EU compliance

GDPR, cookies and the right of withdrawal

GDPR has applied since 25 May 2018. For a store it comes down to three jobs: non-essential cookies wait for consent, you can show what each person agreed to, and data subject requests get an answer on time. EDPB guidance gives one month to respond, with two more for complex requests if you tell the person within the first month.

The consent rule for cookies comes from Article 5(3) of the ePrivacy Directive, which exempts strictly necessary cookies. The EDPB guidelines explain its scope.

The right of withdrawal is consumer law, not GDPR. Since 19 June 2026, an online shop selling to EU consumers has to offer a withdrawal function. The suite includes one for Luma, Hyvä and GraphQL storefronts. It ships switched off, and the statutory exceptions are yours to map.

The suite stores each consent with the wording the shopper saw, and removes a registered cookie in a refused category in the server response as well as in the browser. It supports compliance and does not certify it: your configuration and your lawful basis remain your responsibility.

See GDPR Compliance SuiteRead the docs

GPSR, Regulation (EU) 2023/988

GPSR has applied since 13 December 2024. Under Article 19, an online offer has to show the manufacturer's name and postal and electronic address, the EU responsible person when the manufacturer is outside the EU, details that identify the product, and any warnings or safety information.

The GPSR extension keeps one record per manufacturer and shows it on every product with that manufacturer's attribute option, as a product tab or below the description, with attached documents such as declarations of conformity. It publishes the information and does not decide what the information must say, so check product identifiers and warnings separately.

See GPSRRead the docs

Omnibus Directive, Directive 2019/2161

Since 28 May 2022, announcing a price reduction in the EU means showing the prior price: the lowest price you applied in a period of at least 30 days before the reduction. The rule is Article 6a of the Price Indication Directive, added by Directive 2019/2161. Member States can set their own rules for perishable goods, new arrivals and progressive reductions, so check each market.

The Court of Justice ruled in Case C-330/23 that an announced reduction has to be calculated from the prior price.

The Omnibus Directive extension records each price change from Magento's price index, per website and customer group, and shows the prior price on product pages, category grids and search results. Its optional -X% badge is calculated from the prior price. History starts when you install, so a product whose price has not changed since then shows no prior price and no badge.

See Omnibus DirectiveRead the docs

PPWR, Regulation (EU) 2025/40

PPWR has applied since 12 August 2026, with later dates for labeling, minimization and empty space. Commission guidance separates two roles: the manufacturer answers for the packaging itself, and the producer registers, reports and pays extended producer responsibility (EPR) fees in the Member State where the packaging is expected to become waste.

If you sell directly to consumers in other Member States, the Commission says you need an authorized representative there since August 2026. It has proposed suspending that for small businesses, and while Parliament and the Council examine the proposal, it has asked Member States not to sanction operators.

The PPWR extension keeps packaging specifications, evidence and what went out with each shipment in Magento, then totals the weights per material for a market and period. It does not file anything: a person transcribes the figures into the scheme's own portal. It exports a generic CSV, no verified country adapter ships, and Article 12 marks still belong on the physical packaging.

See PPWRRead the docs