Shopify processes your customers' personal data on your behalf, but it is your responsibility as the merchant to make sure you have proper privacy notices, consent mechanisms, and legal compliance in place for how you collect and use customer data.
This analysis describes what Shopify's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause allocates data governance responsibilities between Shopify and merchants: Shopify's processing obligations are defined in a separate addendum, while merchants bear primary responsibility for upstream data rights and compliance with applicable privacy laws. This structure clarifies that merchants act as data controllers for customer information they provide.
The updated terms clarify the legal identity of the Shopify entity you contract with and establish which courts have exclusive jurisdiction to resolve disputes, depending on your store's billing address. Previously, the terms specified exclusive jurisdiction by region (Ontario for US/Canada, Singapore for Asia Pacific, Ireland for EMEA and other areas). The revised structure presents this information in a table format and adds explicit language stating that disputes can only be brought in the courts listed for your region, with those courts having exclusive jurisdiction. Shopify Inc. may act as a billing agent for other Shopify entities to collect fees and remit taxes in some jurisdictions. You can review the contracting party and forum table in Section 13 to confirm which entity and courts apply to your store based on your billing address.
View change record →Removal of explicit data processing addendum incorporation may shift responsibility allocation for compliance with privacy laws like GDPR and other data protection regulations.
View full change record →End consumers who shop on Shopify-powered stores should know that their personal data (name, email, payment details, browsing history) is controlled by the merchant and processed by Shopify, and privacy complaints should be directed to the individual merchant as the data controller, not solely to Shopify.
How other platforms handle this
Each payment processor uses and processes your complete payment information in accordance with its applicable privacy policy (Stripe and PayPal).
we may share data between our affiliates for the safety and security of our users and may take necessary actions if we believe you have violated these Terms, including banning you from our Services and/or our affiliates' services...
Protect us, our business, our users, and others, for example to enforce our terms of service, prevent spam or other unwanted communications, and investigate or protect against fraud
"To the extent that Shopify processes any Personal Data (as defined in Shopify's Data Processing Addendum) on behalf of the Merchant, the terms of Shopify's Data Processing Addendum, which are incorporated into these Terms of Service by reference, shall apply. Merchants are responsible for ensuring that they have all necessary consents and rights to provide customer data to Shopify for processing, and that their use of customer data complies with all applicable laws including privacy and data protection legislation. Merchants are solely responsible for maintaining the accuracy, completeness and currency of merchant data on the platform.Excerpt from Shopify's Terms of Service
(1) REGULATORY FRAMEWORK: Directly implicates GDPR Arts.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The clause allocates data governance responsibilities between Shopify and merchants: Shopify's processing obligations are defined in a separate addendum, while merchants bear primary responsibility for upstream data rights and compliance with applicable privacy laws. This structure clarifies that merchants act as data controllers for customer information they provide.
End consumers who shop on Shopify-powered stores should know that their personal data (name, email, payment details, browsing history) is controlled by the merchant and processed by Shopify, and privacy complaints should be directed to the individual merchant as the data controller, not solely to Shopify.
ConductAtlas has identified this type of provision across 288 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Shopify.