Shopify plays two different roles: it processes your data on behalf of the merchant whose store you visit, but it also collects and uses your data independently for its own purposes like the Shop App and fraud prevention.
This analysis describes what Shopify's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This dual-role structure allocates data controller responsibilities between merchants and Shopify based on the purpose of data collection, which determines which entity bears primary accountability under data protection regulations and which privacy policy governs the processing activity.
The updated policy changes the legal mechanism used to protect personal data when it crosses borders, but does not change where data is transferred or fundamentally alter protection levels. For EEA and Swiss users, data transfers between Shopify entities now rely on Shopify's Binding Corporate Rules (which have been approved by European data protection authorities), rather than adequacy decisions. For UK users, transfers use Standard Contractual Clauses and may rely on the adequacy decision for Canada. For transfers to third-party subprocessors, contractual commitments in the form of Standard Contractual Clauses now replace prior language referencing comparable protections. The policy states these mechanisms reflect Shopify's commitment to adequate protection, but the shift in legal instruments may have implications for how disputes or compliance issues would be evaluated under GDPR or UK data protection law.
View change record →When you shop at a Shopify-powered store, your personal data may be used by both the merchant (for their own purposes) and Shopify (for platform, advertising, and fraud purposes), meaning you effectively have two data controllers to manage your rights against.
How other platforms handle this
TINDER ASSUMES NO RESPONSIBILITY FOR ANY CONTENT THAT YOU OR ANOTHER USER OR THIRD PARTY POSTS, SENDS, RECEIVES, AND/OR ACTS ON THROUGH OUR SERVICES, NOR DOES TINDER ASSUME ANY RESPONSIBILITY FOR THE IDENTITY, INTENTIONS...
we do not warrant that Offering descriptions are accurate, complete, reliable, current, or error-free.
Please note that these third parties are responsible for their own privacy practices.
"When you visit a store powered by Shopify, the merchant who operates that store is the data controller of your personal information, and Shopify is the data processor acting on their behalf. However, where Shopify collects personal information for its own purposes — such as to operate the Shop App, improve Shopify's services, or for fraud prevention — Shopify acts as an independent data controller.Excerpt from Shopify's Privacy Policy
REGULATORY FRAMEWORK: This provision directly implicates GDPR Articles 4(7) (controller definition), 4(8) (processor definition), 26 (joint controllers), and 28 (processor obligations including mandatory DPA).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This dual-role structure allocates data controller responsibilities between merchants and Shopify based on the purpose of data collection, which determines which entity bears primary accountability under data protection regulations and which privacy policy governs the processing activity.
When you shop at a Shopify-powered store, your personal data may be used by both the merchant (for their own purposes) and Shopify (for platform, advertising, and fraud purposes), meaning you effectively have two data controllers to manage your rights against.
ConductAtlas has identified this type of provision across 287 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Shopify.