GDPR Issue – Customer Data Stored on Abandoned Checkout (Before Payment Completion)
Hi FluentCart team,
I’d like to raise a GDPR compliance concern that I believe affects all EU-based stores using FluentCart.
The issue:
When a user starts the checkout process but does not complete the payment (abandoned checkout), FluentCart already creates a customer record in the database – including personal data such as name, email address, and billing information.
This is problematic under GDPR (EU Regulation 2016/679) because:
• No purchase has been completed
• No explicit consent for data storage has been given at this stage
• Personal data is being stored without a valid legal basis
This means that simply visiting the checkout page and entering personal details – without completing the payment – results in permanent data storage, which is not compliant with GDPR requirements.
What I would expect:
Customer records should only be created after a successful payment has been processed and the user has actively agreed to the terms (which includes data processing consent).
Alternatively, a built-in option to automatically delete or anonymize abandoned checkout data after a defined period (e.g. 24–48 hours) would be a valuable and necessary feature for EU stores.
Is this something that is already on your roadmap? I would appreciate any guidance on how to handle this correctly in the meantime.
Thank you!
"Customer records should only be created after a successful payment has been processed and the user has actively agreed to the terms"
That pretty much nukes things like abandoned cart, right?
"Alternatively, a built-in option to automatically delete or anonymize abandoned checkout data after a defined period (e.g. 24–48 hours) would be a valuable and necessary feature for EU stores."
That I do like. Nice suggestion. +1
Good point.
The suggestion to automatically anonymize the abandoned cart after 24-48 hours might be worth exploring, however there might be a better solution. What if FluentCart added a checkbox on the cart that let's the customer save their cart's contents for later. This way the user has made the decision through a deliberate action (the checkbox)
Part of the reason why abandoned cart tracking is great is it allows stores to automate followup emails to try and still get the sale from the customer. If you anonymize the abandoned cart then this would no longer be possible. The feature wouldn't be completely useless in this case though because abandoned carts may also signal a broken / too complicated checkout experience and things like that.
Great suggestion. It would be helpful if WPManageNinja also published a roadmap for when all of their amazing plugins will be GDPR compliant.