Does Medusa.js require cookie consent?

No for essential operations. Medusa.js is an open-source headless e-commerce backend that powers cart, order, and product data through APIs. Session and cart cookies are essential for store functionality and are exempt from consent requirements under GDPR. No marketing or behavioral tracking is inherent to the platform.

What cookies does Medusa.js set?

Medusa.js sets session cookies to maintain cart state, authenticate users, and manage checkout flow across page navigations. These are strictly functional cookies required for e-commerce operations. No third-party tracking or behavioral profiling cookies are set by Medusa.js itself.

How does ConsentStack handle Medusa.js?

ConsentStack classifies Medusa.js as Essential and Functional. Cart and session cookies are treated as essential and are never blocked regardless of consent status. ConsentStack does not interfere with Medusa.js API calls or storefront functionality, ensuring checkout remains operational for all visitors.

What tracker domains does Medusa.js use?

ConsentStack has catalogued tracker domains for Medusa.js including medusajs.com. These are the network destinations Medusa.js's scripts contact, which a consent platform blocks until a visitor agrees.

Medusa.js - Headless E-Commerce Platform Privacy Overview

Back to Vendor Library

Overview

Medusa.js is an open-source, MIT-licensed headless commerce platform that provides a modular backend for building custom e-commerce storefronts. Unlike SaaS e-commerce platforms, Medusa runs on the merchant's own infrastructure and does not introduce third-party tracking scripts. The framework provides REST and GraphQL APIs for cart, product, order, and customer management; browser-side behavior is entirely determined by the storefront the developer builds on top of it.

What This Script Does

Medusa.js itself does not ship browser-side tracking scripts. Client-side behavior depends entirely on the storefront implementation:

Storefront API calls: The browser-side storefront (typically built with Next.js, Nuxt, or a custom framework) makes API requests to the Medusa backend at the merchant's own domain or a dedicated API subdomain (e.g., api.store.com). These are first-party requests.
Cart and session state: Session tokens and cart state are typically managed via cookies or localStorage set by the storefront application, scoped to the merchant's domain. Medusa's backend issues JWT tokens or session identifiers for authenticated customer flows.
No third-party beacons: Medusa does not send data to Medusa Inc.'s servers from the browser. There is no telemetry, analytics, or tracking code bundled into Medusa's client-side packages.
Plugin ecosystem: Third-party analytics or payment plugins integrated with Medusa (e.g., Stripe.js, Segment, Klaviyo) are independent of Medusa itself and have their own consent requirements.

Consent & Compliance

GDPR and ePrivacy: Medusa.js is self-hosted open-source infrastructure. It does not impose any third-party data flows from the browser. Cart and authentication cookies are strictly necessary for the e-commerce functionality and are exempt from consent requirements under the ePrivacy Directive. The merchant is the sole data controller for all data processed through their Medusa implementation.

CCPA/CPRA: No personal information is transmitted to Medusa's servers from the browser. The merchant's own data practices govern all consumer data collected through the storefront.

This vendor is classified as essential and functional. It is backend infrastructure with no third-party tracking footprint.

Should You Block This Without Consent?

No.

Medusa.js is self-hosted open-source e-commerce infrastructure. There are no third-party tracking scripts to block. Consent management for a Medusa-based store should focus on the third-party tools the developer chooses to integrate (analytics platforms, ad pixels, payment processors) rather than Medusa itself.

Is Medusa.js GDPR compliant?

Medusa.js typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Medusa.js can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Medusa.js, not on Medusa.js itself.

Visit website