Most Shopify merchants treat privacy law as a cookie banner and a policy page copied from a generator. That covers the visible part and almost none of the actual obligations. Shopify GDPR compliance is mostly about what happens to data after it is collected — who it reaches, how long it stays, and whether you can honour a deletion request without a developer.
This guide covers what the platform handles for you, what remains yours, where apps create exposure nobody audits, and a practical order of work.
What Shopify GDPR compliance actually requires
Stripped of the legalese, five duties do most of the work. You need a lawful basis for each kind of processing. You must tell people what you collect and why, in language they can read. You must honour access, correction, deletion and portability requests within a month. You must keep data no longer than you need it. And you must be able to demonstrate all of the above, because accountability is itself an obligation.
Nothing there is about banners. The banner is one control for one duty.
Shopify GDPR compliance: what the platform handles
The platform carries real weight here. Shopify acts as processor for the data you collect through it, provides the mandatory privacy webhooks that apps must implement, and exposes customer data requests in the admin so a deletion request has a defined path.
That last point matters more than it sounds: when you submit a customer erasure request, Shopify propagates it to installed apps through those webhooks. The platform gives you the mechanism. Whether the apps honour it is a separate question, and it is where most real exposure sits.
Where Shopify GDPR compliance actually breaks down
| Area | Typical state | Risk |
|---|---|---|
| Cookie banner | Present | Low |
| Privacy policy | Generic template | Medium — often lists tools you no longer use |
| App data flows | Undocumented | High |
| Marketing consent record | Partial | High |
| Retention periods | Not defined | Medium |
| Processor agreements | Rarely collected | Medium |
| Deletion across all systems | Shopify only | High |
The three high-risk rows share a cause: data leaves Shopify and nobody tracks where it lands. A typical store runs a dozen apps, an email platform, a reviews tool, a helpdesk and an analytics stack. Each holds customer data. Each is a processor you are responsible for.
The Shopify GDPR compliance audit nobody runs
This is the highest-value hour in any Shopify GDPR compliance project. List every installed app and answer four questions for each: what personal data does it receive, where is it stored, does it implement the privacy webhooks, and is there a processor agreement.
Two findings are near-universal. First, apps installed for a trial two years ago that are still receiving customer data because nobody uninstalled them. Second, apps whose data retention is indefinite by default. Both are cheap to fix and impossible to fix if you have not looked.
Uninstalling unused apps is the single most effective privacy action most merchants can take, and it usually improves store performance as a side effect.
Shopify GDPR compliance: consent is a record, not a checkbox
The banner captures a decision. The obligation is to prove it later — what was agreed, when, and on what wording.
For marketing that means storing consent state on the profile with a timestamp and a source, keeping it synchronised with your email platform, and honouring withdrawal everywhere rather than in whichever system the customer happened to use. A store where someone can unsubscribe from email but stay on an SMS list they never separately consented to has a consent problem, not a UX problem.
Consent also has to reach your measurement stack. If analytics and ad events fire regardless of the banner, the banner is decoration — see our guide to Shopify server-side tracking, where this comes up sharply because the server makes it technically easy to send everything.
Retention: the Shopify GDPR compliance duty everyone skips
“Keep it forever in case it is useful” is not a retention policy, and it is the default state of most stores.
Write down how long you keep order records, abandoned checkouts, marketing profiles that never converted, support tickets and analytics data — then make the systems enforce it. Tax law will dictate the floor for order records in your jurisdiction; nothing dictates keeping a five-year-old abandoned cart with an email address attached.
Handling a data subject request without panic
You have a month. The work is knowing where to look, which is why the app audit comes first.
- Verify identity before disclosing anything — a request is also an attack vector.
- Use Shopify’s built-in request so the privacy webhooks fire to installed apps.
- Handle the systems outside Shopify manually: email platform, helpdesk, reviews, analytics, any warehouse or ERP.
- Record what you did, when, and what was retained under a legal obligation.
Practise it once on a test customer. The first real request is a bad time to discover that your helpdesk has no deletion function.
Does Shopify GDPR compliance apply outside the EU?
If you offer goods to people in the EU or monitor their behaviour, yes — location of the business is not the test. A US brand shipping to Germany and running EU ad campaigns is in scope.
The UK maintains its own equivalent regime, documented by the ICO, and other jurisdictions have their own rules with different definitions. Building for the strictest applicable standard is usually cheaper than maintaining several partial implementations, which is the same logic we apply to the European Accessibility Act.
A practical Shopify GDPR compliance order of work
- Audit apps and uninstall the unused ones. Highest return, lowest effort.
- Map data flows — one page listing every system holding customer data.
- Fix the consent record so it is stored, timestamped and synchronised.
- Write retention periods and enforce them where systems allow.
- Update the privacy policy to match reality rather than a template.
- Rehearse a deletion request end to end.
- Collect processor agreements from vendors that hold your customers’ data.
Steps one to three deliver most of the risk reduction, and step one alone often removes several processors from the picture entirely.
Cookie banners done properly
The banner is one control, but doing it badly creates the very exposure it was meant to remove.
Three rules cover most of it. Refusing must be as easy as accepting — a prominent “accept all” beside a buried settings link is the pattern regulators have repeatedly ruled against. Nothing non-essential may fire before a choice is made, which means checking what actually loads on first paint rather than trusting the banner’s own claim. And the choice must be revocable, with a visible way back to the settings.
Test this by loading your store in a clean browser session and watching network requests before touching the banner. Most stores find at least one tag firing early, usually installed by an app rather than deliberately.
Shopify GDPR compliance when apps come and go
The steady state is the hard part. Apps get installed for a trial, a campaign, a season — and each one is a new processor receiving customer data.
Build one habit into how the store is run: no app gets installed without someone recording what data it receives and whether it has a processor agreement, and no app stays installed once it stops being used. A quarterly review of the app list against that record takes twenty minutes and keeps the data map honest.
Without it, the map you build during a compliance project is accurate for about two months. With it, a data subject request stays a fifteen-minute task instead of an investigation.
What this is not
This article is engineering guidance, not legal advice, and Shopify GDPR compliance has genuinely legal components — lawful basis, jurisdiction, contractual terms — where a qualified adviser is the right call.
What we can tell you is where the data goes, because that is a technical question with a technical answer. Our technical audit maps every system receiving customer data from your store, which is the artefact every subsequent privacy conversation depends on.
