Cookie banner and GDPR for an online store in Bulgaria

In short: under GDPR and the EU cookie rules, an online store may set analytics and advertising cookies only after the customer agrees, must publish a privacy policy, keep proof of who accepted what, and answer access or erasure requests within 1 month. In CloudCart the GDPR app covers all of it: a cookie banner, 5 cookie groups, 4 ready policies, a consent log and a request list.

This guide is for stores selling to EU customers in or from Bulgaria. It explains what Regulation (EU) 2016/679 (the GDPR) and the ePrivacy Directive 2002/58/EC require, how Bulgaria applies the cookie rule, and how each duty is handled in CloudCart, the Bulgarian ecommerce platform. This is not legal advice: have a lawyer review the final policy texts. The Bulgarian regulator is the Commission for Personal Data Protection (CPDP, in Bulgarian KZLD). Returns are covered in the guide to returns and consumer rights in Bulgaria.

What are website cookies and which ones need consent?

Cookies are small text files a website stores in the browser to remember the cart, the login or the traffic source. Every cookie that is not strictly necessary for the service the customer asked for needs consent first: analytics, advertising, remarketing and embedded third-party services (ePrivacy Directive 2002/58/EC, Art. 5(3)).

The rule also covers pixels, local storage and scripts that read the device. So Google Analytics, Google Ads, Meta Pixel and TikTok Pixel wait for a "yes", while the cart and session work without asking.

Cookie type	Example in an online store	Consent needed?
Strictly necessary (session or persistent)	Cart, login, language, the cookie choice itself	No
Analytics (performance)	Google Analytics 4	Yes
Advertising and remarketing	Google Ads, Meta Pixel, TikTok Pixel	Yes
Third-party functional	Embedded video, external chat	Yes, if the service sets its own cookies

How Bulgarian law puts the cookie rule

Bulgaria wrote the ePrivacy cookie rule into Art. 4a of the Electronic Commerce Act (in Bulgarian, on lex.bg), in force since Dec 29, 2011. A store may store or read information on the device only after clear information under Art. 13 GDPR and a way to refuse; strictly necessary cookies are exempt. Art. 6(4) of the same act bans marketing emails to consumers without prior consent, so the newsletter checkbox stays optional and unticked.

What does GDPR require from an online store?

GDPR asks five things of an online store: consent before non-essential cookies, clear information on who processes the data, proof of consent, answers to customer requests and data protection. Each has its own section in the CloudCart GDPR app.

Duty	Where it comes from	Where it is in CloudCart
Consent before analytics and ad cookies	Directive 2002/58/EC, Art. 5(3); Electronic Commerce Act, Art. 4a	Apps → GDPR → Cookies
Who the data controller is	GDPR, Art. 13	Apps → GDPR → Address and Policy
Proof that the customer gave consent	GDPR, Art. 7(1)	Apps → GDPR → Acceptance
Easy withdrawal of consent	GDPR, Art. 7(3)	A cookie settings link in the storefront
Answering access, portability or erasure requests within 1 month	GDPR, Art. 12(3) and Art. 15 to 20	Apps → GDPR → Requests

Fines for breaching the core principles can reach €20 million or 4% of annual worldwide turnover, whichever is higher (GDPR, Art. 83(5)), and in Bulgaria the CPDP imposes them. A pre-ticked box is not valid consent: the Court of Justice of the EU ruled so in the Planet49 case (C-673/17) in 2019.

What is the CloudCart GDPR app and who needs it?

The GDPR app is the CloudCart module for personal data protection: it shows the cookie banner, holds back advertising scripts until consent, stores the policies and the consent log, and collects customer requests. Every store with at least one customer in the EU needs it.

The app is in Apps → GDPR, and the pricing page lists "GDPR app and legal documents" among the features; check the app's terms for your plan there before installing. Its tabs are Overview, Settings, Address (company details), Cookies, Policy, Acceptance (the consent log) and Requests. The Enable / Disable button keeps the settings when off, but the banner disappears and advertising scripts start without consent.

How to set up GDPR in CloudCart step by step

GDPR in CloudCart is set up in six steps, and the company details come first. The platform inserts them into the ready policies once, on installation; later changes mean editing the policies by hand.

1. Prepare the company details. Name, Company registration number (the UIC from the Bulgarian Commercial Register), Company owner (the managing person), phone and address. Empty fields are accepted, so check them yourself.
2. Install the app. In Apps, choose GDPR. It creates 4 ready policies and 5 cookie groups with your company details.
3. Choose a bar or a wall. In Cookies → Cookie Consent Mode, choose Cookie bar or Cookie wall, then write Cookies bar text and Cookies consent text.
4. Set up the cookie groups. Set Active, Default state, Name and Description, and add the cookies your store uses.
5. Review the policies. Check the four policies and add your ad and analytics providers, couriers (for example Econt, Speedy or BOX NOW) and payment provider.
6. Test the storefront. Open the store in a private window, refuse the advertising group and check the banner and settings link. Repeat on a phone, where the banner must not cover "Add to cart" (more in the guide to the mobile version of an online store). Make a test registration and find it in Acceptance.

How do I add a cookie banner to my online store?

The cookie banner in CloudCart is switched on in Apps → GDPR → Cookies, where the Cookie Consent Mode menu offers a bar (Cookie bar) or a wall (Cookie wall). The two modes exclude each other: choosing one turns the other off.

The bar is a strip at the bottom that lets the customer keep browsing; the wall blocks the page until the customer accepts or saves a choice. The European Data Protection Board considers that access to a site made conditional on accepting cookies does not produce valid consent (EDPB Guidelines 05/2020 on consent). For most stores the bar is the safer choice.

The five cookie groups

The customer accepts or refuses a whole group at once.

Group	What it is for	State on installation	Recommendation
Strictly necessary	Session, cart, customer login	Always on, cannot be refused	Leave as is
Performance	Analytics, e.g. Google Analytics	Active, "accepted" by default	Default state: off
Functional	Video, live chat, language choice	Active, "accepted" by default	Default state: off, if third-party cookies
Targeting	Advertising, e.g. Google Ads, TikTok Pixel	Active, "accepted" by default	Default state: off
Google Consent Mode	Consent signal to Google	Inactive, "refused" by default	Turn it on if you advertise on Google

Default state decides what applies before the customer chooses, and three groups start as "accepted", so their scripts run without an answer. Valid consent is a clear affirmative action by the customer (GDPR, Art. 4(11)), and a pre-accepted state is not such an action. Switch it off for analytics and advertising.

What happens when the customer chooses

• "Accept" accepts all groups.
• "Save settings" saves the choice per group and clears cookies of refused groups.
• × only hides the banner on that page; nothing is saved.
• Partial consent is saved, and the banner keeps reminding until all groups are accepted.

The choice is kept for 365 days, and editing the banner text does not ask again. The banner shows to every visitor, whatever the country, and the app does not detect cookies by itself: you add each one to its group.

Important: the customer must be able to change the choice at any time (GDPR, Art. 7(3)). Check that your theme shows a "Cookie settings" link, usually in the footer; if not, write to support@cloudcart.com.

Google Consent Mode v2 and advertising pixels

Google Consent Mode v2 is the signal that tells Google Ads and Google Analytics whether the customer allowed advertising and analytics cookies. For users in the European Economic Area, Google requires consent for remarketing and ad measurement (Google EU user consent policy).

In CloudCart, Consent Mode v2 is a separate group in Apps → GDPR → Cookies, switched off by default. It can be switched on only with a subscription to the GDPR app (an older one-time purchase is offered a move to the subscription). Once on, the store passes the choice to Google Ads, Google Analytics and Floodlight.

A refused group also stops connected apps: Google Analytics, Google Tags, TikTok Pixel and Facebook Comments check the choice before they start. Connecting the tools is covered in the guides to GA4 and Google Tag Manager and Google Ads for an online store. SSL, backups and two-factor login are on the domain, SSL and GDPR page and in the guide to domain, SSL and team security.

What goes into the privacy policy and the cookie policy?

The privacy policy states who processes which data, why, on what legal basis, for how long, who receives it and how customers exercise their rights (GDPR, Art. 13). The cookie policy lists each group and cookie with its purpose and duration.

On installation CloudCart creates 4 policies in the store's language (Bulgarian, English, Romanian, Greek, Hungarian or Macedonian; any other language gets English text) and attaches them to forms:

Policy	Where it appears	Required or optional
Privacy policy	Registration and order checkout	Required
Terms and conditions	Registration and order checkout	Required
Consent to processing personal data (marketing)	Registration, checkout and the newsletter pop-up	Optional
Cookie policy	A separate page in the storefront	Informational

Any policy can go on any of five forms (registration, contact, checkout, newsletter pop-up, re-acceptance pop-up), as required or optional. In the cookie policy text, place {cookies_table}: at that spot the storefront shows a table of the groups and cookies you entered.

Accepting the marketing policy gives the customer marketing consent in their profile, and the subscriber list and email apps follow it.

For customers who registered before the app, turn on the re-acceptance pop-up in Settings (show_policies_popup): a logged-in customer with no record sees it after login.

How do you prove which customer accepted what?

Proof of consent in CloudCart is the log in Apps → GDPR → Acceptance: each row shows which customer accepted which policy, when and from which form. For every row the IP address and device are also kept.

The platform keeps the exact policy version the customer saw, so editing a policy does not change old records. Records cannot be edited or deleted, even after an erasure: only the profile data is removed and the fact of consent stays. The log is searched by email, and Export downloads an Excel file after a two-step verification code; above 500 records it is prepared in the background.

How do I handle a data erasure request?

A data erasure request is handled in Apps → GDPR → Requests, and you answer the customer within 1 month of receiving it. The deadline can be extended by 2 more months for complex or numerous requests, if you inform the customer within the first month (GDPR, Art. 12(3)).

Customers file requests from the /gdpr page in the storefront:

Type in the list	What the customer asks for	What you do
info	What data you hold (Art. 15)	Send the data
download	Their data in a file (Art. 20)	Send CSV, JSON or XML
delete	Erasure of the data (Art. 17)	Erase profile data; invoices stay
marketing_unsubscribe	Opting out of marketing	Stop marketing emails

1. Check who is asking. The request must come from the account or the registered email, or you may wipe a real customer's profile.
2. Carry out the action in the customer's profile. In Customers, remove the name, email, phone and addresses, or use Delete customer. There is no undo, so do it last.
3. Keep what the law requires. Invoices and orders stay under Bulgarian accounting law, as GDPR Art. 17(3)(b) allows.
4. Mark it processed and reply by email. The platform does not notify the customer, so tell them what you did.

Important: the list has no 30-day counter. Open Requests at least once a week and watch the submission date.

Requests by email or phone do not enter the list; track them with the same deadline.

Can an AI assistant work on the store without breaching GDPR?

An AI assistant such as Claude Code, ChatGPT Codex or Gemini CLI can work on a CloudCart store in line with GDPR if it sees only the data the task needs. Access is set by a PAT (Personal Access Token) created in Settings → PAT tokens, with permissions per resource.

GDPR requires data to be "limited to what is necessary" (Art. 5(1)(c)), and an outside service processing customer data for you is a processor that needs a contract or accepted terms (Art. 28). Check the AI provider's terms before giving it access to customers.

Task for the agent	Access in the PAT token	Does it see personal data?
Products, prices, stock, blog	Custom Permissions: Products, Inventory, Blog	No
A subscriber segment for a campaign	Customers: Read	Yes

Custom Permissions set None, Read or Read & Write for each of 8 resources; Customers covers customers, groups and subscribers. A token can have an expiry date and up to 20 allowed IPs, and deleting it cuts access at once.

GDPR best practices for an online store

A well set up GDPR app keeps the store clear of fines and its advertising measurable.

• Enter company details before installing. They go into the policies only once.
• Switch Default state off for analytics and advertising. Scripts then wait for a "yes".
• Prefer the bar to the wall, in line with the EDPB view on conditional access.
• Describe every cookie. The platform does not scan the site, so add the cookies of each new ad or chat app.
• Turn on Consent Mode v2 if you advertise on Google.
• Handle requests weekly. The platform sends no reminder of the 1-month deadline.
• Check each store separately. GDPR settings are not copied between stores.

Mistakes to avoid

• Disabling the app for a "cleaner" storefront. The banner disappears and ad scripts start without consent.
• An inactive required policy. Its checkbox does not appear, even if the policy is attached to the form. Check its status in Policy.
• Reinstalling the app. The log and requests stay, but policies and cookie groups return to the defaults and the cookies you added are lost.
• New company details, old policies. Changing Address does not rewrite existing policies.
• Pre-ticked marketing consent, which is not valid consent.
• Deleting orders on request. Accounting documents stay; only profile data is erased.

Frequently asked questions

Sales on CloudCart carry 0% commission (ecommerce with zero commission), and payment, policies and consents sit on one step of the checkout. Create your store for €1 and set up the banner and consent log before the first order. Questions about the GDPR app? Write to support@cloudcart.com.