Bright IT - Which Headless Commerce Platforms Are GDPR Compliant?

Chances are you’ve heard of the term ‘headless commerce’ by now. It’s been the buzzword in e-commerce and retail for quite some time. Since e-commerce systems handle customer data, they have to be compliant with data protection laws such as the EU GDPR. Find out if and how headless commerce solutions are GDPR compliant.

Headless commerce is a relatively modern form of commerce, where frontend and backend systems are ‘decoupled’- meaning they are not ‘stacked upon each other’ but instead share data by using APIs.

This allows for greater flexibility and control over the frontend and backend and is considered in the industry to be a more future-proof approach to building modern commerce solutions. We wrote about the differences and similarities between these approaches a few weeks ago, if you’d like to know more. 

One of the great drivers behind the demand for headless content management systems is speed. Decoupling the frontend and backend layers generally means leaner systems and, thus, faster serving content across multiple customized endpoints. Customers are demanding increasingly quicker load times, so speed equals profit. 

To get an idea of how decoupled commerce is structured, have a look at this diagram down below, created by Shopify.

A more challenging aspect of headless commerce is security. Of course, your use of the software will always determine how secure it is in practice, but generally speaking, decoupled eCommerce solutions are considered more secure because how they are structured - with a separated backend and frontend - allows for better security protocols. This is also important in light of recent GDPR changes.

Let’s take a small step back to consider why the GDPR is relevant when comparing headless commerce providers. Slowly but steadily, the industry is getting used to managing consent for visitors about cookies, newsletters, and analytics tracking. 

For many current commerce solutions, there are of course plugins that can address those issues relatively easily. However, as we argued in one of our blogs about a recent ruling in Austria in favor of a strict interpretation of the GDPR, the industry as a whole might not yet grasp the scope of the implications of the GDPR. The regulation addresses all aspects of the storage of customer data, including:

• What exactly is stored and for how long.

• Where and how this data is stored.

• To what extent the main (eCommerce) party or 3rd Party Services are accountable.

• How your data usage should be communicated to users.

In short, this puts the way we ‘organize’ the internet, eCommerce, and advertising ecosystem at stake (hence Google’s announcement to bid farewell to the cookie as we know it). It requires a ‘design first’ approach to customer data and privacy to allow users to manage their consent to the use of their data. This is where modern commerce providers come into play. Designed and built for the future of privacy, these solutions are competing for and cooperating with multinationals and large companies to make the switch to future-proof content and commerce.

So moving forward, what might some trustworthy options for companies be? Here are a few of our picks for leading headless shopping solutions that can give you an idea of what to look for when researching on your or your company's behalf.

Here it’s important to note that GDPR compliance doesn’t just come down to the software itself. A service can provide the tools you need, but how you use it determines your level of legal compliance. Most modern headless commerce providers can only allow for GDPR-compliant use of customer data, not guarantee it by default.

Optimizely (Commerce Cloud)

Optimizely offers two flavors of their commerce solution, Commerce Cloud. One caters to the likes of B2C organizations, and one would be more fit for B2B teams. Its B2B Commerce Cloud has a React-based storefront, which allows for more ‘granular control over customer experiences’.

On a security level, Optimizely is in process of obtaining ISO 27001 certification for its complete range of products.

Out of the box, Commerce Cloud comes with all the necessary opt-in features for end users to manage their data preferences. 

Optimizely Commerce Cloud is hosted on the Microsoft Azure Cloud infrastructure. This allows you to set it up to meet the strictest GDPR compliance requirements. For example, you can dictate that German consumer data will only be stored and processed in data centers located in the EU.

If you wish to read more about Optimizely’s Commerce Cloud GDPR compliance efforts, you can find a more detailed description of its procedures here. 

Shopify Plus

Shopify Plus can best be described as Shopify’s big brother, ready to serve full-scale enterprises. It is one of the better-known brands in eCommerce and has attracted a big following over the years. However, its price indicates that this suite is not for startups.

The company states that: "Shopify has designed its platform to enable you to offer your customers transparency into and control over their personal information." However, you and your company, as a processor of your customers' data, are responsible for configuring Shopify’s features to handle customer data and comply with the GDPR. 

One of the platform’s big selling points is that they allow merchants to sell products around the world. One of the main and straightforward features that Shopify has built into their software, in light of GDPR guidelines, is the ability to allow merchants to obtain independent consent for marketing purposes. They can also choose whether or not to pre-check the consent checkbox depending on their requirements. This means you can configure the platform to suit your local regulations.

Shopify goes into more detail about all the different elements of their compliance with the GDPR in their whitepaper. For more details on their obligations as a data processor in relation to your company, you can access their Data Processing Agreement (DPA).

In this article, we’ve discussed a short explanation of the core concepts of headless commerce solutions, and why it is important from a business and infrastructural perspective. We’ve also argued why investing time and research into several headless commerce solutions is beneficial to business owners to prepare for the future of commerce on one hand and privacy design and data use on the other. 

We’ve argued why compliance matters and that picking a good provider is only the first step. If one thing has to come out of this transition to headless commerce, it is that eCommerce customers will benefit. Compared to monolithic commerce solutions, headless commerce can be more easily adjusted to the buyers’ desired shopping experiences and comply with data protections like GDPR.