By platform

GDPR Policy Generator for Shopify

Written for Shopify checkout, Shopify Payments, the app ecosystem and the customer privacy API.

Generate your GDPR policy Read the GDPR policy guide

GDPR on Shopify is a shared responsibility with an uneven split. Shopify handles its own processor obligations and exposes the mandatory GDPR webhooks to apps, but the controller duties - lawful basis, the records, the consent evidence and the response to a data subject request - stay entirely with the merchant.

A Shopify store is not one data flow, it is about a dozen. Checkout collects name, address, phone and payment token; Shopify Payments runs fraud analysis; Shop Pay stores card details for reuse across merchants; the customer accounts system holds order history; and every app you install adds its own collection, usually with its own processor and its own cookies.

That app layer is what most Shopify privacy policies get wrong. Reviews, upsell, loyalty, subscription, back-in-stock and abandoned-cart apps all read customer data through the Shopify API, and several of them place third-party scripts on the storefront. A policy that names only Shopify is describing a fraction of the processing actually happening.

Shopify gives you real tooling for this. The customer privacy API carries consent state to apps and pixels, the Customer Privacy settings can block tracking until consent, and the built-in policy fields render at /policies/privacy-policy and are linked automatically from checkout. Using them properly is the difference between a policy that is published and one that is enforced.

What a GDPR policy for a Shopify store has to cover

Records of processing covering checkout, marketing, apps and fulfilment as separate activities
The lawful basis for each: contract for the order, consent or soft opt-in for marketing
Article 28 terms with Shopify and with every app that reads customer data
How the customers/data_request, customers/redact and shop/redact webhooks are honoured across your app stack
Consent evidence from the banner and from the checkout marketing checkbox, retained and retrievable

Shopify surfaces data requests in the admin, but fulfilling one properly means reaching the apps too. An app that holds order data and does not honour the redact webhook leaves your erasure incomplete regardless of what the admin reports.

How a Shopify store actually moves personal data

Checkout and order data

Name, email, shipping and billing address, phone and order contents, processed under contract. Shopify processes it on your behalf, and separately as a controller for fraud prevention and platform security.

Shop Pay and accelerated checkouts

Shop Pay, Apple Pay, Google Pay and PayPal Express each collect through their own interface and hand back a token. The customer’s payment details go to the provider, not to you, and the policy should say so rather than implying you store cards.

Storefront analytics and the Meta pixel

Shopify’s own analytics, Google Analytics 4 through the Google & YouTube channel, and the Meta pixel through the Facebook channel all set identifiers on the storefront. Under UK and EU rules these need consent before firing.

App-installed scripts and web pixels

Reviews widgets, loyalty programmes, live chat, upsell popups and back-in-stock alerts inject scripts that set their own cookies and send data to their own vendors. Each is a separate recipient.

Abandoned cart and email marketing

Capturing an email at checkout and then sending a recovery email is direct marketing. In the UK and EU it needs either consent or a correctly-applied soft opt-in, and the checkout marketing checkbox has to be unticked by default.

Customer accounts and Shopify’s new login

Passwordless customer accounts move identity handling to Shopify, which changes who holds the authentication data and belongs in the recipients section.

Fulfilment and shipping carriers

Address data goes to carriers and to any third-party logistics provider, plus customs data for cross-border orders - which is a transfer as well as a disclosure.

Third parties the draft will ask you about

Shopify Inc. · Shopify Payments (Stripe) · PayPal · Klarna · Shop Pay · Klaviyo · Judge.me or Loox · Gorgias · Google Analytics 4 · Meta · ShipStation

The rules that apply

Shopify Terms of Service

Merchants must publish a privacy policy that meets applicable law. Shopify provides the policy fields and links them from checkout, but the content is your responsibility.

Shopify Protect and fraud analysis

Fraud scoring means Shopify processes order data for its own purposes as well as yours, which is a disclosure and, in the EU and UK, potentially an automated-decision question.

Customer Privacy API and consent tracking

Shopify’s consent framework gates when apps and pixels may collect. If it is not configured, apps typically default to collecting immediately.

App Store data-access declarations

Every app you install declares the customer data it reads. That list is the starting point for your recipients disclosure.

Payment card industry obligations

Shopify Payments and third-party gateways handle card data so you do not store it - but your policy still has to describe the hand-off accurately.

What the generated GDPR policy contains

Article 13 and 14 transparency notice
The full disclosure set, split by whether the data came from the person or from somewhere else.
Lawful basis register
Every processing activity mapped to one of the six bases, with the legitimate interests assessment written down where you rely on that basis.
Records of processing (Article 30)
The internal register a supervisory authority can ask for at any time, covering purposes, categories, recipients, transfers and retention.
Data subject rights procedure
How a request arrives, how identity is verified, who handles it, and the one-month clock with its two-month extension.
International transfer mechanism
Adequacy, SCCs with a transfer impact assessment, or the UK IDTA/addendum - named per destination, not asserted in general.
Breach detection and 72-hour notification
The internal escalation path, the assessment test, and the template for notifying the regulator and, where required, the individuals.
Processor and sub-processor controls
Article 28 terms, the sub-processor list, and the change-notification commitment your customers will ask for.

Publishing the document on Shopify

Paste it into Settings → Policies
Shopify hosts privacy policy, refund policy, terms of service, shipping policy and contact information as first-class fields. They render at /policies/<name> and are linked automatically from checkout.
Add the links to your footer menu
Checkout links are not enough for a crawler or a visitor who never reaches checkout. Add the policy pages to the footer menu under Content → Menus.
Wire consent into the customer privacy API
Use a consent app or the privacyBanner API so that Shopify passes consent state to pixels and apps instead of letting them collect immediately.
Audit installed apps and web pixels
Settings → Apps and Customer events list what is running. Reconcile that list against your recipients and cookie table.
Untick the checkout marketing consent box for EU and UK markets
Settings → Checkout → Marketing options. Pre-selection is a valid configuration in some markets and not in others.
Re-check after every theme or app change
A new app is a new recipient and usually a new cookie. The policy goes stale the moment the app list changes.

Where this usually goes wrong

Using the Shopify sample policy unedited

Shopify’s template is a scaffold with placeholder text. It does not know which apps you installed, which markets you sell to, or which payment providers you use - and merchants routinely publish it with the placeholders still in place.

Not listing the apps that read customer data

Every app with customer or order scope is a recipient. The app list in your admin is effectively a first draft of your sub-processor list.

Pixels firing before consent in the UK and EU

Installing the Facebook or Google channel drops a pixel on every storefront page. Without the customer privacy API wired into your banner, it fires on page one regardless of consent.

A pre-ticked marketing checkbox at checkout

Shopify lets you set the checkout marketing consent checkbox to pre-selected. In the UK and EU that is not valid consent, and it contaminates the whole list.

No cookie policy despite a dozen app cookies

The default Shopify policy set has no cookie policy, so most stores publish none - while running review widgets, chat and retargeting that each set their own.

Ignoring the storefront’s own cookies

Shopify sets _shopify_y, _shopify_s, cart and secure_customer_sig by default. Some are strictly necessary and some are analytics, and the distinction belongs in the table.

Frequently asked questions

Does Shopify provide a privacy policy?

It provides a template with placeholders and a hosting field, not a finished document. The template cannot know which apps you run, which payment providers you use or which jurisdictions you sell into - all of which change what the policy has to say.

Where does my Shopify privacy policy live?

At yourstore.com/policies/privacy-policy once you save it in Settings → Policies. Shopify links it from checkout automatically; you should also add it to the footer menu.

Do I need a cookie policy for a Shopify store?

If you sell to the UK or EU, in practice yes. Shopify sets its own cookies, and review, chat, loyalty and retargeting apps add more. A per-cookie table is the disclosure regulators ask for.

Does Shopify handle GDPR for me?

Shopify handles its own obligations as a processor and provides tooling - the customer privacy API, the GDPR webhook endpoints, data requests in the admin. The controller obligations, including the policy, the lawful basis and the consent banner, stay with you.

What about the apps I have installed?

Each one that reads customer or order data is a recipient you should be disclosing, and several place cookies on the storefront. The Apps page in your admin is the list to start from.

Does GDPR apply to a business outside the EU?

Yes, where you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) is about where the person is, not where you are - and Article 27 may also require you to appoint an EU representative.

What is the difference between EU GDPR and UK GDPR?

The text is nearly identical, but they are separate laws with separate regulators, separate fine ceilings in different currencies, and separate transfer regimes. A business serving both needs both named, not "GDPR" as shorthand.

Do I need a Data Protection Officer?

Only where your core activities involve large-scale regular monitoring or large-scale special-category data, or you are a public authority. Many businesses do not need one - but if you do not have one, say who is accountable instead.

Is a GDPR policy the same as a privacy policy?

No. The privacy policy is the outward-facing notice. The GDPR policy set is the internal machinery - lawful basis register, ROPA, rights procedure, breach plan - that lets you answer a regulator when they ask how the notice is honoured.