Cross-border purchases made up 16% of all global orders over Black Friday Cyber Monday weekend in 2025, according to Shopify.
However, the five top-selling countries, the U.S., the U.K., Australia, Germany, and Canada, each have their own privacy rules.
That means one checkout can fall under different consent requirements depending on where the shopper is.
Black Friday Cyber Monday 2026 runs November 27 through 30, meaning stores selling abroad will face those privacy rules during peak traffic.
But which rules actually apply to a U.S. retailer that never opened an office abroad?
Shipping Abroad Can Trigger the GDPR
Selling to Germany can put a store under the GDPR even without an EU office.
Article 3(2) covers sellers outside the Union that offer goods or services to people in it, according to the European Data Protection Board.
The rule also reaches tracking of shoppers’ behavior in the EU, which analytics and retargeting tags can do.
For offers, Recital 23 looks for signs that the store clearly envisages serving customers in EU countries.
Consent management platform Cookiebot by Usercentrics lists such signs, including shipping to EU countries and accepting EU payment methods, in its guide to the GDPR for U.S. companies.
In fact, marketing does not have to target Europe.
Offering shipping to EU countries or enabling EU payment methods "may indicate that the company offers services to EU individuals," the guide says.
In other words, a U.S. store that ships to Germany can be covered without ever running a European campaign.
Once the GDPR applies, non-essential cookies and trackers need consent before they activate.
Foreign Regulators Can Fine a Store Over Its Cookies
Many stores based outside the EU must also appoint a representative in the EU, whom regulators and individuals can contact on GDPR matters, according to Cookiebot.
Regulators enforce the consent requirement across borders, and a miss can be costly.
For example, France’s data protection authority fined the Irish subsidiary of the SHEIN group 150 million euros in September 2025, which was about $175 million at the time.
It found advertising cookies running as soon as users arrived on shein.com, before any interaction with the banner, according to the CNIL.
The CNIL said its jurisdiction extends to devices used by people in France, and it tied its reach over SHEIN to the company’s French entity.
For a store selling abroad, a local presence in a market can bring that market’s regulator into play.
Consent Rules and Coverage Thresholds Differ by Market
In the EU, non-essential cookies can’t load until a shopper agrees. California instead gives shoppers a way to opt out of data sales and sharing.
A U.K. law that took effect in February 2026 exempts analytics cookies that only gather aggregate statistics from consent, provided visitors are told and can object easily, per the ICO.
The EU exempts only strictly necessary cookies, the Cookiebot Shopify setup guide says. So the same tag can need consent in Germany and only a notice in the U.K.
Coverage thresholds differ too. One of California’s tests is annual gross revenue above $26,625,000, according to the California Privacy Protection Agency.
Connecticut now covers businesses that process the personal data of at least 35,000 residents, down from 100,000 before July 1, 2026.
It also covers any seller of personal data, according to Public Act 25-113. A store can therefore fall under a state law it has never checked.
By contrast, the GDPR sets no cutoff based on how many EU shoppers a store has, according to Cookiebot.
Built-In Banners Stop at the Platform
Shopify's built-in banner has limits. The platform's developer documentation says consent decisions apply to Shopify-managed surfaces such as pixels, audiences, and checkout.
The banner therefore "only controls the platform’s own tracking," according to Cookiebot.
For example, a Meta Pixel pasted straight into theme code, outside Shopify's native tools, "keeps firing whatever the visitor chose," unless a developer adds a check.
The CNIL cited the same failure at SHEIN, where new cookies kept loading after users refused them.
Beyond regulatory risk, consent signals that arrive late or wrong can corrupt the data ad platforms bid on.
Every new app or theme edit can add another tracker, so a store has to recheck its coverage each time it makes a change.
Consent Platforms Scan and Log Choices
To make every tag respect a visitor's choice, stores can turn to a dedicated consent platform.
A basic banner informs visitors but does not necessarily give them "meaningful opt-in or opt-out control," according to Shopify's guide to consent management platforms.
The software enforces each choice by blocking or enabling the associated scripts. Cookiebot says that includes pixels added by apps, which stay blocked until a visitor agrees.
Many platforms also scan a site for new trackers on a schedule such as weekly or monthly, per Shopify.
Cookiebot's own scan runs monthly and, according to the company, sorts each tracker into a category.
Platforms also keep logs of each visitor’s choice that are "essential for regulatory compliance across multiple regulations and jurisdictions."
Those records are what a store can show a regulator in any of the markets it sells into when asked what a shopper chose.
Pre-Sale Checks Worth Running Now
Market rules, the built-in banner’s limits, and scheduled scans all come down to what a store's tags do once a shopper arrives.
With BFCM starting near the end of next month, Cookiebot points to two quick checks:
- Rescan the store after each app install, since apps can bring in trackers the last scan never saw.
- Open the store in a private window and look for a reject button on the banner’s first screen.
The first catches trackers added in the meantime. The second shows whether a shopper can refuse without digging through settings.
Come November 27, a store’s consent setup will be judged by the rules of every market it ships to, not the one it operates from.
