Shopify tracks your shopping activity across all stores built on its platform — not just the one you're visiting — and combines this data from multiple sources to build a profile used for advertising.
Your shopping behavior at any Shopify-powered store may be combined with your activity at other Shopify stores to serve you targeted advertising, even if you have no direct relationship with Shopify itself.
How other platforms handle this
With Our Affiliates. Where appropriate, we may disclose your information with BAM Management US Holdings Inc, and its wholly-owned subsidiaries and/or affiliates in the course of conducting business and offering our Services to you. With Service Providers. We may disclose your information on a confi...
Dropbox uses certain trusted third parties (for example, providers of customer support and IT services) for the business purposes of helping us provide, improve, protect, and promote our Services. These third parties will access your information to perform tasks on our behalf, and we'll remain respo...
As part of a significant corporate event. If Anthropic is involved in a merger, corporate transaction, bankruptcy, or other situation involving the transfer of business assets, Anthropic will disclose your personal data as part of these corporate transactions.
Most consumers assume their data stays with the individual store they shop at, but Shopify aggregates purchase and browsing history across its entire network of merchants, creating a comprehensive cross-merchant consumer profile.
REGULATORY FRAMEWORK: This practice implicates GDPR Article 6(1)(f) (legitimate interests for profiling) and Article 22 (automated decision-making/profiling), requiring a Legitimate Interests Assessment; CCPA/CPRA §§1798.100 and 1798.120, which grant California consumers the right to opt out of the 'sharing' of personal information for cross-context behavioral advertising; and FTC Act Section 5, which prohibits unfair or deceptive practices including undisclosed cross-context tracking. Enforcement authorities include EU DPAs (lead: Irish DPC for EU), ICO for UK, CPPA/California AG, and FTC.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.