Shopify · Shopify Privacy Policy

California Consumer Privacy Rights (CPRA)

Medium severity
Share 𝕏 Share in Share

What it is

If you are a California resident, you have the right to: (1) know what personal information we collect, use, disclose, or sell about you; (2) request deletion of your personal information; (3) opt out of the sale or sharing of your personal information; (4) correct inaccurate personal information; (5) limit the use or disclosure of sensitive personal information.

Why it matters

California residents have the most comprehensive set of enforceable privacy rights against Shopify under CPRA, including the ability to stop Shopify from sharing behavioral data with advertisers — a right not available to users in most other US states.

Consumer impact

Shopify collects a wide range of personal data including contact details, payment information, browsing behavior, device identifiers, and purchase history from both merchants and end consumers shopping at Shopify-powered stores. This data is shared with an extensive network of third parties including advertising platforms, fraud detection vendors, payment processors, and third-party app developers, meaning your shopping behavior across multiple stores may be aggregated and used for targeted advertising without your explicit awareness. You can opt out of cross-context behavioral advertising and exercise data access or deletion rights by visiting Shopify's privacy request portal at https://privacy.shopify.com/en/consumer.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.
  • Export Your Data
    Visit https://privacy.shopify.com/en/consumer, select 'Access My Data' or 'Do Not Sell or Share My Personal Information,' complete identity verification, and submit your request — Shopify must respond within 45 days under CPRA.

Applicable agencies

  • State AG
    The California Privacy Protection Agency (CPPA) and California AG have joint enforcement authority over CPRA consumer rights compliance.
    File a complaint →
  • FTC
    The FTC has concurrent authority to pursue deceptive practices related to failure to honor stated privacy rights under Section 5 of the FTC Act.
    File a complaint →

Provision details

Document information
Document
Shopify Privacy Policy
Entity
Shopify
Document last updated
March 24, 2026
Tracking information
First tracked
March 15, 2026
Last verified
April 4, 2026
Record ID
CA-P-002226
Document ID
CA-D-00122
Evidence Provenance
Source URL
Wayback Machine
SHA-256
929225abb20671960ed1f40a6325a4c72cf5ea341e79aa8378056b3b66ef5708
Verified
✓ Snapshot stored   ✓ Change verified
How to Cite
ConductAtlas Policy Archive
Entity: Shopify | Document: Shopify Privacy Policy | Record: CA-P-002226
Captured: 2026-03-15 11:22:02 UTC | SHA-256: 929225abb2067196…
URL: https://conductatlas.com/platform/shopify/shopify-privacy-policy/california-consumer-privacy-rights-cpra/
Accessed: April 6, 2026
Classification
Severity
Medium
Categories

Other provisions in this document