What can I do about this clause?

{'method': 'WEB_FORM', 'recipient': 'https://privacy.shopify.com/en', 'difficulty': 'MODERATE', 'action_type': 'DELETE_DATA', 'instructions': 'Visit https://privacy.shopify.com/en and submit a data deletion or restriction request. Select the applicable request type and provide identifying information to verify your identity.', 'deadline_days': None, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'FTC', 'reason': 'FTC Act Section 5 prohibits unfair or deceptive data practices; cross-merchant data pooling without clear consumer disclosure may constitute a deceptive practice.', 'complaint_url': 'https://reportfraud.ftc.gov/'}, {'agency': 'State_AG', 'reason': "California Privacy Protection Agency enforces CPRA 'sharing' opt-out rights; state AGs in other jurisdictions may pursue consumer protection claims for inadequate disclosure.", 'complaint_url': 'https://www.naag.org/find-my-ag/'}

What is the severity of this clause?

ConductAtlas classifies this Cross-Merchant Data Use for Fraud Prevention and Analytics clause as medium severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

Cross-Merchant Data Use for Fraud Prevention and Analytics — Shopify

Share 𝕏 Share in Share 🔒 PDF

What it is

When you shop at any store powered by Shopify, your purchase data may be used by Shopify across its entire network of stores — not just the one you shopped at — for fraud detection and business analytics.

Consumer impact (what this means for users)

Your purchase history, device identifiers, and behavioral data from one Shopify store can be used to build network-wide profiles for fraud prevention and analytics that benefit other merchants you have never interacted with.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Delete Your Data

Visit https://privacy.shopify.com/en and submit a data deletion or restriction request. Select the applicable request type and provide identifying information to verify your identity.

Cross-platform context

See how other platforms handle Cross-Merchant Data Use for Fraud Prevention and Analytics and similar clauses.

Compare across platforms →

Need full compliance memos? See Professional →

Why it matters (compliance & risk perspective)

Most shoppers believe their data stays with the specific store they purchase from; this provision reveals it is pooled across Shopify's entire merchant network without explicit per-transaction consent.

View original clause language

We use information about buyers across our merchants' stores to detect and prevent fraud and abuse, and to provide merchants with analytics and insights about their businesses. This means that data you provide when purchasing from one Shopify merchant may be used in connection with services provided to other Shopify merchants.

Institutional analysis (Compliance & legal intelligence)

1) REGULATORY FRAMEWORK: This provision implicates GDPR Art. 5(1)(b) purpose limitation (processing must be compatible with the original collection purpose), Art. 6(1)(f) legitimate interests balancing test, and Arts. 13-14 transparency obligations requiring disclosure of secondary purposes at time of collection. CCPA/CPRA §1798.140(ad)(1) definition of 'sharing' for cross-context behavioral advertising may be triggered. Enforcement authorities: Ireland DPC (EU lead), California Privacy Protection Agency (CPRA), ICO (UK). 2)

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

FTC

FTC Act Section 5 prohibits unfair or deceptive data practices; cross-merchant data pooling without clear consumer disclosure may constitute a deceptive practice.
File a complaint →
State AG

California Privacy Protection Agency enforces CPRA 'sharing' opt-out rights; state AGs in other jurisdictions may pursue consumer protection claims for inadequate disclosure.
File a complaint →

Provision details

Document information

Document

Shopify Privacy Policy

Entity

Shopify

Document last updated

April 29, 2026

Tracking information

First tracked

April 28, 2026

Last verified

April 28, 2026

Record ID

CA-P-003994

Document ID

CA-D-00122

Evidence Provenance

Source URL

https://www.shopify.com/legal/privacy

Wayback Machine

View archived versions →

SHA-256

f007cdd0481f2eadfaff8041501f08fdc3e70dffbfff2515668b24ba05e31645

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: Shopify | Document: Shopify Privacy Policy | Record: CA-P-003994
Captured: 2026-04-28 10:00:11 UTC | SHA-256: f007cdd0481f2ead…
URL: https://conductatlas.com/platform/shopify/shopify-privacy-policy/cross-merchant-data-use-for-fraud-prevention-and-analytics/
Accessed: May 2, 2026

Classification

Severity

Medium

Cross-Merchant Data Use for Fraud Prevention and Analytics