Shopify GDPR compliance: what the platform does and what you still owe
Shopify gives you a customer privacy API and a consent banner. It does not give you compliance. Here is the split.
Shopify is a processor for the data your store collects; you are the controller. That single distinction explains most of the confusion. Shopify secures the infrastructure and gives you tooling. The obligations that attach to decisions — what you collect, why, who you share it with, how long you keep it — stay with you.
What Shopify covers
- Infrastructure security, encryption at rest and in transit, and PCI DSS for payments.
- A data processing addendum in the merchant terms, with Standard Contractual Clauses for transfers.
- Customer data request and redaction webhooks that apps must honour.
- A built-in consent banner and the Customer Privacy API that apps can read to decide whether to fire.
What is still yours
| Obligation | Where it breaks in practice |
|---|---|
| Prior consent for trackers | Pixels pasted into theme.liquid ignore the consent API entirely |
| Accurate privacy policy | The default Shopify template names no processors and no retention periods |
| Marketing opt-in | Checkout email subscription enabled by default in some regions |
| Processor list | Every app you install is a new processor; nobody updates the policy |
| Data requests | Requests arrive by email and never reach the apps holding the data |
| Retention | Abandoned-cart and marketing data kept indefinitely |
The three settings to check today
- 1Settings → Customer privacy: enable the cookie banner, set the regions to at least the EEA, UK and Switzerland, and choose the granular preferences layout rather than accept-only.
- 2Settings → Customer privacy → Data sales: for CCPA-region visitors, make sure the 'Do not sell or share my personal information' link is displayed.
- 3Online Store → Themes → Edit code: search theme.liquid for gtag, fbq, ttq and hotjar. Any hardcoded tag there is firing regardless of consent.
Making a hardcoded pixel consent-aware
Rather than pasting a tag directly, wrap it so it waits for the visitor's marketing consent. Shopify exposes this through window.Shopify.customerPrivacy, and apps registered with the consent API are gated automatically. The safest route is to install the pixel as a custom pixel in Settings → Customer events, where Shopify handles the gating for you, instead of editing the theme.
Apps are the usual culprit
A typical store runs a dozen apps. Each one that loads a script on the storefront is a processor, each one should appear in your privacy policy, and each one can reintroduce a tracker after you clean things up. When you uninstall an app, check that its script tag actually went with it — orphaned script tags are extremely common and keep collecting data for nobody's benefit.
The practical answer is to check the live storefront rather than trusting the app list, because the storefront is what a regulator sees.
See where your own store stands in 60 seconds.
mir-n loads your storefront in a real browser, records every tracker and cookie fired before consent, checks your required documents and runs WCAG tests — then hands you the fix for each finding.
Run a free auditFrequently asked
Is Shopify GDPR compliant out of the box?
Shopify as a platform meets its obligations as a processor. Your store is not automatically compliant — consent configuration, policy accuracy, app processors and retention are all merchant responsibilities.
Does Shopify's cookie banner cover me?
It covers Shopify's own tracking and any app that respects the Customer Privacy API. Tags hardcoded into your theme are not covered and will fire before consent.
Do I need a GDPR app for Shopify?
Not necessarily. The native customer privacy settings plus custom pixels cover most stores. What you do need is a way to verify the result on the live site, because misconfiguration is invisible from the admin.