> Shopify and the GDPR: its role as a processor, cookie consent on Shopify stores, the DPA, US data transfers and how to run a compliant store. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/shopify E-commerce # Shopify Unclassified · [Official website](https://shopify.com) Shopify is a leading e-commerce platform used by millions of merchants worldwide. As a data processor for merchant stores, Shopify handles customer personal data including names, addresses, email addresses, payment tokens, and purchase history on behalf of the merchant (data controller). GDPR compliance requires merchants to sign a DPA with Shopify, implement cookie consent for non-essential tracking, maintain a compliant privacy policy, and honour customer data subject rights. Shopify provides built-in GDPR tools including customer data export and deletion. [Block Shopify until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Unclassified - Prior consent Required - Documented cookies 2 - Third-party domains 3 - Servers United States and Canada (Shopify Inc., Ottawa Canada, global CDN) Overview ## What does Shopify do? ## **What is Shopify?** Shopify is a cloud-based e-commerce platform used by millions of merchants to build and operate online stores. Merchants use Shopify to manage their product catalogue, process orders, handle payments, manage inventory, and run marketing campaigns. Shopify processes a substantial amount of customer personal data on behalf of merchants: names, email addresses, shipping addresses, payment tokens, order history, and browsing behaviour. ## **GDPR roles: controller and processor** The GDPR relationship for Shopify stores is: the merchant is the data controller (you decide why and how customer data is processed), and Shopify is the data processor (they process it on your behalf). This means merchants bear primary GDPR responsibility. Shopify acts as an independent controller only for its own business purposes (billing the merchant, fraud detection across the Shopify platform). Sign Shopify's Data Processing Addendum to establish the processor relationship. ## **Cookies and consent management** Shopify sets strictly necessary cookies for cart management (\_shopify\_s, \_shopify\_sa\_t) and checkout (\_checkout\_token, cart) that do not require consent. However, Shopify stores typically add analytics apps (Google Analytics, Pixel), marketing apps (email, advertising), and product recommendation apps that introduce non-essential cookies requiring consent. Use Shopify's built-in cookie consent banner or a dedicated CMP app from the Shopify App Store. ## **Customer data rights** Shopify provides built-in tools for GDPR compliance: customer data export (Admin, Customers, export), customer account deletion (removes order history), and request handling. For EU customers, you must respond to access and erasure requests within 30 days. Shopify's customer deletion removes their personal data from your store's active database, though some data is retained for legal obligations (tax records). ## **Practical compliance steps** Sign Shopify's DPA. Add a GDPR-compliant cookie consent banner. Write a privacy policy covering all data processing (orders, marketing, analytics). Audit all installed Shopify apps for their own data processing. Set up a customer data request process. Configure email marketing with proper double opt-in. Disclose all third-party apps and services in your privacy policy. Compliance ## Shopify and the GDPR Shopify is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Multiple legal bases: contract performance (Art. 6(1)(b)) for order processing, account management, and fulfillment. Legitimate interest for fraud prevention and security. Consent required for marketing cookies, analytics tracking, and retargeting pixels. Shopify stores itself set strictly necessary cookies for cart and session management which do not require consent. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, SCCs for US/Canada transfers. Also subject to PCI DSS for payment processing. ### Impact assessment (DPIA) A DPIA is recommended for Shopify stores using extensive customer profiling, behavioural advertising across multiple ad platforms, or processing health or sensitive purchase data (pharmacies, medical devices). Standard e-commerce processing typically does not require a DPIA. ### Sample text for your banner > This store uses cookies for essential shopping functions (cart, checkout) which are strictly necessary. We also use analytics and marketing cookies to improve your experience and show relevant ads. You can manage your preferences below. Cookies and trackers ## What Shopify sets and contacts - Tracking method E-commerce platform, first-party analytics, Shopify Pixel, third-party app tracking, checkout cookies, customer account cookies - Server location United States and Canada (Shopify Inc., Ottawa Canada, global CDN) - Data transferred outside the EU Shopify is a Canadian e-commerce platform with infrastructure primarily in the US and Canada. EU personal data (customer names, addresses, purchase history, payment tokens) is processed on North American infrastructure. Shopify provides a GDPR-compliant DPA and SCCs for EU data transfers. Shopify also offers a EU Data Processing Addendum. ### Cookies set (2) | Name | Type | Duration | Purpose | | ------------ | ---------- | -------- | ----------------------------------------------------------------------------- | | \_shopify\_y | persistent | 1 year | Shopify analytics visitor identifier tracking unique visitors across sessions | | \_shopify\_s | session | Session | Shopify analytics session cookie grouping page views within a single visit | ### Third-party domains contacted (3) - `shopify.com` - `cdn.shopify.com` - `monorail.shopifycloud.com` Questions ## Frequently asked questions about Shopify Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Is Shopify GDPR compliant? Shopify provides GDPR infrastructure but compliance depends on merchant configuration. Merchants must sign Shopify's DPA, install cookie consent, write a privacy policy, configure marketing opt-ins, and audit all installed apps. ### What is the GDPR role of a Shopify merchant? The merchant is the data controller: you decide what customer data to collect and why. Shopify is your data processor. Sign Shopify's Data Processing Addendum to formalise this relationship. ### Do Shopify cart cookies require consent? No. Shopify cart cookies (\_shopify\_s, \_shopify\_sa\_t, cart) are strictly necessary for checkout. These cannot be blocked without breaking the store and do not require consent under ePrivacy. ### How do I handle customer deletion requests in Shopify? In Shopify Admin, go to Customers, open the profile, and select Delete customer. Respond within 30 days. Note that Shopify retains some data for legal obligations such as financial records. ### Does installing Shopify apps create GDPR obligations? Yes. Each app creates a new data processor relationship. Review each app's privacy policy and DPA. Apps with advertising or analytics require consent management integration. ### Does Shopify transfer data outside the EU? Yes. Shopify is Canadian with North American infrastructure. EU data transfers to Canada (adequate) and US (SCCs required). Sign Shopify's EU DPA covering these transfers. ### What is Shopify's Customer Privacy API? Shopify's Customer Privacy API allows themes and apps to check visitor consent before loading non-essential tracking, enabling GDPR-compliant conditional analytics and marketing app loading. ### How do I add a cookie banner to Shopify? Options: Shopify's built-in cookie banner (basic, free), CMP apps from the App Store (Cookiebot, Consentmo, Pandectes GDPR), or a custom CMP script via theme.liquid. Ensure Google Consent Mode v2 integration for ad platforms. Related guide ## Our guides on Shopify [31 May 2026](https://www.flowconsent.com/en/blog/shopify-cookies-gdpr-compliance-guide) ### [Shopify and GDPR cookies: the compliance guide](https://www.flowconsent.com/en/blog/shopify-cookies-gdpr-compliance-guide) [Shopify's native banner only covers part of the picture. Learn which cookies your store sets, how to audit them and how to block pixels and apps before consent.](https://www.flowconsent.com/en/blog/shopify-cookies-gdpr-compliance-guide) [Read the guide](https://www.flowconsent.com/en/blog/shopify-cookies-gdpr-compliance-guide) Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [AfterShip Returns Center](https://www.flowconsent.com/en/services/ecommerce/aftership-returns-center) [AfterShip Returns Center is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. AfterShip Returns Center supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, AfterShip Returns Center ensures your website delivers a smooth, uninterrupted experience to every visitor and.](https://www.flowconsent.com/en/services/ecommerce/aftership-returns-center) [E-commerce](https://www.flowconsent.com/en/services/ecommerce/aftership-returns-center) · ### [fortune3](https://www.flowconsent.com/en/services/ecommerce/fortune3) [Fortune3 is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Fortune3 integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Fortune3 helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/fortune3) [Preferences](https://www.flowconsent.com/en/services/ecommerce/fortune3) · ### [FoodBooking](https://www.flowconsent.com/en/services/ecommerce/foodbooking) [FoodBooking is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. FoodBooking provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, FoodBooking helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/ecommerce/foodbooking) [Preferences](https://www.flowconsent.com/en/services/ecommerce/foodbooking) · ### [SunShop](https://www.flowconsent.com/en/services/ecommerce/sunshop) [Sunshop is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Sunshop integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Sunshop helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/sunshop) [Preferences](https://www.flowconsent.com/en/services/ecommerce/sunshop) · ### [Pluralo](https://www.flowconsent.com/en/services/ecommerce/pluralo) [Pluralo is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Pluralo supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Pluralo ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/pluralo) [Preferences](https://www.flowconsent.com/en/services/ecommerce/pluralo) · ### [ezCater](https://www.flowconsent.com/en/services/ecommerce/ezcater) [eZCater is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. eZCater supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, eZCater ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/ezcater) [Preferences](https://www.flowconsent.com/en/services/ecommerce/ezcater) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)