, pixels, and forms, and remove anything that collects personal data you do not need to fulfill orders or provide the service your customers asked for. - **Be careful with sensitive data.** Do not sell sensitive data, and only collect it when it is strictly necessary. Avoid targeted advertising to visitors you know or should know are under 18. - **Update your privacy notice.** Explain what personal data you collect, why, which categories of third parties receive it, and how consumers can exercise their rights. - **Handle consumer requests.** Set up a reliable way for customers to request access, correction, deletion, or a copy of their data, and respond within the required timeframe. A consent management platform makes these steps much easier to maintain. **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/modpa&utm_id=pandectes)** is built for Shopify stores and provides a cookie banner with opt-out options for US states, a “Do not sell or share my personal information” link, and support for the Global Privacy Control signal. It automatically scans and classifies the cookies on your store, generates a cookie declaration, keeps consent logs, and helps you handle data subject requests. Region-specific banner settings use geolocation to show the right experience to visitors from Maryland and other states. Privacy laws differ in their details and continue to change, so review your setup with legal counsel where appropriate. #### Official sources - [Maryland Online Data Privacy Act of 2024 (SB 541, Chapter 455), Maryland General Assembly](https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541?ys=2024RS) - [Data Privacy in Maryland, Maryland Attorney General](https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/modpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/ndpa/ ### Nebraska Data Privacy Act (NDPA) Learn about the Nebraska Data Privacy Act (NDPA), a groundbreaking law that empowers Nebraska residents to take control of their personal data while setting compliance standards for businesses. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ndpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is the Nebraska Data Privacy Act (NDPA)? The Nebraska Data Privacy Act (NDPA) is a comprehensive privacy law designed to protect the personal information of Nebraska residents. By granting individuals new rights and imposing data handling obligations on businesses, the NDPA enhances transparency and accountability in data practices. It reflects Nebraska’s commitment to safeguarding consumer privacy in an increasingly digital world. #### Who does the NDPA apply to? The NDPA applies to businesses that operate in Nebraska or process the personal data of its residents. This includes entities meeting thresholds such as generating significant revenue, processing a large volume of personal data, or earning a substantial portion of revenue from data sales. These criteria ensure the law primarily targets businesses with considerable influence on consumer data. #### What happens if I don’t comply with the NDPA? Businesses failing to comply with the NDPA face substantial penalties: - **Fines**: Up to $7,500 per violation. - **Legal Remedies**: Consumers may sue for damages caused by violations or data breaches. - **Reputational Risks**: Non-compliance can damage trust and business credibility. #### When will the NDPA go into effect? The Nebraska Data Privacy Act (NDPA) is scheduled to take effect on January 1, 2025. #### Complying with the NDPA - **Update Your Privacy Practices** Ensure your data handling and privacy policies meet NDPA standards. - **Implement Consumer Data Rights Management** Adopt tools to facilitate consumer requests for data access, deletion, and opt-out. - **Strengthen Data Security** Enhance data protection measures to prevent breaches and unauthorized access. - **Leverage Compliance Solutions** The **Pandectes GDPR Compliance App** offers Shopify stores tools to automate NDPA compliance, manage data requests, and maintain transparency with customers. #### Official sources - [Data Privacy, Nebraska Attorney General](https://protectthegoodlife.nebraska.gov/data-privacy-homepage) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ndpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/nhpa/ ### New Hampshire Privacy Act (NHPA) Explore how the NHPA enhances data privacy for New Hampshire residents and ensures businesses comply with transparency and accountability standards. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/nhpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is the New Hampshire Privacy Act (NHPA)? The New Hampshire Privacy Act (NHPA) is a comprehensive data privacy law designed to protect the personal information of New Hampshire residents. The law empowers consumers with rights over their data while requiring businesses to adopt responsible data collection, usage, and sharing practices. It represents a significant step forward in addressing data privacy concerns in the digital era. #### Who does the NHPA apply to? The NHPA applies to businesses operating in New Hampshire or processing data from its residents if they have significant revenue, handle large volumes of personal data, or rely heavily on data sales for income. #### What happens if I don’t comply with the NHPA? Failure to comply with the NHPA can lead to significant consequences: - **Financial Penalties**: Fines up to $7,500 per violation. - **Legal Action**: Consumers may pursue legal remedies for violations or data breaches. - **Reputational Impact**: Non-compliance can harm consumer trust and brand reputation. #### When will the NHPA go into effect? The New Hampshire Privacy Act will become effective on January 1st, 2025. Therefore, organizations should take swift action to ensure that their personal data processing activities comply with the new law’s requirements. #### Complying with the NHPA - **Review and Update Privacy Policies** Ensure privacy notices are up-to-date and clearly communicate data practices. - **Implement Consumer Rights Management** Adopt systems to handle consumer requests for access, deletion, or rectification of personal data. - **Strengthen Data Security** Invest in robust cybersecurity measures to protect against breaches. - **Use Advanced Compliance Tools** The **Pandectes GDPR Compliance App** simplifies NHPA compliance with features like automated data request handling, cookie consent management, and customizable privacy notices. #### Official sources - [RSA Chapter 507-H, Expectation of Privacy, New Hampshire General Court](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm) - [Data Privacy Enforcement, New Hampshire Department of Justice](https://www.doj.nh.gov/data-privacy-enforcement) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/nhpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/njdpa/ ### New Jersey Data Privacy Act (NJDPA): Comprehensive Overview Discover the essentials of the NJDPA, New Jersey’s comprehensive data privacy law, designed to protect consumer rights and ensure business accountability. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/njdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is NJDPA? The New Jersey Data Privacy Act (NJDPA) is a state law aimed at safeguarding the privacy rights of New Jersey residents. Enacted to address growing concerns over data misuse, the NJDPA establishes strict guidelines for how businesses collect, use, and share personal data. It ensures transparency and empowers consumers with greater control over their personal information. #### Key Provisions of the NJDPA The NJDPA introduces several significant provisions that reshape the data privacy landscape: - **Consumer Rights** Residents of New Jersey are granted the rights to know, access, opt out, deletion, and portability under the NJDPA. - **Business Obligations** Businesses subject to the NJDPA must provide transparent and detailed privacy notices. Respond to consumer data requests within a specified timeframe. Enable opt-out mechanisms, including a “Do Not Sell My Personal Information” link on websites, and implement appropriate security measures to protect personal data. #### Who does the NJDPA apply to? The NJDPA applies to businesses operating in New Jersey or handling data from New Jersey residents if they generate annual revenue above a specific threshold (e.g., $25 million) and/or buy, sell, or share the personal data of at least 50,000 New Jersey residents annually and/or derive at least 50% of their revenue from selling personal data. #### How Does NJDPA Compare to Other Laws? The NJDPA shares similarities with other U.S. privacy laws, like the **CCPA** and **VCDPA**, but it also includes unique elements: - **Broader Consumer Rights**: Emphasizes consumer empowerment and transparency. - **Stronger Enforcement**: Introduces higher fines and stricter timelines for compliance. - **Harmonization with GDPR**: Aligns with key GDPR principles for businesses operating globally. #### When will the NJDPA go into effect? Effective January 16, 2025. #### Penalties for Non-Compliance Non-compliance with the NJDPA can result in severe penalties: - **Civil Fines**: Up to $7,500 per violation. - **Private Right of Action**: Consumers can sue for data breaches or non-compliance. - **Reputational Damage**: Public enforcement actions can harm a business’s credibility. #### How to Comply with the NJDPA - **Update Your Privacy Policies** Ensure your privacy policy is clear, comprehensive, and accessible to consumers. - **Facilitate Consumer Requests** Implement systems to handle requests for data access, deletion, and opt-outs efficiently. - **Invest in Data Security** Adopt advanced security protocols to safeguard sensitive personal data. - **Leverage Technology** Use tools like the **Pandectes GDPR Compliance App** to automate compliance tasks, manage data requests, and handle cookie consent efficiently. #### Official sources - [Bill S332 (P.L.2023, c.266), New Jersey Legislature](https://www.njleg.state.nj.us/bill-search/2022/S332) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/njdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/nzpa/ ### New Zealand Privacy Act (NZPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet New Zealand Privacy Act (NZPA) requirements by scanning for cookies, generating reports, and ensuring compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/nzpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is NZPA? The New Zealand Privacy Act (NZPA) is New Zealand’s national data protection legislation. It was first enacted in 1993 and has undergone several amendments, with significant updates coming into effect in December 2020. The NZPA aims to protect the personal information of individuals by regulating the collection, use, and disclosure of personal data by organizations. It establishes principles such as obtaining consent for the collection, use, and disclosure of personal information, providing individuals with access to their personal information, and protecting personal information through appropriate security measures. The NZPA applies to all organizations that handle personal information, including both public and private sector organizations. Under the NZPA, organizations are required to appoint a privacy officer, to take necessary measures for personal information protection, to establish a personal information management system, and to report to the Office of the Privacy Commissioner when a data breach occurs. #### Who does the NZPA apply to? The New Zealand Privacy Act (NZPA) applies to personal information that is collected, used, or disclosed within New Zealand, as well as personal information that is transferred from New Zealand to other countries. #### What happens if I don’t comply with the NZPA? Failing to comply with the New Zealand Privacy Act (NZPA) can result in various penalties and enforcement actions. The Office of the Privacy Commissioner (OPC), which is responsible for enforcing the NZPA, has the power to impose fines for non-compliance. The fines can be significant, depending on the severity and nature of the violation. In addition to fines, the OPC can also impose other penalties, such as ordering companies to stop processing personal data, requiring companies to rectify non-compliance, and issuing public warnings or compliance notices. The OPC can also take legal action against organizations that fail to comply with the NZPA. In some cases, non-compliance with the NZPA can also result in legal action being taken against a company by individuals whose personal data has been affected. It’s important to note that NZPA compliance is not only about avoiding fines and penalties, but also about protecting people’s personal information and respecting their rights. #### When will the NZPA go into effect? The New Zealand Privacy Act (NZPA) was first enacted in 1993 and came into effect on July 1st, 1993. However, it was significantly amended in 2020, with the amendments coming into effect on December 1st, 2020. #### Complying with the NZPA The New Zealand Privacy Act (NZPA) is New Zealand’s national data protection legislation. As businesses operate across multiple jurisdictions, it becomes increasingly difficult to navigate and adhere to the intricate network of international data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. It is essential to keep track of these laws as they progress through national legislatures. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a Consent Management Platform (CMP) like [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/nzpa&utm_id=pandectes). A CMP relieves the burden on your team by offering customizable consent management, automation of data subject access requests, and tools for cookie & vendor management. Pandectes GDPR Compliance is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Privacy Act 2020, New Zealand Legislation](https://www.legislation.govt.nz/act/public/2020/31/en/latest/) - [Office of the Privacy Commissioner](https://www.privacy.org.nz/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/nzpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/ocdpa/ ### Oregon Consumer Data Privacy Act (OCDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet OCDPA requirements by scanning for cookies, generating reports, and ensuring data privacy compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ocdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is OCDPA? The Oregon Consumer Data Privacy Act (OCDPA) provides Oregon residents with certain rights pertaining to their data and imposes obligations on those who control and process data. It shares some similarities with other state laws such as the California Privacy Rights Act (CPRA) and Virginia’s Consumer Data Protection Act (CDPA), as well as draws inspiration from the EU’s General Data Protection Regulation (GDPR). While there are resemblances, such as the inclusion of opt-out provisions for data collection and processing, safeguards for sensitive data, and the integration of privacy-by-design principles, the significant divergences lie in the specific details. This insight comes from Kirk Nahra, a seasoned privacy attorney and co-chair at Wilmer Hale. For instance, the CPRA (California) and OCDPA (Oregon) diverge in their definitions of “sensitive data.” As Nahra pointed out, complying with the law will require careful consideration of these distinctions. In the following discussion, we will delve into the definition of sensitive data under the OCDPA, along with its other stipulations. #### Who does the OCDPA apply to? The Oregon Consumer Data Privacy Act (OCDPA) applies to “controllers” that conduct business in Oregon or produce or deliver commercial products or services that are intentionally targeted to Oregon residents. #### What happens if I don’t comply with the OCDPA? The OCDPA doesn’t specify the penalties or fines that violators will have to pay. However, violations of the regulation are considered a deceptive trade practice. This means that violations will be dealt with as per the Oregon Unlawful Trade Practices Act. Fines per violation can vary based on the specifics of the violation. OCDPA violations could also result in criminal charges. Enforcement of the OCDPA is entrusted to the Oregon Attorney General and district attorneys, who bear the responsibility of implementing injunctions, penalties, and settlements. It is important to note, however, that the OCDPA does not provide a private right of action, meaning that individuals cannot file lawsuits against businesses for violating their rights. Before the Attorney General or district attorneys can initiate any enforcement measures, they are obliged to issue a notice of violation to the relevant business. This notice grants the violators a 60-day cure period, during which they can rectify the violations. If the business remains non-compliant after the cure period, the district attorneys or Attorney General can proceed with enforcement actions. As of January 1, 2025, the 60-day cure period will no longer be in effect. Instead, violators will have the option to request interpretative guidance and opinion letters from the office of the Attorney General. #### When will the OCDPA go into effect? The OCDPA tasks the Oregon Attorney General with implementing and enforcing the OCDPA, including adopting new rules. The OCDPA is a part of the State of Oregon’s Unlawful Trade Practices Act and goes into effect on July 1, 2025. #### Complying with the OCDPA The OCDPA stands as one of the comprehensive data privacy laws, and other states, such as Indiana, Iowa, Tennessee, and Colorado, are also introducing their own privacy bills. As businesses operate across multiple states, it becomes increasingly difficult to navigate and adhere to the intricate network of state data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through state legislatures is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ocdpa&utm_id=pandectes)**. A CMP relieves the burden on your team by offering customizable consent management, automation of data subject access requests, and tools for cookie & vendor management. **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ocdpa&utm_id=pandectes)** is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Privacy Law FAQs for Businesses, Oregon Department of Justice](https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ocdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/pdpa/ ### Personal Data Protection Act (PDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet PDPA requirements by scanning for cookies, generating reports, and ensuring compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is PDPA? The Thailand Personal Data Protection Act (PDPA) is a data protection law in Thailand. It aims to protect the personal data of individuals by regulating the collection, use, and disclosure of personal data by organizations. It establishes principles such as obtaining consent for the collection, use, and disclosure of personal data, providing individuals with access to their personal data, and protecting personal data through appropriate security measures. The PDPA applies to all organizations that handle personal data, including both public and private sector organizations. The law requires organizations to appoint a Data Protection Officer (DPO), to take necessary measures for personal data protection, to establish a personal data protection management system, and to notify the Personal Data Protection Committee (PDPC) when a data breach occurs. The law also provides individuals with the right to access, correct or delete their personal data, and the right to object to the collection, use or disclosure of personal data. The PDPA sets out principles for the handling of personal data, including obtaining consent from individuals for the collection, use, and disclosure of personal data, and taking appropriate measures to protect the security of personal data. Additionally, the PDPA establishes the Personal Data Protection Committee (PDPC) to monitor and enforce compliance with the law. #### Who does the PDPA apply to? The PDPA applies to Stores that collect personal data and use or disclose them within Thailand, as well as when this personal data that is transferred from Thailand to other countries. #### What happens if I don’t comply with the PDPA? Failing to comply with the Thailand Personal Data Protection Act (PDPA) can result in significant fines and penalties. The Personal Data Protection Committee (PDPC) has the power to impose administrative fines for non-compliance. The fines can be up to 5 million baht (around 160,000 USD) per violation. Fines can be imposed for a variety of reasons, including failure to comply with the principles of data protection, failure to appoint a Data Protection Officer (DPO), failure to establish a personal data protection management system, failure to report a data breach, and failure to provide individuals with their rights under the PDPA. In addition to fines, supervisory authorities can also impose other penalties, such as ordering companies to stop processing personal data, requiring companies to rectify non-compliance, and issuing reprimands. It’s important to note that PDPA compliance is not only about avoiding fines and penalties, but also about protecting people’s personal data and respecting their rights. #### When will the PDPA go into effect? The Thailand Personal Data Protection Act (PDPA) was passed on May 27, 2019 and it came into effect on May 27, 2020. However, the Personal Data Protection Committee (PDPC) has implemented a grace period until May 26, 2021, during which it will prioritize guidance, education and awareness-raising over fines and penalties for non-compliance with the PDPA. #### Complying with the PDPA The PDPA stands as one of the comprehensive data privacy laws, and other countries, such as Singapore, Malaysia, and Indonesia, are also introducing their own privacy regulations. As businesses operate across multiple jurisdictions, it becomes increasingly difficult to navigate and adhere to the intricate network of international data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through national legislatures is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a Consent Management Platform (CMP) like [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pdpa&utm_id=pandectes). A CMP relieves the burden on your team by offering customizable consent management, automation of data subject access requests, and tools for cookie & vendor management. Pandectes GDPR Compliance is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Personal Data Protection Committee (PDPC), Thailand](https://www.pdpc.or.th/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/pdpo/ ### Hong Kong Personal Data (Privacy) Ordinance (PDPO) Compliance Pandectes GDPR Compliance helps Shopify stores meet PDPO requirements by giving clear notice about cookies, scanning and classifying cookies, and keeping consent records. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pdpo&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is PDPO? The Personal Data (Privacy) Ordinance (PDPO), Chapter 486 of the Laws of Hong Kong, is Hong Kong’s main data protection law. It regulates how “data users”, meaning anyone who controls the collection, holding, processing or use of personal data, handle information about individuals. It is overseen by the Privacy Commissioner for Personal Data (PCPD). At its core are six Data Protection Principles: - **Collection:** Personal data must be collected lawfully and fairly, for a purpose related to the data user’s activities, and no more than necessary. On or before collection, individuals must be told the purpose, who the data may be given to, whether supplying it is voluntary, and how to request access and correction. - **Accuracy and retention:** Data must be accurate and not kept longer than needed. - **Use:** Data may not be used for a new purpose without the individual’s express and voluntary consent. - **Security:** Data must be protected against unauthorized or accidental access, processing, erasure, loss or use. - **Openness:** Data users must make their personal data policies and practices available. - **Access and correction:** Individuals can ask for a copy of their data and ask for it to be corrected. The PDPO also has specific rules on using personal data for direct marketing, which needs the individual’s consent. #### Who does the PDPO apply to? The PDPO applies to both the private and public sectors in Hong Kong, covering any business that collects or uses personal data in or from Hong Kong. Businesses outside Hong Kong that collect personal data from Hong Kong customers should treat the PDPO as relevant to them. #### What happens if I don’t comply with the PDPO? The PCPD can investigate complaints and, if it finds a contravention, issue an enforcement notice directing the data user to take remedial and preventive steps. Consequences can include: - **Breaching an enforcement notice:** A criminal offence punishable on first conviction by a fine of up to HK$50,000 and imprisonment for 2 years, plus a daily fine of up to HK$1,000 if the offence continues. - **Direct marketing offences:** Fines of up to HK$500,000 and imprisonment for 3 years, rising to HK$1,000,000 and 5 years where personal data is provided to a third party for gain. - **Compensation claims:** Individuals can seek compensation through a civil claim for damage caused by a contravention. - **Published findings:** The PCPD can publish a report of its investigation and recommendations when this is in the public interest. #### When did the PDPO go into effect? The PDPO was passed in 1995 and took effect in December 1996, except for certain provisions. Major amendments in 2012 introduced the direct marketing provisions, and amendments in 2021 made doxxing a criminal offence. #### Complying with the PDPO The PDPO does not have a cookie-specific consent rule like the GDPR, but cookies and tracking tools that collect personal data are subject to its principles. For a Shopify store selling to customers in Hong Kong, that means telling visitors clearly, at or before the point of collection, what personal data is collected through cookies and similar tools, why, and who it is shared with, for example in a cookie banner and a Personal Information Collection Statement or privacy policy. If you use personal data for direct marketing, you must get the customer’s consent first, and using data for a new, unrelated purpose needs express and voluntary consent. The provision of the PDPO that would restrict transfers of personal data outside Hong Kong is not yet in operation, but the PCPD publishes recommended model contract clauses for transfers. You should also be ready to respond to data access and correction requests. A Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pdpo&utm_id=pandectes)** helps with the parts of this that happen on your storefront. It shows a cookie banner and can block non-essential cookies until the visitor consents, automatically scans and classifies the cookies on your store, and generates a cookie declaration for your policy. It keeps consent logs as proof of consent, helps you handle data subject requests, and lets you configure banner settings by region using geolocation, so visitors from Hong Kong can see a banner suited to the PDPO. The PDPO is under review and may change, so review your setup with legal counsel where appropriate. #### Official sources - [Personal Data (Privacy) Ordinance (Cap. 486), Hong Kong e-Legislation](https://www.elegislation.gov.hk/hk/cap486) - [The Ordinance at a Glance, Office of the Privacy Commissioner for Personal Data](https://www.pcpd.org.hk/english/data_privacy_law/ordinance_at_a_Glance/ordinance.html) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pdpo&utm_id=pandectes) --- Source: https://pandectes.io/regulations/pipeda/ ### Establish trust in your business by ensuring PIPEDA compliance. Pandectes GDPR Compliance helps Shopify stores meet PIPEDA requirements by scanning for cookies, generating reports, and providing updates for compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pipeda&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is PIPEDA? The Personal Information Protection and Electronic Documents Act (PIPEDA) is a Canadian federal privacy law that regulates how organizations collect, use, and disclose personal information during commercial activities. It applies to any private sector organization handling personal information about identifiable individuals, whether or not the organization is based in Canada. PIPEDA outlines principles such as: - Obtaining meaningful consent for the collection, use, and disclosure of personal information. - Ensuring that the personal information collected is accurate, complete, and up-to-date. - Protecting personal information through appropriate security measures. - Providing individuals with access to their personal information. - Reporting data breaches to affected individuals and the Privacy Commissioner of Canada. PIPEDA applies across Canada, except in Quebec, British Columbia, and Alberta, which have their own privacy laws considered substantially similar to PIPEDA. #### Who does the PIPEDA apply to? PIPEDA applies to organizations engaged in commercial activities throughout Canada. This includes private sector companies, not-for-profit organizations, and federal entities. Essentially, it covers any organization that collects personal information about identifiable individuals. #### What happens if I don’t comply with the PIPEDA? Non-compliance with PIPEDA can lead to: - **Administrative Monetary Penalties (AMPs):** Fines of up to $10,000 for each violation. - **Compliance Orders:** Orders from the Privacy Commissioner of Canada requiring specific actions to achieve compliance. - **Public Findings:** Public disclosures of non-compliance and recommendations for corrective measures. - **Court Action:** Referrals to the Federal Court for further action if compliance orders or findings are not followed. - **Reputational Damage:** Negative impacts on your organization’s reputation, affecting trust with personal information. PIPEDA compliance is not just about avoiding penalties; it’s also about safeguarding personal information and respecting individual rights. #### When will the PIPEDA go into effect? PIPEDA became law on January 1, 2001. Full enforcement started on January 1, 2004, following a 3-year transition period. #### Complying with the PIPEDA Navigating PIPEDA, along with other provincial privacy laws (like those in Quebec, British Columbia, and Alberta), can be challenging. Staying informed about evolving regulations and consulting with legal experts are essential steps. To simplify compliance, consider using a Consent Management Platform (CMP) like Pandectes GDPR Compliance. Our CMP offers customizable consent management, automates data subject access requests, and manages cookies and vendors. [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pipeda&utm_id=pandectes) is designed specifically for Shopify stores to help you stay compliant in a dynamic data privacy landscape. #### Official sources - [Personal Information Protection and Electronic Documents Act, Justice Laws Website](https://laws-lois.justice.gc.ca/eng/acts/p-8.6/) - [PIPEDA, Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pipeda&utm_id=pandectes) --- Source: https://pandectes.io/regulations/pipl/ ### China Personal Information Protection Law (PIPL) Compliance Pandectes GDPR Compliance helps Shopify stores meet PIPL requirements by collecting consent before non-essential cookies, scanning and classifying cookies, and keeping consent records. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pipl&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is PIPL? The Personal Information Protection Law of the People’s Republic of China (PIPL) is China’s comprehensive law on personal information. It sets the rules for how organizations, which the law calls “personal information processors”, collect, store, use, share and delete information about identified or identifiable people. Many of its ideas will be familiar from the GDPR, but some of its consent rules are stricter. Key principles of the PIPL include: - Processing needs a legal basis, and for most marketing and tracking that basis is the individual’s consent, which must be voluntary, explicit and fully informed. - Individuals must be told, before processing, who is processing their information, for what purposes, how, for how long, and how to exercise their rights. - Separate consent is required for processing sensitive personal information, sharing information with another processor, making it public, and transferring it outside China. - Information about children under 14 counts as sensitive, and needs consent from a parent or guardian. - Individuals can withdraw consent at any time, and must be given a convenient way to do so. - Individuals have rights to access, copy, correct and delete their information. #### Who does the PIPL apply to? The PIPL applies to the processing of personal information inside China. It also applies to processing outside China when the purpose is to provide products or services to people in China, or to analyze or evaluate their behavior. An online store abroad that sells to customers in China can therefore be covered, and such processors must appoint a representative or set up an office in China. #### What happens if I don’t comply with the PIPL? The PIPL is enforced by the Cyberspace Administration of China (CAC), which coordinates enforcement, together with other government departments within their own areas. Possible consequences include: - **Corrective orders and warnings:** Orders to fix the violation, confiscation of illegal gains, and suspension of apps or services that process information unlawfully. - **Fines:** Up to RMB 1 million for refusing to correct a violation. For serious violations, up to RMB 50 million or 5% of the previous year’s turnover. - **Personal liability:** Responsible managers can be fined between RMB 100,000 and RMB 1 million and barred from senior roles for a period. - **Business restrictions:** Suspension of business operations and revocation of business licenses in serious cases. - **Credit records:** Violations are entered in credit records and can be made public. Individuals can also bring civil claims for damages caused by unlawful processing. #### When did the PIPL go into effect? The PIPL was adopted on August 20, 2021 and came into force on November 1, 2021. The CAC has since issued further rules, including rules in 2024 that ease some requirements for cross-border transfers. #### Complying with the PIPL For a Shopify store selling to customers in China, the most visible part of the PIPL is consent. Analytics, advertising and other tracking tools that collect personal information should not run until the visitor has explicitly agreed, and a visitor who declines must still be able to use the store unless the information is truly needed to provide the service. Your privacy notice should describe your processing in clear language, and visitors need a convenient way to withdraw consent later. Cross-border transfer needs particular attention, because most stores send customer information outside China to their platform, payment and marketing providers. The PIPL requires a transfer mechanism, such as the CAC standard contract, unless an exemption applies. The CAC’s 2024 rules exempt some transfers, for example those necessary to fulfil a contract with the customer such as a cross-border purchase, but individuals must still be informed about the overseas recipient and give separate consent. You should also be ready to answer requests from individuals to access, correct or delete their information. A Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pipl&utm_id=pandectes)** helps with the parts of this that happen on your storefront. It shows a cookie banner and blocks non-essential cookies until the visitor consents, automatically scans and classifies the cookies on your store, and generates a cookie declaration for your policy. It keeps consent logs as proof of consent, helps you handle data subject requests, and lets you configure banner settings by region using geolocation, so visitors from China can see a banner suited to the PIPL. Transfer mechanisms, representatives in China and sector rules go beyond what a consent tool can cover, so review your setup with legal counsel where appropriate. #### Official sources - [Personal Information Protection Law of the People's Republic of China, National People's Congress (English)](http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559.htm) - [Personal Information Protection Law (Chinese text), Cyberspace Administration of China](https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/pipl&utm_id=pandectes) --- Source: https://pandectes.io/regulations/popia/ ### Protection of Personal Information Act Compliance Pandectes GDPR Compliance helps Shopify stores meet South Africa's POPIA requirements by scanning for cookies, generating reports, and ensuring compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/popia&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is POPIA? The Protection of Personal Information Act (POPIA) is South Africa’s data protection law, which sets out how personal information should be processed. Enacted to promote the protection of privacy, POPIA aligns with global data protection standards, ensuring that South Africa is on par with international data protection laws. It applies to any organization that processes personal information within South Africa and outlines the conditions under which personal information can be lawfully processed. #### Who does the POPIA apply to? The Protection of Personal Information Act (POPIA) applies broadly to any entity, whether public or private, that processes personal information within South Africa. #### What happens if I don’t comply with the POPIA? Non-compliance with the Protection of Personal Information Act (POPIA) in South Africa can lead to significant consequences, reflecting the seriousness with which data protection is treated globally. - **Financial Penalties:** Fines up to R10 million for breaches. - **Legal Proceedings:** Potential for civil lawsuits and enforcement actions by the Information Regulator, including demands for compliance or operational restrictions. - **Reputational Damage:** Loss of consumer trust and negative publicity affecting business relationships and market position. - **Operational Impact:** Enforcement notices could disrupt or halt business operations. - **Criminal Charges:** Individuals responsible for serious breaches could face imprisonment. - **Data Subject Actions:** Individuals may withdraw consent or demand data deletion, complicating data management. - **International Implications:** Non-compliance could affect international data transfers, impacting global operations. Ensuring compliance with POPIA is crucial to avoid these consequences, safeguard personal information, and maintain trust with stakeholders. #### When will the POPIA go into effect? The Protection of Personal Information Act (POPIA) of South Africa was signed into law on November 26, 2013. #### Complying with the POPIA Complying with the Protection of Personal Information Act (POPIA) in South Africa is essential for organizations that process personal information within the country. It signifies a commitment to protecting the privacy and personal data of individuals, aligning with global data protection standards. Here’s what compliance entails: ##### Understanding POPIA’s Requirements Compliance starts with understanding the eight conditions for lawful processing of personal information outlined by POPIA, including accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. ##### Implementing Data Protection Measures Organizations must implement reasonable technical and organizational measures to secure personal information, prevent unauthorized access, and ensure data integrity. This includes developing and reviewing privacy policies, data protection impact assessments, and incident response plans. ##### Data Subject Rights Complying with POPIA means respecting data subject rights, including the right to access, rectify, or delete personal information, as well as the right to object to processing or to have data processed in a fair, lawful, and transparent manner. ##### Appointment of an Information Officer Organizations are required to appoint an Information Officer responsible for encouraging compliance with POPIA, dealing with requests, and working with the Information Regulator as necessary. ##### Training and Awareness Raising awareness and training staff on POPIA requirements and data protection principles is crucial. Employees should understand their roles in maintaining compliance and protecting personal information. ##### Regular Audits and Monitoring Regular audits of data processing activities and security measures help ensure ongoing compliance with POPIA. Monitoring and evaluating compliance efforts can identify areas for improvement and mitigate potential risks. ##### Reporting and Notification of Breaches Organizations must report any data breaches to the Information Regulator and, in certain cases, to the data subjects affected, as soon as reasonably possible to mitigate potential harm. ##### International Data Transfers For international data transfers, organizations must ensure that the receiving country provides an adequate level of protection for personal information, in line with POPIA’s requirements. ##### Benefits of Compliance Beyond avoiding penalties, complying with POPIA builds trust with customers and stakeholders, enhances the organization’s reputation, and ensures a competitive advantage in the marketplace. It demonstrates a commitment to ethical data practices and the protection of individual privacy rights. ##### Solution for Compliance Compliance with POPIA is not just a legal requirement but a strategic asset that can enhance business operations, customer relationships, and brand integrity in the digital age. To streamline the data compliance process, consider utilizing a **[Consent Management Platform](https://pandectes.io/features/)** (CMP) like **[Pandectes](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/popia&utm_id=pandectes)**. A CMP relieves the burden on your team by offering customizable consent management, automation of **[data subject access requests](https://pandectes.io/features/customer-data-requests/)**, and tools for cookie & vendor management. **[Pandectes](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/popia&utm_id=pandectes)** is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Protection of Personal Information Act 4 of 2013, South African Government](https://www.gov.za/documents/protection-personal-information-act) - [Information Regulator (South Africa)](https://inforegulator.org.za/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/popia&utm_id=pandectes) --- Source: https://pandectes.io/regulations/ridtppa/ ### Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet RIDTPPA requirements by managing cookie consent, offering clear opt-outs and handling consumer privacy requests. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ridtppa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is RIDTPPA? The Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) is Rhode Island’s comprehensive consumer privacy law. It gives Rhode Island residents rights over their personal data and sets obligations for the businesses that collect and process it. The law closely follows the model used by states such as Connecticut and Virginia. Under the RIDTPPA, Rhode Island residents have the right to: - Confirm whether a business processes their personal data, and access that data - Correct inaccurate personal data - Delete personal data - Obtain a portable copy of their personal data - Opt out of targeted advertising, the sale of their personal data, and profiling used for solely automated decisions with legal or similarly significant effects Businesses must also obtain consent before processing sensitive data, such as health data, precise geolocation, biometric data, data revealing racial or ethnic origin, or data collected from a known child. The law places particular weight on transparency. Websites that collect and sell the personal data of Rhode Island customers must publish a privacy notice that describes the categories of personal data collected, and identifies the third parties to which that data has been or may be sold. This notice requirement is written more broadly than the rest of the law, so it may apply even to websites that fall below the thresholds below. #### Who does the RIDTPPA apply to? The RIDTPPA applies to for-profit businesses that operate in Rhode Island or offer products or services targeted to Rhode Island residents, and that in the previous calendar year controlled or processed the personal data of at least 35,000 Rhode Island customers (not counting data used only to complete a payment), or of at least 10,000 customers while earning more than 20% of gross revenue from selling personal data. Nonprofits and certain regulated entities and data types are exempt. #### What happens if I don’t comply with the RIDTPPA? A violation of the RIDTPPA is treated as a deceptive trade practice under Rhode Island law. Key points about enforcement: - The Rhode Island Attorney General has exclusive authority to enforce the law. - Violations can lead to civil penalties under Rhode Island’s deceptive trade practices law, which can reach $10,000 per violation. - Anyone who intentionally discloses personal data in violation of the law can also be fined between $100 and $500 for each disclosure. - The law does not include a cure period, so businesses are not guaranteed a chance to fix a problem before enforcement begins. - There is no private right of action, so consumers cannot sue businesses directly under the law. #### When did the RIDTPPA go into effect? The RIDTPPA took effect on January 1, 2026. Businesses that meet the thresholds should already be in compliance. #### Complying with the RIDTPPA If your online store sells to Rhode Island residents, most of your practical work involves cookies and tracking. Marketing pixels, analytics tags, and advertising cookies often count as targeted advertising or a “sale” of personal data under state privacy laws, so they need to respect each visitor’s choices. Practical steps for a Shopify store include: - **Offer a clear opt-out.** Give visitors an easy way to opt out of targeted advertising and the sale of their personal data, such as a “Do not sell or share my personal information” link, and make sure tracking stops once they do. - **Consider honoring Global Privacy Control.** Unlike several other states, the RIDTPPA does not specifically require businesses to recognize universal opt-out signals. Treating a Global Privacy Control (GPC) signal as an opt-out is still a sensible way to respect visitor choices consistently across states. - **Get consent for sensitive data.** Do not process sensitive data without the consumer’s consent, and review your apps and forms for anything that collects it. - **Update your privacy notice.** Describe the personal data you collect, why you collect it, how consumers can exercise their rights, and the third parties to which personal data has been or may be sold. Your cookie list is a good starting point for identifying advertising and analytics partners. - **Handle consumer requests.** Set up a reliable way for customers to request access, correction, deletion, or a copy of their data, and respond within the required timeframe. A consent management platform makes these steps much easier to maintain. **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ridtppa&utm_id=pandectes)** is built for Shopify stores and provides a cookie banner with opt-out options for US states, a “Do not sell or share my personal information” link, and support for the Global Privacy Control signal. It automatically scans and classifies the cookies on your store, generates a cookie declaration, keeps consent logs, and helps you handle data subject requests. Region-specific banner settings use geolocation to show the right experience to visitors from Rhode Island and other states. For background on how the law came about, read our article [Rhode Island implements the Data Transparency and Privacy Protection Act](https://pandectes.io/blog/rhode-island-implements-the-data-transparency-and-privacy-protection-act/). Privacy laws differ in their details and continue to change, so review your setup with legal counsel where appropriate. #### Official sources - [Rhode Island General Laws Chapter 6-48.1, Rhode Island Data Transparency and Privacy Protection Act](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) - [Protect Rhode Island Consumers, Rhode Island Attorney General](https://riag.ri.gov/what-we-do/protect-rhode-island-consumers) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ridtppa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/singapore-pdpa/ ### Singapore Personal Data Protection Act (PDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet Singapore PDPA requirements by collecting consent for cookies, scanning and classifying cookies, and keeping consent records. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/singapore-pdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is PDPA? The Personal Data Protection Act 2012 (PDPA) is Singapore’s general data protection law. It governs how private sector organizations collect, use and disclose personal data, and it also set up Singapore’s Do Not Call Registry for marketing messages. The law is administered and enforced by the Personal Data Protection Commission (PDPC). The PDPA is built around a set of data protection obligations, including: - **Consent:** Organizations may collect, use or disclose personal data only with the individual’s consent, unless an exception applies. In some situations consent can be deemed, for example when someone voluntarily provides their data for a purpose. - **Notification:** Individuals must be told the purposes for which their data is collected, used and disclosed, on or before collection. - **Purpose limitation:** Data may only be used for purposes a reasonable person would consider appropriate. - **Access and correction:** Individuals can ask for their data and how it has been used, and ask for errors to be corrected. - **Protection and retention:** Data must be protected with reasonable security arrangements and not kept longer than needed. - **Transfer limitation:** Data sent outside Singapore must receive a standard of protection comparable to the PDPA. - **Data breach notification:** Notifiable data breaches must be reported to the PDPC no later than 3 calendar days after the organization assesses them, and in many cases to the affected individuals. #### Who does the PDPA apply to? The PDPA applies to organizations that collect, use or disclose personal data in Singapore, whether or not they are formed in Singapore or have an office there. An online store based elsewhere that collects personal data from customers in Singapore can therefore be covered. #### What happens if I don’t comply with the PDPA? The PDPC can investigate complaints and data breaches, and can give directions to bring an organization into compliance. Consequences can include: - **Financial penalties:** Up to 10% of the organization’s annual turnover in Singapore for organizations whose turnover in Singapore exceeds S$10 million, or up to S$1 million in any other case. - **Directions:** Orders to stop collecting, using or disclosing data, to destroy data collected in breach of the PDPA, or to take other steps to comply. - **Civil claims:** Individuals who suffer loss or damage from a breach of certain obligations can bring a claim in court. - **Published decisions:** The PDPC publishes its enforcement decisions, which can affect your reputation. #### When did the PDPA go into effect? The PDPA was passed in 2012. Its data protection provisions came into force on July 2, 2014, after the Do Not Call provisions took effect earlier that year. Amendments made in 2020 took effect from February 1, 2021, adding mandatory data breach notification and new forms of deemed consent, and the higher financial penalties apply from October 1, 2022. #### Complying with the PDPA For a Shopify store selling to customers in Singapore, the consent and notification obligations are the most relevant to cookies and tracking. Where cookies or similar tools collect personal data, for example to build profiles for analytics or advertising, visitors should be told what is collected and why, and their consent should be obtained. Visitors can withdraw consent at any time on reasonable notice, and you must then stop the related collection and use. Because most stores rely on providers outside Singapore, check that your platform, payment and marketing providers protect transferred data to a comparable standard, for example through contracts. You should also be able to respond to access and correction requests, and have a plan for assessing and reporting data breaches. A Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/singapore-pdpa&utm_id=pandectes)** helps with the parts of this that happen on your storefront. It shows a cookie banner and blocks non-essential cookies until the visitor consents, automatically scans and classifies the cookies on your store, and generates a cookie declaration for your policy. It keeps consent logs as proof of consent, helps you handle data subject requests, and lets you configure banner settings by region using geolocation, so visitors from Singapore can see a banner suited to the PDPA. The PDPC publishes detailed advisory guidelines, and how they apply depends on your store, so review your setup with legal counsel where appropriate. #### Official sources - [Personal Data Protection Act 2012, Singapore Statutes Online](https://sso.agc.gov.sg/Act/PDPA2012) - [PDPA Overview, Personal Data Protection Commission](https://www.pdpc.gov.sg/about/the-legislation/pdpa-overview) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/singapore-pdpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/tdpsa/ ### Texas Data Privacy and Security Act (TDPSA) Compliance Pandectes GDPR Compliance helps Shopify stores meet Texas TDPSA requirements. Our scans identify cookies and tracking technologies, providing detailed reports and actionable insights to ensure compliance with privacy regulations. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/tdpsa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is TDPSA? The Texas Data Privacy and Security Act (TDPSA) provides Texas residents with certain rights pertaining to their data and imposes obligations on those who control and process data. It shares some similarities with other state laws such as the California Privacy Rights Act (CPRA) and Virginia’s Consumer Data Protection Act (CDPA), as well as draws inspiration from the EU’s General Data Protection Regulation (GDPR). While there are resemblances, such as the inclusion of opt-out provisions for data collection and processing, safeguards for sensitive data, and the integration of privacy-by-design principles, the significant divergences lie in the specific details. This insight comes from Kirk Nahra, a seasoned privacy attorney and co-chair at Wilmer Hale. For instance, the CPRA (California) and TDPSA (Texas) diverge in their definitions of “sensitive data.” As Nahra pointed out, complying with the law will require careful consideration of these distinctions. In the following discussion, we will delve into the definition of sensitive data under the TDPSA, along with its other stipulations. #### Who does the TDPSA apply to? The Texas Data Privacy and Security Act (TDPSA) applies to “controllers” that conduct business in Texas or produce or deliver commercial products or services that are intentionally targeted to Texas residents. #### What happens if I don’t comply with the TDPSA? The TDPSA doesn’t specify the penalties or fines that violators will have to pay. However, violations of the regulation are considered a deceptive trade practice. This means that violations will be dealt with as per the Texas Deceptive Trade Practices-Consumer Protection Act. Fines per violation can vary based on the specifics of the violation. TDPSA violations could also result in criminal charges. Enforcement of the TDPSA is entrusted to the Texas Attorney General and district attorneys, who bear the responsibility of implementing injunctions, penalties, and settlements. It is important to note, however, that the TDPSA does not provide a private right of action, meaning that individuals cannot file lawsuits against businesses for violating their rights. Before the Attorney General or district attorneys can initiate any enforcement measures, they are obliged to issue a notice of violation to the relevant business. This notice grants the violators a 60-day cure period, during which they can rectify the violations. If the business remains non-compliant after the cure period, the district attorneys or Attorney General can proceed with enforcement actions. As of January 1, 2025, the 60-day cure period will no longer be in effect. Instead, violators will have the option to request interpretative guidance and opinion letters from the office of the Attorney General. #### When will the TDPSA go into effect? The TDPSA tasks the Texas Attorney General with implementing and enforcing the TDPSA, including adopting new rules. The TDPSA is a part of the State of Texas’s Deceptive Trade Practices-Consumer Protection Act and goes into effect on July 1, 2025. #### Complying with the TDPSA The TDPSA stands as one of the comprehensive data privacy laws, and other states, such as Indiana, Iowa, Tennessee, and Colorado, are also introducing their own privacy bills. As businesses operate across multiple states, it becomes increasingly difficult to navigate and adhere to the intricate network of state data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through state legislatures is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a Consent Management Platform (CMP) like [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/tdpsa&utm_id=pandectes). A CMP relieves the burden on your team by offering customizable consent management, automation of data subject access requests, and tools for cookie & vendor management. Pandectes GDPR Compliance is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Texas Data Privacy and Security Act, Texas Attorney General](https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act) - [HB 4 (88th Legislature), Texas Legislature Online](https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB4) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/tdpsa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/tipa/ ### Tennessee Information Protection Act (TIPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet TIPA requirements by managing cookie consent, opt-outs of targeted advertising and sale, and consumer privacy requests. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/tipa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is TIPA? The Tennessee Information Protection Act (TIPA) is Tennessee’s comprehensive consumer privacy law. It was passed as House Bill 1181 and signed in May 2023, and it is codified at Tennessee Code Annotated § 47-18-3201 and the sections that follow. Like the privacy laws of Virginia and other US states, it gives residents rights over their personal information and sets rules for the businesses that collect it. Under TIPA, Tennessee consumers have the right to: - Confirm whether a business processes their personal information and access it - Correct inaccuracies in their personal information - Delete personal information provided by or obtained about them - Obtain a portable copy of the personal information they provided - Opt out of the sale of their personal information, targeted advertising, and profiling that produces legal or similarly significant effects TIPA also treats some information as sensitive data, including racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, precise geolocation, and personal information collected from a known child. #### Who does the TIPA apply to? TIPA applies to businesses that operate in Tennessee or target products or services to Tennessee residents, have more than $25 million in revenue, and either process the personal information of at least 175,000 Tennessee consumers in a calendar year, or process the personal information of at least 25,000 consumers and derive more than 50% of gross revenue from selling personal information. Nonprofits, institutions of higher education, financial institutions subject to the Gramm-Leach-Bliley Act, licensed insurance companies, and HIPAA covered entities and business associates are exempt. #### What happens if I don’t comply with the TIPA? The Tennessee Attorney General has exclusive authority to enforce TIPA. The main points are: - **Cure period**: before bringing an action, the Attorney General must give written notice and 60 days to cure the violation. This cure period is permanent and does not expire. - **Civil penalties**: a court may impose up to $7,500 for each violation. - **Treble damages**: for willful or knowing violations, a court may award three times the damages. - **Costs**: the Attorney General may recover reasonable attorney fees and investigative costs. - **No private right of action**: consumers cannot sue a business directly under TIPA. TIPA also gives businesses an affirmative defense if they maintain a written privacy program that reasonably conforms to the NIST Privacy Framework or comparable documented standards, keep it updated, and provide consumers the rights the law requires. #### When did the TIPA go into effect? TIPA took effect on July 1, 2025. Businesses that meet its thresholds must comply now. #### Complying with the TIPA If your online store meets TIPA’s thresholds, the work that matters most for cookies and tracking looks like this: - **Offer an opt-out of targeted advertising and sale.** Advertising pixels and tags that follow visitors across other websites are typically targeted advertising. TIPA requires you to clearly and conspicuously disclose this processing and how consumers can opt out. A visible opt-out link and a cookie banner with clear choices are the usual way to do this. TIPA does not require businesses to honor universal opt-out signals such as Global Privacy Control. - **Get opt-in consent for sensitive data.** You must not process sensitive data, such as precise geolocation, without the consumer’s consent. Data from a known child must be handled under the federal Children’s Online Privacy Protection Act. - **Publish a clear privacy notice.** It must list the categories of personal information you process, why you process it, the categories you sell and the third parties you sell to, and how consumers can exercise their rights and appeal your decisions. - **Handle consumer requests on time.** Provide at least one secure and reliable way to submit requests, without requiring a new account. Respond within 45 days, extendable once by another 45 days when reasonably necessary, and answer appeals within 60 days. - **Document your privacy program.** Aligning it with the NIST Privacy Framework can give you the affirmative defense described above. To make this easier, consider a Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/tipa&utm_id=pandectes)**. It is built for Shopify stores and provides a cookie banner with opt-out options for US states, a “Do not sell or share my personal information” link, automatic cookie scanning and classification, a cookie declaration, consent logs, and data subject request handling. Region-specific banner settings let you show Tennessee visitors the right experience based on their location. For background on how the law came about, read our article [Adoption of the Information Protection Act in Tennessee](https://pandectes.io/blog/adoption-of-the-information-protection-act-in-tennessee/). Every business is different, so review your obligations under TIPA with legal counsel where appropriate. #### Official sources - [Tennessee Information Protection Act, Public Chapter 408 (HB 1181), Tennessee Secretary of State](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf) - [Guidance on the Tennessee Information Protection Act, Tennessee Attorney General](https://www.tn.gov/attorneygeneral/news/2025/4/30/pr25-25.html) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/tipa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/uae-pdpl/ ### UAE Personal Data Protection Law (PDPL) Compliance Pandectes GDPR Compliance helps Shopify stores meet UAE PDPL requirements by blocking non-essential cookies until visitors consent, scanning and classifying cookies, and keeping consent records. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/uae-pdpl&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is PDPL? The Personal Data Protection Law (PDPL) is the United Arab Emirates’ federal data protection law, issued as Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data. It sets out how personal data may be processed, what rights individuals have over their data, and what obligations apply to the businesses that collect it. It is overseen by the UAE Data Office, which was established by a separate decree-law in the same year. The PDPL follows many of the same ideas as the EU’s GDPR. Its key rules include: - Personal data may not be processed without the consent of the data subject, unless one of the exceptions in the law applies, such as performing a contract or complying with a legal obligation. - Consent must be specific, clear, and unambiguous, the business must be able to prove it, and people can withdraw it at any time. - Individuals have rights to information about how their data is processed, and to request correction, erasure, restriction of processing, and data portability, as well as to object to certain processing. - Businesses must keep personal data secure, report data breaches to the UAE Data Office, and in some cases appoint a data protection officer. - Personal data may be transferred abroad only to countries with adequate data protection or under the other conditions in the law. The PDPL does not apply everywhere in the country. Free zones with their own data protection laws, such as the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM), are excluded, and so are some types of data covered by separate legislation, such as health and banking data. #### Who does the PDPL apply to? The PDPL applies to the processing of personal data of people who live or have a place of business in the UAE. It covers businesses established in the UAE, and also businesses outside the UAE that process the personal data of people in the UAE, so a foreign online store selling to UAE customers can fall within its scope. #### What happens if I don’t comply with the PDPL? Breaching the PDPL can lead to: - **Complaints and investigations:** Individuals can file a complaint with the UAE Data Office if they believe their data has been processed in breach of the law, and the Data Office can investigate. - **Administrative penalties:** The Data Office can impose administrative penalties. The law leaves the violations and the amount of the administrative penalties to be set by a decision of the UAE Cabinet, so the exact fines depend on those implementing rules. Because the penalty rules come from implementing regulations, check their current status before relying on any figure. #### When did the PDPL go into effect? The PDPL was issued on 20 September 2021 and came into force on 2 January 2022. Businesses have six months from the issue of its executive regulations to bring their processing into line with the law. #### Complying with the PDPL If your online store sells to customers in the UAE, the PDPL can apply to the personal data you collect from them, including data collected through cookies and tracking tools on your storefront. For cookies and tracking, the main points are: - **Consent:** Consent is the default legal basis under the PDPL. For analytics, advertising, and other non-essential cookies, ask for consent before they are set, make the request clear and easy to understand, and let visitors withdraw consent as easily as they gave it. - **Notice:** Tell visitors what data you collect, why, and who you share it with, including the third-party tools that place cookies on your store. - **Proof of consent:** The law requires you to be able to prove consent, so keep a record of each visitor’s choice. - **Cross-border transfers:** Many analytics and marketing tools process data outside the UAE. Check that each transfer meets the PDPL’s conditions. - **Data subject requests:** Be ready to respond to requests for access, correction, erasure, and portability. If your business is set up in the DIFC or ADGM, the free zone’s own data protection rules apply instead, and they have their own requirements. To make this manageable, consider using a Consent Management Platform (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/uae-pdpl&utm_id=pandectes)**. It shows a cookie banner that blocks non-essential cookies until the visitor consents, scans your store to detect and classify cookies automatically, and generates a cookie declaration for your policy page. It keeps consent logs as proof of each visitor’s choice, helps you handle data subject requests, and uses geolocation to show region-specific banner settings to visitors from different countries. Pandectes GDPR Compliance is designed specifically for Shopify stores. The PDPL’s implementing rules are still developing, so review your setup with legal counsel where appropriate. #### Official sources - [Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data, UAE Legislation](https://uaelegislation.gov.ae/en/legislations/1972) - [Data protection laws, The UAE Government portal](https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/uae-pdpl&utm_id=pandectes) --- Source: https://pandectes.io/regulations/ucpa/ ### Utah Consumer Privacy Act (UCPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet UCPA requirements. Our scans identify cookies, generate detailed reports, and ensure data privacy compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ucpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is UCPA? The Utah Consumer Privacy Act (UCPA) is a data privacy law that protects the privacy rights of Utah residents and sets requirements for companies operating in the state. Effective March 24, 2022, the UCPA focuses on the sale of personal data and targeted advertising. It defines a sale as the exchange of personal data for monetary consideration to a third party, unlike California’s CCPA and CPRA. The UCPA follows an opt-out model, allowing the collection, sale, and use of personal data for targeted advertising without explicit consent, except for data involving young people. In such cases, consent must be obtained from a parent or legal guardian. Consumers can opt out of the sale or use of their data for targeted advertising, and businesses must honor these requests and stop using the data for these purposes. #### Who does the UCPA apply to? The UCPA applies to both controllers and processors of personal data. A controller is anyone conducting business in Utah who decides how and why personal data is processed, either alone or with others. #### What happens if I don’t comply with the UCPA? Enforcement of the UCPA involves consumer complaints managed by the Division of Consumer Protection. Persistent violations may lead to action from the attorney general, resulting in fines up to $7,500. #### When will the UCPA go into effect? The UCPA takes effect on December 31, 2023, granting rights to consumers and imposing obligations on businesses in Utah. #### Complying with the UCPA As data privacy laws evolve, including new regulations in states like Indiana, Iowa, Tennessee, and Montana, compliance can be challenging. Stay informed about new legislation and review new laws with legal counsel to ensure compliance. Consider using a Consent Management Platform (CMP) like [Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ucpa&utm_id=pandectes) to streamline the process. Our CMP offers customizable consent management, automation of data subject requests, and tools for cookie and vendor management, helping Shopify stores maintain compliance in a changing data privacy landscape. #### Official sources - [Utah Consumer Privacy Act, Utah Attorney General](https://attorneygeneral.utah.gov/utah-consumer-protection-act-a-new-law-to-protect-online-privacy/) - [Utah Consumer Privacy Act, Utah Division of Consumer Protection](https://dcp.utah.gov/ucpa/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/ucpa&utm_id=pandectes) --- Source: https://pandectes.io/regulations/vcdpa/ ### Virginia Consumer Data Protection Act (VCDPA) Compliance Pandectes GDPR Compliance helps Shopify stores meet VCDPA requirements by scanning for cookies, generating reports, and providing updates to ensure compliance. [Start Free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/vcdpa&utm_id=pandectes) #### The #1 cookie consent app for Shopify, trusted by 185k stores #### What is VCDPA? The Virginia Consumer Data Protection Act (VCDPA) is a data privacy law that regulates how businesses handle personal data of Virginia residents. It was signed into law on March 2, 2021, and it will become effective on January 1, 2023. The VCDPA provides certain rights to Virginia residents with respect to their personal data, such as the right to know what personal data is being collected, the right to access and request to delete personal data, and the right to opt-out of the sale of personal data. It also requires businesses to provide notice of data collection, implement data security measures, and appoint a data protection officer. The VCDPA also creates a private right of action for individuals whose data is subject to unauthorized access, exfiltration, theft, or destruction. It applies to companies that conduct business in Virginia and meet certain thresholds in terms of revenue and data processing. The VCDPA is considered as one of the most stringent data protection laws in the US, and it is similar to the California Consumer Privacy Act (CCPA). #### Who does the VCDPA apply to? The VCDPA applies to any for-profit business that does business in Virginia regardless of whether the business is headquartered in Virginia or not. #### What happens if I don’t comply with the VCDPA? Failing to comply with the Virginia Consumer Data Protection Act (VCDPA) can result in significant fines and penalties. The VCDPA gives the Virginia attorney general the power to impose administrative fines for non-compliance. The fines can be up to $7,500 for each violation or $750 per day for each day of a continuing violation, but not exceeding $2.5 million. Fines can be imposed for a variety of reasons, including failure to provide notice of data collection, failure to provide a way for consumers to opt-out of the sale of their personal information, failure to delete personal information upon request, failure to provide a way for consumers to access personal information, failure to disclose data breaches, and failure to appoint a Data Protection Officer. In addition to fines, supervisory authorities can also impose other penalties, such as ordering companies to stop processing personal data, requiring companies to rectify non-compliance, and issuing reprimands. In some cases, non-compliance with VCDPA can also result in legal action being taken against a company by individuals whose personal data has been affected. It’s important to note that VCDPA compliance is not only about avoiding fines and penalties, but also about protecting people’s personal data and respecting their rights. #### When will the VCDPA go into effect? The Virginia Consumer Data Protection Act (VCDPA) was signed into law on March 2, 2021, and it will become effective on January 1, 2023. #### Complying with the VCDPA The VCDPA stands as one of the comprehensive data privacy laws, and other states, such as Indiana, Iowa, Tennessee, and Montana, are also introducing their own privacy bills. As businesses operate across multiple states, it becomes increasingly difficult to navigate and adhere to the intricate network of state data privacy laws. Maintaining compliance begins with staying informed about the evolving legislation that may impact your company. Keeping track of these laws as they progress through state legislatures is essential. Subscribing to relevant newsletters and resources can be helpful. When a new law is enacted but not yet in effect, it is advisable to review its text in collaboration with legal counsel. They can assess your compliance status and provide guidance on necessary actions. To streamline the data compliance process, consider utilizing a **[Consent Management Platform](https://pandectes.io/features/)** (CMP) like **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/vcdpa&utm_id=pandectes)**. A CMP relieves the burden on your team by offering customizable consent management, automation of **[data subject access requests](https://pandectes.io/features/customer-data-requests/)**, and tools for cookie & vendor management. **[Pandectes GDPR Compliance](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/vcdpa&utm_id=pandectes)** is specifically designed for Shopify Stores and is ready to assist you in achieving and maintaining compliance within the ever-changing landscape of data privacy. #### Official sources - [Code of Virginia, Title 59.1, Chapter 53 (Consumer Data Protection Act)](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/) #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=regulations/vcdpa&utm_id=pandectes) --- ## Knowledge base Source: https://pandectes.io/knowledge-base/differences-between-ccpa-and-cpra/ ### Differences Between CCPA and CPRA By [Nikos Tsirakis](https://pandectes.io/blog/author/nikos/)30 December 2024 The **California Consumer Privacy Act (CCPA)** and the **California Privacy Rights Act (CPRA)** are pivotal privacy laws that enhance consumer data protection in California. Understanding the distinctions between these two regulations is essential for businesses, including Shopify store owners, to ensure compliance and maintain consumer trust. #### Overview of CCPA and CPRA - **CCPA**: Enacted in 2018 and effective from January 1, 2020, the CCPA grants California consumers rights over their personal information, including the right to know, delete, and opt-out of the sale of their data. - **CPRA**: Approved by voters in November 2020 and effective from January 1, 2023, the CPRA amends and expands the CCPA, introducing new consumer rights and establishing the California Privacy Protection Agency (CPPA) for enforcement. #### Key Differences Between CCPA and CPRA **Expanded Consumer Rights** - **Right to Correction**: Under the CPRA, consumers can request businesses to correct inaccurate personal information. - **Right to Limit Use of Sensitive Personal Information**: Consumers can restrict the use of sensitive personal information, such as race, health data, or precise geolocation, particularly concerning its use in advertising. - **Right to Access Information on Automated Decision-Making**: The CPRA allows consumers to understand and opt-out of automated decision-making technologies used in profiling. **New Category: Sensitive Personal Information** The CPRA introduces “sensitive personal information” as a distinct category, encompassing data like social security numbers, financial information, and precise geolocation. Businesses are required to provide additional protections for this type of data. **Changes in Applicability Thresholds** The CPRA adjusts the criteria determining which businesses must comply: - **Data Processing Volume**: The threshold for businesses that buy, sell, or share personal information increases from 50,000 to 100,000 consumers or households. - **Revenue from Data Sharing**: The CPRA includes businesses that derive 50% or more of their annual revenues from sharing (not just selling) consumers’ personal information. **Establishment of the California Privacy Protection Agency (CPPA)** The CPRA creates the CPPA, a dedicated agency responsible for enforcing California’s privacy laws, conducting audits, and providing guidance to businesses and consumers. #### Implications for Businesses Businesses, including Shopify store owners, should take note of the following: - **Compliance Obligations**: With the CPRA’s expanded scope, businesses may need to update their data processing practices, privacy policies, and consumer rights management procedures. - **Data Mapping and Inventory**: Identifying and categorizing sensitive personal information is crucial to comply with the CPRA’s requirements. - **Consumer Rights Management**: Implementing mechanisms to facilitate new consumer rights, such as correction and limiting the use of sensitive information, is essential. By utilizing tools like the Pandectes, businesses can navigate the complexities of evolving privacy regulations and ensure they meet their legal obligations while fostering consumer trust. #### More from the Knowledge Base - [German Cookie Regulation](https://pandectes.io/knowledge-base/german-cookie-regulation/) Understanding and complying with German cookie regulations is essential for businesses operating websites accessible to German users. - [UK Data Protection Act 2018](https://pandectes.io/knowledge-base/uk-data-protection-act-2018/) UK cookie regulations are governed by the Privacy and Electronic Communications Regulations (PECR) and the UK General Data Protection Regulation (UK GDPR). - [UK Digital Markets, Competition and Consumers Act](https://pandectes.io/knowledge-base/uk-digital-markets-competition-and-consumers-act/) The Digital Markets, Competition and Consumers Act 2024 (DMCC Act) is transformative legislation in the UK, enacted on May 24, 2024. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=knowledge-base/differences-between-ccpa-and-cpra&utm_id=pandectes) --- Source: https://pandectes.io/knowledge-base/german-cookie-regulation/ ### German Cookie Regulation By [Nikos Tsirakis](https://pandectes.io/blog/author/nikos/)30 December 2024 #### Introduction to German cookie law Understanding and complying with German cookie regulations is essential for businesses operating websites accessible to German users. These regulations, aligned with the General Data Protection Regulation (GDPR) and the Telecommunications-Telemedia Data Protection Act (TTDSG), mandate specific practices regarding the use of cookies and user consent. #### Key Aspects of German Cookie Regulations: **User Consent Requirement:** - As of May 28, 2020, businesses must obtain explicit user consent before deploying marketing or non-essential cookies on their websites. - Cookies essential for the website’s basic functionality, such as those enabling shopping cart operations, are exempt from this requirement. **Scope of Application:** - These rules apply to any website accessible by German users, regardless of the business’s location. - Both first-party cookies (set by the website’s domain) and third-party cookies (set by external services) are subject to these regulations. **Obtaining Valid Consent:** - Consent must be informed, specific, and given freely through an affirmative action, such as clicking an “Accept” button. - Pre-ticked checkboxes are not considered valid; users must actively select their preferences. - Users should have the option to refuse cookies without facing adverse consequences, like restricted website access. **Penalties for Non-Compliance:** Violations can lead to significant fines: - Under the GDPR, penalties can reach up to €20 million or 4% of the global annual turnover, whichever is higher. - The TTDSG allows for fines up to €300,000 for failing to obtain proper consent. Additional consequences may include data deletion, restrictions on data sharing, and bans on processing activities. **Best Practices for Compliance:** - **Implement a Consent Management Platform (CMP):** Utilize Pandectes CMP that facilitate the collection and management of user consents in compliance with legal standards. - **Provide Clear Information:** Clearly inform users about the types of cookies in use, their purposes, and data retention periods. - **Offer Easy Consent Management:** Allow users to easily manage their cookie preferences and withdraw consent at any time. - **Regularly Review Practices:** Continuously assess and update your data processing activities to ensure ongoing compliance with evolving regulations. By adhering to these guidelines, businesses can ensure compliance with German cookie regulations, thereby protecting user privacy and avoiding substantial penalties. #### More from the Knowledge Base - [Differences Between CCPA and CPRA](https://pandectes.io/knowledge-base/differences-between-ccpa-and-cpra/) The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are pivotal privacy laws that enhance consumer data protection in… - [UK Data Protection Act 2018](https://pandectes.io/knowledge-base/uk-data-protection-act-2018/) UK cookie regulations are governed by the Privacy and Electronic Communications Regulations (PECR) and the UK General Data Protection Regulation (UK GDPR). - [UK Digital Markets, Competition and Consumers Act](https://pandectes.io/knowledge-base/uk-digital-markets-competition-and-consumers-act/) The Digital Markets, Competition and Consumers Act 2024 (DMCC Act) is transformative legislation in the UK, enacted on May 24, 2024. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=knowledge-base/german-cookie-regulation&utm_id=pandectes) --- Source: https://pandectes.io/knowledge-base/uk-data-protection-act-2018/ ### UK Data Protection Act 2018 By [Nikos Tsirakis](https://pandectes.io/blog/author/nikos/)30 December 2024 #### Understanding UK Cookie Regulations UK cookie regulations are governed by the Privacy and Electronic Communications Regulations (PECR) and the UK General Data Protection Regulation (UK GDPR). These regulations ensure that businesses handle cookies and user data responsibly, prioritizing transparency and user consent. #### Legal Framework for Cookies **Privacy and Electronic Communications Regulations (PECR)** PECR specifically governs the use of cookies and similar technologies for storing information on users’ devices. Businesses must: - Inform users about the use of cookies. - Explain the purpose of each cookie. - Obtain user consent before deploying non-essential cookies. **UK General Data Protection Regulation (UK GDPR)** The UK GDPR provides a broader framework for data protection. While PECR addresses cookie-specific rules, the UK GDPR emphasizes: - Lawful processing of personal data. - Transparency in data handling practices. - Respect for user rights, such as the ability to access or delete data. #### Types of Cookies Cookies fall into two main categories: **Essential Cookies:** - Necessary for basic website functions, such as maintaining shopping carts or enabling user logins. - Do not require user consent but must be clearly disclosed. **Non-Essential Cookies:** - Include analytical, advertising, and functional cookies that enhance user experience but are not critical. - Require explicit user consent before being deployed. #### Consent Requirements Under UK cookie regulations, user consent must meet the following standards: - **Informed Consent:** Users should be provided with clear, detailed information about the types of cookies used and their purposes. - **Active Affirmation:** Consent must be given through an explicit action, such as clicking an “Accept” button. Pre-ticked checkboxes or implied consent (e.g., continued browsing) are invalid. - **Granular Control:** Users should have the option to accept or reject specific types of cookies. - **Easy Withdrawal:** Users must be able to revoke their consent as easily as they provided it. #### Transparency and User Rights Transparency is crucial for building trust with users. Organizations should: - Provide accessible and clear cookie policies or notices. - Allow users to manage their cookie preferences, including rejecting non-essential cookies without negative consequences. #### Penalties for Non-Compliance The Information Commissioner’s Office (ICO) enforces cookie regulations in the UK. Non-compliance can lead to: - Significant fines under the UK GDPR, up to £17.5 million or 4% of global annual turnover, whichever is higher. - Reputational damage, as regulatory actions are often made public. - In November 2023, the ICO warned 53 of the UK’s top 100 websites about potential enforcement for failing to comply with cookie consent requirements. #### Best Practices for Compliance To ensure compliance with UK cookie regulations, businesses should follow these best practices: **Conduct a Cookie Audit:** - Identify all cookies in use on your website. - Document their purposes and necessity. **Use a Consent Management Platform (CMP):** - Implement tools to streamline user consent collection and management. **Design User-Friendly Consent Mechanisms:** - Avoid “dark patterns” that manipulate users into giving consent. - Ensure cookie banners are clear and concise. **Regularly Update Policies:** - Keep cookie policies and consent mechanisms up to date with changes in legal requirements or website functionality. **Educate Your Team:** - Train staff on compliance requirements and the importance of responsible cookie use. #### Conclusion UK cookie regulations are designed to protect user privacy and promote transparent data handling practices. By adhering to these rules, businesses can not only avoid penalties but also build trust with their users. Ensuring compliance demonstrates your organization’s commitment to ethical and lawful data management. #### More from the Knowledge Base - [Differences Between CCPA and CPRA](https://pandectes.io/knowledge-base/differences-between-ccpa-and-cpra/) The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are pivotal privacy laws that enhance consumer data protection in… - [German Cookie Regulation](https://pandectes.io/knowledge-base/german-cookie-regulation/) Understanding and complying with German cookie regulations is essential for businesses operating websites accessible to German users. - [UK Digital Markets, Competition and Consumers Act](https://pandectes.io/knowledge-base/uk-digital-markets-competition-and-consumers-act/) The Digital Markets, Competition and Consumers Act 2024 (DMCC Act) is transformative legislation in the UK, enacted on May 24, 2024. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=knowledge-base/uk-data-protection-act-2018&utm_id=pandectes) --- Source: https://pandectes.io/knowledge-base/uk-digital-markets-competition-and-consumers-act/ ### UK Digital Markets, Competition and Consumers Act By [Nikos Tsirakis](https://pandectes.io/blog/author/nikos/)30 December 2024 #### Overview of the Digital Markets, Competition and Consumers Act (DMCC) The **Digital Markets, Competition and Consumers Act 2024 (DMCC Act)** is transformative legislation in the UK, enacted on May 24, 2024. It aims to enhance competition, protect consumer rights, and ensure transparency in the digital economy. The Act is particularly relevant for addressing the challenges posed by dominant players in the digital marketplace. #### Objectives of the DMCC Act **Promoting Competition** The DMCC Act seeks to prevent anti-competitive behavior by large digital firms. By fostering a fair marketplace, it aims to create opportunities for smaller businesses and encourage innovation. **Protecting Consumers** The Act ensures consumers are shielded from unfair practices, such as misleading advertising, hidden fees, and difficulties in canceling subscriptions. **Empowering Regulators** The legislation gives enhanced powers to the **Competition and Markets Authority (CMA)** to enforce compliance and oversee digital markets effectively. #### Establishment of the Digital Markets Unit (DMU) **Role of the DMU** The **Digital Markets Unit (DMU)** is a dedicated body within the CMA tasked with regulating and supervising the activities of digital firms. **Strategic Market Status (SMS)** The DMU is responsible for identifying companies with **Strategic Market Status (SMS)**, those with entrenched power in digital markets, and ensuring they comply with fair practice codes. **Enforcing Codes of Conduct** The DMU develops tailored codes of conduct to: - Prevent anti-competitive practices. - Protect smaller businesses and consumers. - Promote transparency and fair dealings. #### Consumer Protection Measures **Ban on Subscription Traps** The Act prohibits practices that make it difficult for consumers to cancel subscriptions. Businesses must provide clear and simple cancellation processes. **Prohibition of Fake Reviews** Fake reviews, which mislead consumers about product quality or services, are now explicitly banned. **Addressing Drip Pricing** The Act requires businesses to disclose all mandatory fees upfront, preventing hidden costs from appearing during the checkout process. #### Implications for Businesses **Compliance Requirements** Businesses, especially those designated with SMS, must adhere to the codes of conduct issued by the DMU. This includes fair treatment of consumers and transparent operations. **Potential Penalties** Non-compliance with the DMCC Act can result in: - Substantial fines. - Legal actions by the CMA. - Reputational damage due to regulatory scrutiny. #### Conclusion The **Digital Markets, Competition and Consumers Act 2024** is a significant step toward creating a fairer digital economy in the UK. By ensuring competition, protecting consumers, and empowering regulatory bodies, the Act establishes a robust framework for transparency and accountability in digital markets. Businesses operating in the UK must stay informed and align their practices with the new legal requirements to avoid penalties and foster consumer trust. #### More from the Knowledge Base - [Differences Between CCPA and CPRA](https://pandectes.io/knowledge-base/differences-between-ccpa-and-cpra/) The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are pivotal privacy laws that enhance consumer data protection in… - [German Cookie Regulation](https://pandectes.io/knowledge-base/german-cookie-regulation/) Understanding and complying with German cookie regulations is essential for businesses operating websites accessible to German users. - [UK Data Protection Act 2018](https://pandectes.io/knowledge-base/uk-data-protection-act-2018/) UK cookie regulations are governed by the Privacy and Electronic Communications Regulations (PECR) and the UK General Data Protection Regulation (UK GDPR). #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=knowledge-base/uk-digital-markets-competition-and-consumers-act&utm_id=pandectes) --- Source: https://pandectes.io/knowledge-base/understanding-google-consent-mode-v2/ ### Understanding Google Consent Mode v2 By [Nikos Tsirakis](https://pandectes.io/blog/author/nikos/)21 January 2025 #### The Need for Privacy-First Solutions In today’s digital landscape, data privacy is a growing concern for both consumers and businesses. Regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) have transformed how organizations handle user data. Google Consent Mode emerges as a pivotal tool that enables websites to respect user privacy preferences while still gathering actionable insights. #### What Is Google Consent Mode? Google Consent Mode is a framework designed to manage user consent dynamically. It adjusts the behavior of Google tags based on the consent status provided by visitors, ensuring compliance with data protection regulations. Tags can either operate with full functionality (if consent is given) or modify their behavior (if consent is denied), allowing businesses to respect user preferences without entirely losing critical data. #### A Closer Look at Google Consent Mode v2 The second version of Google Consent Mode builds on its predecessor with improved features and functionality. Key enhancements include: ##### 1. **Dynamic Consent Management** Google Consent Mode v2 provides the flexibility to adjust tag behavior in real time, depending on the type of consent provided. For instance: - **Analytics Consent**: Enables tags to collect anonymized analytics data. - **Ad Consent**: Allows tags to record ad performance data without identifying users. ##### 2. **Behavioral Data Modeling** A standout feature of Consent Mode v2 is its ability to leverage machine learning for data modeling. When users decline consent, Google uses anonymized and aggregated data to predict user behavior, reducing the impact of missing data. ##### 3. **Expanded Compatibility** The latest version supports a broader range of Google products and third-party integrations, making it easier for businesses to maintain a cohesive marketing strategy while adhering to privacy requirements. #### How Does Google Consent Mode Work? Google tags track events like page views, ad clicks, and conversions. These events are influenced by user consent status. Here’s how Consent Mode functions in different scenarios: - **Full Consent**: Tags operate with full functionality, collecting complete data. - **Partial Consent**: Tags collect only the allowed categories of data (e.g., analytics but not ads). - **No Consent**: Tags switch to data modeling, capturing anonymized and non-identifiable insights. For example, if a user does not consent to analytics cookies, Consent Mode ensures that data such as page views are recorded without identifying the individual. #### Benefits of Google Consent Mode v2 ##### 1. **Compliance with Privacy Regulations** By dynamically adjusting data collection practices based on user consent, Consent Mode v2 ensures compliance with global regulations like GDPR, CCPA, and more. ##### 2. **Retention of Valuable Insights** Even when users decline consent, data modeling ensures businesses still gain insights into conversion rates and campaign performance. ##### 3. **Improved User Trust** Transparent data collection practices foster trust, an essential factor for brand loyalty and customer retention. ##### 4. **Optimized Advertising** With Consent Mode, advertisers can optimize campaigns even with partial or no user consent, minimizing disruptions to marketing strategies. #### A Game-Changer for Shopify Stores Shopify merchants often operate in a global market, subject to diverse privacy laws. Google Consent Mode v2 simplifies compliance by: - Automatically aligning tag behavior with regional regulations. - Supporting multilingual consent banners for international customers. - Integrating seamlessly with advertising and analytics tools. #### The Future of Data Privacy with Google Consent Mode As regulations evolve, tools like Google Consent Mode v2 will become indispensable for businesses navigating the complexities of privacy compliance. By combining dynamic consent management with advanced data modeling, this framework sets a new standard for ethical data collection. #### Conclusion Google Consent Mode v2 represents a pivotal step in harmonizing user privacy and business needs. For Shopify merchants, leveraging this tool with a certified CMP like Pandectes simplifies compliance and enhances customer trust. Embracing these technologies today prepares businesses for the privacy-focused future of digital commerce. #### More from the Knowledge Base - [Why It’s Important to Comply with Google Consent Mode V2](https://pandectes.io/knowledge-base/why-its-important-to-comply-with-google-consent-mode-v2/) Complying with Google Consent Mode V2 demonstrates that your business respects user privacy preferences. - [Differences Between CCPA and CPRA](https://pandectes.io/knowledge-base/differences-between-ccpa-and-cpra/) The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are pivotal privacy laws that enhance consumer data protection in… - [German Cookie Regulation](https://pandectes.io/knowledge-base/german-cookie-regulation/) Understanding and complying with German cookie regulations is essential for businesses operating websites accessible to German users. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=knowledge-base/understanding-google-consent-mode-v2&utm_id=pandectes) --- Source: https://pandectes.io/knowledge-base/what-are-cookies/ ### What are cookies? By [Nikos Tsirakis](https://pandectes.io/blog/author/nikos/)21 January 2025 Cookies, also known as internet cookies, are small text files created by websites and stored in a user’s web browser. When you visit a website, it sends a cookie to your browser, which stores the file on your device, whether it’s a computer, smartphone, or tablet. These cookies contain data about your interactions with the website, such as your preferences or login details. The next time you visit the same website, your browser sends the stored cookie back to the web server, allowing the site to deliver a tailored experience, such as remembering your username or the items in your shopping cart. Cookies are designed to improve the user experience by saving information locally, reducing the need for websites to request the same data repeatedly. They also enable features like personalization, seamless navigation, and faster load times. Cookies are often referred to by other names, including web cookies, browser cookies, or HTTP cookies. The term itself originates from the concept of “magic cookies,” which were small packets of data passed between programs in early computing. The analogy to a fortune cookie, a cookie containing a hidden message, aptly describes their function. The invention of cookies dates back to 1994, when computer programmer Lou Montulli created them while working at Netscape Communications. Netscape sought to make websites more functional and commercially viable, and cookies provided a way for sites to remember user data. Montulli’s invention has since become a foundational technology for the internet. #### More from the Knowledge Base - [Differences Between CCPA and CPRA](https://pandectes.io/knowledge-base/differences-between-ccpa-and-cpra/) The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are pivotal privacy laws that enhance consumer data protection in… - [German Cookie Regulation](https://pandectes.io/knowledge-base/german-cookie-regulation/) Understanding and complying with German cookie regulations is essential for businesses operating websites accessible to German users. - [UK Data Protection Act 2018](https://pandectes.io/knowledge-base/uk-data-protection-act-2018/) UK cookie regulations are governed by the Privacy and Electronic Communications Regulations (PECR) and the UK General Data Protection Regulation (UK GDPR). #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=knowledge-base/what-are-cookies&utm_id=pandectes) --- Source: https://pandectes.io/knowledge-base/what-is-the-digital-markets-act/ ### What is the Digital Markets Act? By [Nikos Tsirakis](https://pandectes.io/blog/author/nikos/)30 December 2024 #### What is the Digital Markets Act (DMA)? The **Digital Markets Act (DMA)** is a groundbreaking regulation introduced by the European Union to ensure fair competition and openness in the digital economy. The act specifically targets the largest digital platforms, known as **gatekeepers**, to prevent anti-competitive practices and promote consumer choice. #### Key Objectives of the DMA - **Promote Fair Competition**: Ensure that large platforms do not abuse their dominant position to stifle competition. - **Foster Innovation**: Create a level playing field where smaller businesses and startups can compete effectively. - **Enhance Consumer Choice**: Provide users with more control over their digital experience, including app usage and data sharing. - **Protect Business Users**: Prevent unfair practices that harm businesses relying on digital platforms to reach their customers. #### Who Are Gatekeepers? Gatekeepers are defined as large digital platforms that: - Have a significant impact on the internal market. - Operate a core platform service (e.g., search engines, social networks, online marketplaces) that serves as an important gateway for business users to reach customers. - Hold a durable and entrenched position in the market. Examples of potential gatekeepers include major players like Google, Amazon, Meta (Facebook), and Apple. #### Obligations for Gatekeepers Gatekeepers must comply with several rules under the DMA, including: - Allowing users to uninstall pre-installed apps easily. - Providing businesses with access to platform performance data. - Ensuring fair ranking of products and services, avoiding self-preferencing. - Allowing interoperability with third-party software and services. #### Prohibited Practices Gatekeepers are prohibited from: - Combining user data across different services without consent. - Favoring their own products or services over competitors’ offerings. - Restricting app developers from using third-party payment systems. #### Timeline of the Digital Markets Act - December 2020: The European Commission proposed the DMA to address challenges posed by digital gatekeepers. - March 2022: The European Parliament and EU Member States reached a political agreement on the DMA. - November 2022: The DMA officially came into force. - May 2023: Designated gatekeepers were required to comply with the new rules. #### Key Rules for Gatekeepers **Prohibited Practices:** - No self-preferencing (e.g., ranking their products higher than competitors’). - No use of non-public data from businesses using their platform to compete against them. **Mandatory Practices:** - Allow users to easily uninstall pre-installed apps. - Ensure interoperability with third-party services. - Provide transparency in advertising metrics. #### How Does the DMA Impact Shopify Store Owners? - **Improved Fairness:** Third-party apps, like Pandectes’ GDPR Compliance app, will benefit from fair treatment on digital platforms. - **Better Opportunities:** Easier access to data and digital marketplaces for Shopify merchants. - **Enhanced Trust:** Compliance with DMA fosters consumer trust in online businesses. #### Why Does the DMA Matter? The DMA represents a shift toward a more balanced digital ecosystem. By holding gatekeepers accountable, the regulation ensures: - **A Level Playing Field:**Smaller businesses can compete without unfair barriers. - **Empowered Consumers:**More choices and transparency in the digital market. - **Stronger Innovation:** Encourages new entrants and technological advancements. #### More from the Knowledge Base - [Differences Between CCPA and CPRA](https://pandectes.io/knowledge-base/differences-between-ccpa-and-cpra/) The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are pivotal privacy laws that enhance consumer data protection in… - [German Cookie Regulation](https://pandectes.io/knowledge-base/german-cookie-regulation/) Understanding and complying with German cookie regulations is essential for businesses operating websites accessible to German users. - [UK Data Protection Act 2018](https://pandectes.io/knowledge-base/uk-data-protection-act-2018/) UK cookie regulations are governed by the Privacy and Electronic Communications Regulations (PECR) and the UK General Data Protection Regulation (UK GDPR). #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=knowledge-base/what-is-the-digital-markets-act&utm_id=pandectes) --- Source: https://pandectes.io/knowledge-base/why-its-important-to-comply-with-google-consent-mode-v2/ ### Why It’s Important to Comply with Google Consent Mode V2 By [Nikos Tsirakis](https://pandectes.io/blog/author/nikos/)21 January 2025 #### Respecting Privacy Builds Trust Complying with Google Consent Mode V2 demonstrates that your business respects user privacy preferences. By honoring consent choices transparently, you foster trust and loyalty among your customers. Trust is the foundation of long-term relationships and a key differentiator in today’s privacy-conscious market. Consumers are more likely to engage with brands that value their privacy. #### Ethical Data Collection Enables Personalization Google Consent Mode V2 allows you to ethically collect data while maintaining access to advanced targeting features. Tools such as dynamic remarketing and lookalike audiences enable you to deliver personalized ad experiences to users who have consented. This approach not only complies with regulations but also ensures that your marketing strategies remain effective and user-centric. #### Accurate Data Leads to Better Decisions Data loss due to non-consenting users can hinder your ability to analyze performance effectively. Consent Mode V2 mitigates this by enabling behavioral modeling, which predicts user behavior using anonymized data. This ensures that you can still access critical insights for decision-making, such as conversion tracking and audience engagement metrics, even when full consent isn’t granted. #### Compliance Optimizes Ad Campaigns Complying with Consent Mode V2 ensures your ad campaigns remain competitive. By providing accurate data for bidding optimization and campaign analysis, it helps you deliver cost-effective ads while achieving exceptional results. Tools like Google Ads and Google Analytics 4 work seamlessly with Consent Mode to keep your campaigns efficient and impactful. #### Future-Proofing Your Business As privacy laws evolve, ongoing compliance with Consent Mode V2 ensures your business is always prepared. Google frequently introduces updates and new features, and maintaining compliance guarantees that your tools remain functional. This forward-thinking approach protects your operations while ensuring access to the latest marketing technologies. #### Enhancing Global Compliance For businesses operating across multiple regions, Consent Mode V2 simplifies compliance with global privacy laws such as GDPR and CCPA. It supports multilingual banners and adapts tag behavior dynamically to meet the legal requirements of each region. This makes it easier for you to maintain a consistent, privacy-first approach worldwide. #### Conclusion Complying with Google Consent Mode V2 is about more than just meeting legal obligations, it’s about building trust, optimizing data collection, and preparing for the future. By respecting user privacy and leveraging advanced tools, you position your business for sustainable success in an increasingly privacy-driven digital landscape. #### More from the Knowledge Base - [Understanding Google Consent Mode v2](https://pandectes.io/knowledge-base/understanding-google-consent-mode-v2/) In today’s digital landscape, data privacy is a growing concern for both consumers and businesses. - [Differences Between CCPA and CPRA](https://pandectes.io/knowledge-base/differences-between-ccpa-and-cpra/) The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are pivotal privacy laws that enhance consumer data protection in… - [German Cookie Regulation](https://pandectes.io/knowledge-base/german-cookie-regulation/) Understanding and complying with German cookie regulations is essential for businesses operating websites accessible to German users. #### Make your Shopify Store's use of cookies and online tracking compliant today [Try for free](https://apps.shopify.com/gdpr-cookie-consent?utm_source=pandectes&utm_medium=website&utm_campaign=unlabelled&utm_content=knowledge-base/why-its-important-to-comply-with-google-consent-mode-v2&utm_id=pandectes) ---