"Shopify's practices present substantial privacy risk due to extensive collection of sensitive personal data including government identifiers and inferred characteristics, broad sharing with advertisers and third parties, and limited transparency on automated decision-making and retention periods."
Take Action
4 Privacy Improvements Available
shopify Privacy Concerns & Scorecard
Shopify collects an extensive range of sensitive personal data including government-issued identifiers (SSN, driver's license, passport numbers), financial account information, precise geolocation data, email message contents, facial imagery, and inferred sensitive characteristics such as race, ethnicity, and sexual orientation.
Shopify shares data with an extensive network of third parties including cloud storage providers, payment processors, fulfillment partners, advertisers, marketing vendors, data analytics vendors, affiliate partners, and law enforcement. Specific third-party recipients are not fully enumerated. Data is transferred internationally to US and Canada.
Shopify acknowledges using machine learning and automated decision-making but provides limited transparency on all applications. Machine learning/automated decision-making data is collected without full disclosure of how it is used or what decisions it informs.
Shopify uses cookies, tracking pixels, and social plugins (Facebook 'like' button) for behavioral tracking and advertising purposes. The company shares data with advertisers and marketing vendors. Shopify does not respond to Do Not Track signals, limiting user control over tracking.
For merchant accounts, Shopify retains store information for two years after account closure before deletion process begins. Data may be retained indefinitely to comply with legal obligations or protect company interests. Deletion timelines are unclear for consumer data.
Merchant store deactivation
- 1Log in to your Shopify admin as the store owner.
- 2Go to Settings > Plan.
- 3Click 'Deactivate store'.
- 4Select a reason for deactivation and click 'Continue'.
- 5Follow the remaining prompts to confirm and complete the deactivation. Your subscription will be cancelled at the end of the current billing cycle.
Customer data erasure deactivated store
- 1Deactivate your Shopify store via Settings > Plan > Deactivate store in your Shopify admin.
- 2After deactivation, contact Shopify Support to request erasure of all customer personal data from the deactivated store.
- 3Note that only the store owner can submit this request; staff members cannot do so on the owner's behalf.
- 4Customer personal data will be erased within 14 days of the completed request. If you change your mind, contact Shopify Support again before the 14-day window closes.
Shop app marketing opt out
- 1Open the Shop app on your mobile device.
- 2Go to the Account tab.
- 3Tap 'Privacy and Marketing', then tap 'Marketing Communications'.
- 4Turn off Marketing Communications to stop promotional emails and push notifications while keeping order tracking active.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, verification, payment processing, fulfillment, and identity verification for legal compliance
Payment processing, fulfillment, fraud prevention, and personalization of shopping experience
Shipping, localized marketing, personalized recommendations, and service delivery
Website functionality, security, analytics, troubleshooting, and personalization
Personalization, analytics, marketing, product improvement, and content recommendations
Providing services, customer support, marketing communications, and inbox integration
Targeted advertising, personalization, and marketing segmentation
Content moderation, identity verification, or personalization features
Cross-Platform Tracking
Shopify employs cross-device tracking that combines information across multiple devices to build a unified profile of users. The Shop app automatically imports purchase history from connected third-party marketplaces and email accounts, enabling behavioral tracking and personalization across external platforms without requiring separate tracking on those sites.
Tracking Methods:
Cookies
First-party and third-party cookies placed by Shopify and multiple external companies to track user behavior, maintain sessions, and enable advertising targeting across visits
Tracking Pixels
Invisible image tags and conversion tracking pixels embedded on Shopify sites and partner sites to measure user interactions, attribute conversions, and enable retargeting advertising
Social Plugins
Facebook 'like' button and similar social media widgets that enable third-party platforms to track user activity on Shopify sites
Device Fingerprinting
Collection of device characteristics (browser type, OS, installed fonts, screen resolution, timezone) to create unique identifiers that persist across sessions and browsers
Cross-Device Tracking
Correlation of activity across multiple devices (phone, tablet, computer) using login data, IP addresses, and shared identifiers to build unified user profiles
Terms of Service Updates
Section 13 title updated to include 'Forum'
The section title changed from '13. Shopify Contracting Party' to '13. Shopify Contracting Party and Forum', suggesting new dispute resolution or jurisdiction provisions may have been added. This could impact where and how legal disputes are resolved.
Effective: August 1, 2026
AI & Data Training
shopify does not train AI on your content
Based on their public policy, your content is not used to train AI models.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed shopify
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.