Old version
April 19, 2026 06:08 UTC
7c0bf9501b86d83070ac3cc9fece30882778eaa6a5728dc77b7719cbe2fa974d
CA-V-000693
New version
July 10, 2026 00:26 UTC
470ba6ffdcc217829134ec93411823fb9a35e117b5f0e95d853d0bef4ed6a51e
CA-V-004662
Share 𝕏 Share in Share
Change Summary
Shopify updated its privacy policy on July 10, 2026 to revise how it describes cross-border data transfers for users in the EEA, UK, and Switzerland. The prior policy stated that Personal Data sent to Canada was protected under Canadian law, which the European Commission had found adequate. The updated policy replaces this with a framework based on Shopify's Binding Corporate Rules (BCRs) for transfers between Shopify entities, and Standard Contractual Clauses (SCCs) for transfers to third-party subprocessors. The practical effect is that data protection assurances now rest on different legal instruments (BCRs and SCCs) rather than adequacy decisions.
medium severity
2 Sentences added
0 Sentences removed
6 Sentences modified
114 Sentences before
116 Sentences after
Added
Removed
Modified
BeforeAfter
0Updated March 2, 2026 Privacy Policy How Shopify handles your data Table of Contents Introduction Our values Why we process your information Your rights over your information Where we send your information How long do we retain your information Our use of Machine Learning How we protect your information How we use "cookies" and other tracking technologies How you can reach us United States Regional Privacy Notice Introduction In our mission to make commerce better for everyone at Shopify, we collect and use information about you, our merchants using Shopify to power your business consumers who shop at a Shopify-powered business, or use Shopify apps and services like Shop or Shop Pay partners who develop apps for merchants to use, build stores on behalf of merchants, refer potential entrepreneurs to Shopify, or otherwise help merchants operate or improve their Shopify-powered business visitors to Shopify's websites , or anyone contacting Shopify support This overall privacy policy and the supplemental privacy policies (together, the " Privacy Policy ") will help you better understand how we collect, use, and share your Personal Data.0Updated July 7, 2026 Privacy Policy How Shopify handles your data Table of Contents Introduction Our values Why we process your information Your rights over your information Where we send your information How long do we retain your information Our use of Machine Learning How we protect your information How we use "cookies" and other tracking technologies How you can reach us United States Regional Privacy Notice Introduction In our mission to make commerce better for everyone at Shopify, we collect and use information about you, our merchants using Shopify to power your business consumers who shop at a Shopify-powered business, or use Shopify apps and services like Shop or Shop Pay partners who develop apps for merchants to use, build stores on behalf of merchants, refer potential entrepreneurs to Shopify, or otherwise help merchants operate or improve their Shopify-powered business visitors to Shopify's websites , or anyone contacting Shopify support This overall privacy policy and the supplemental privacy policies (together, the " Privacy Policy ") will help you better understand how we collect, use, and share your Personal Data.
38Transfers outside of Europe and Switzerland If you are located in the EEA, the UK, or Switzerland, your Personal Data is received by our Irish affiliate, Shopify International Ltd.38Transfers outside of the EEA, the UK and Switzerland If you are located in the EEA, the UK, or Switzerland, your Personal Data is received by our Irish affiliate, Shopify International Ltd.
39Your information is then sent to other Shopify locations and to service providers who may be located in other regions, including Canada (where we are based) and the United States.39Your information is then sent to other Shopify locations and to service providers who may be located in other regions, including Canada (where we are headquartered) and the United States.
40When we send your Personal Data outside of the EEA, UK or Switzerland, we do so in accordance with applicable law.40When we send your Personal Data outside of the EEA, the UK and Switzerland, we do so in accordance with applicable law.
41If you are in the EEA, the UK, or Switzerland, when we send your Personal Data to Canada it is protected under Canadian law, which the European Commission has found adequately protects your information.41If you are in the EEA or Switzerland, when we send your Personal Data to any other Shopify entity outside the EEA or Switzerland, it is transferred in accordance with Shopify's Binding Corporate Rules (BCRs).
42If we then send this Personal Data outside of Canada (for example, when we send this information to our Subprocessors ), this information is protected by contractual commitments that are comparable to those provided in the Standard Contractual Clauses.42Shopify's BCRs have been approved by European data protection authorities and reflect Shopify's commitment to adequately protect Personal Data regardless of where the information resides.
43If you are in the UK, when we send your Personal Data to any other Shopify entity outside of the UK, EEA or Switzerland, it is transferred pursuant to Standard Contractual Clauses in place between Shopify entities, and may rely on the European Commission's adequacy decision in relation to Canada to support transfers from Shopify International Limited to its Canadian-registered corporate parent Shopify Inc.
44Where Shopify transfers your Personal Data to any third parties (for example, when we send this information to our Subprocessors ), such transfers are protected by contractual commitments in the form of Standard Contractual Clauses where appropriate.
Stay ahead of the changes

Watch this before it changes again

Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.