Shopify Privacy Policy: What to Include and How to Add It
Where the privacy policy lives in Shopify, what the built-in automated template covers and misses, and a store-specific checklist of the apps, pixels and tools to document.
Published Updated 10 min read
On this page
A Shopify privacy policy is the public page at /policies/privacy-policy on your store domain that tells customers what personal data your store collects, why, who receives it and how they can use their privacy rights. You add it from Settings in your Shopify admin, where Shopify can also generate an automated version from its own template. That template is a sound starting point, but it is built from your store settings, not from the apps, pixels and email tools you have installed, so those data flows are yours to add.
This is general information, not legal advice. For questions about your own business, ask a qualified privacy professional.
Where does the privacy policy live in Shopify?
Shopify's help center documents two routes: Settings > Policies, in the Written policies section (Adding store policies), and Settings > Customer privacy > Privacy policy, where you also switch automated settings on or off for the privacy policy, cookie banner and data sharing opt-out page (Configuring customer privacy settings). Use whichever your admin shows.
Once the policy is published, customers reach it here:
| Where customers see it | How it gets there |
|---|---|
| Checkout footer | Shopify links published policies there automatically. |
/policies/privacy-policy | A direct URL Shopify adds to your store domain. |
| Store footer or other menus | In Content > Menus, open the menu, click Add menu item, search for the policy, click Add, then Save menu. |
| Cookie banner, sign-up forms, account pages | You add the link in the banner, form or app settings. |
The automated policy pulls your store name, address and email from your store settings. Policies are public, so use business contact details.
Is Shopify's privacy policy template enough?
"Shopify privacy policy template" can mean two different things.
The automated policy in your admin. With Use automated policy turned on, Shopify fills in its template text and updates it as your settings change, recording each update in the Store activity log. New stores have automated privacy settings on by default, and existing stores can turn them on. Policies that support automation don't offer the separate Insert template button, so for the privacy policy the automated text is the template.
Shopify's free online generator. The privacy policy generator on shopify.com asks for company details, your website URL and whether the site uses cookies, then emails a basic template. Shopify says it isn't legal advice and that store owners already get a custom privacy policy in their settings, so start in your admin.
What the automated template knows about your store
Shopify publishes the variables behind its template:
| Type | What Shopify fills in |
|---|---|
| Store details | Store name, address, email and domain, last-updated date, data sharing opt-out page URL |
| Conditional sections | Selling to the US; selling to the EEA, UK or Switzerland; an app in the Customer Accounts or User Generated Content category; Shop app installed; Shop Pay on; data sharing opt-out page on; Shopify Network Intelligence on; cookie consent required in any region |
What it doesn't know
None of those variables names your specific apps, pixels or email tools. Shopify says some disclosures can't be automated, so you need to review and add them. Its GDPR guide notes that if your store or customers are in the UK, EEA or Switzerland, you may need to add the legal basis for each purpose and any DPO or representative contact details (Using Shopify to help comply with GDPR).
The usual gaps are your email or SMS platform, the pixels in Settings > Customer events or your theme, apps such as reviews, loyalty, chat and subscriptions, your retention periods, and how customers send privacy requests.
Two warnings from Shopify's documentation. Turning on automation on an existing store replaces your current policy text and custom translations, so save a copy first. And to edit the text yourself, you turn Use automated policy off, which makes keeping it current your job.
Our suggestion: generate the automated version, copy it, then extend it into a manual policy that adds your store's own data flows.
What must a Shopify privacy policy include?
The answer depends on where you are based and where your customers are. Three reference points cover the common cases.
EU and UK (GDPR and UK GDPR). Article 13 lists what you must tell people when you collect data from them (UK GDPR Article 13; European Commission):
- Who you are, with representative and DPO contacts where they apply
- Each purpose and its lawful basis, including legitimate interests
- Recipients, and any transfers outside the UK or EU with safeguards
- How long you keep data, or how you decide
- Rights to access, correct, erase, restrict, object and port data, withdraw consent and complain to a supervisory authority
- Whether providing data is a legal or contractual requirement
- Any automated decision-making, including profiling
The Commission says this information must be concise, transparent, intelligible and in clear and plain language. The ICO says you must provide it at the time you collect the data (The right to be informed). Our Shopify GDPR compliance guide covers the rest of what stays with you as the controller, from cookie consent to data requests.
California (CCPA). The California Attorney General's CCPA page says the law applies to for-profit businesses doing business in California that meet any one threshold: gross annual revenue over $25 million (adjusted for inflation to $26,625,000 from 1 January 2025, according to the California Privacy Protection Agency); buying, selling or sharing the personal information of 100,000 or more California residents or households; or earning 50% or more of annual revenue from selling California residents' personal information. A covered business's policy must explain consumers' rights (to know, delete, opt out of sale or sharing, correct, limit use of sensitive data, and non-discrimination) and how to submit requests. Businesses that sell or share data need a "Do Not Sell or Share My Personal Information" link and must honor Global Privacy Control signals. Shopify's data sharing opt-out page responds to that signal in the regions where it's used.
United States (FTC). The FTC's consumer privacy guidance tells businesses to reread their privacy policy to make sure they keep the promises in it. Wherever you sell, don't describe consent flows, retention periods or security measures you don't actually have.
Shopify data flows to document, and what to write
This is where a store-specific policy beats a template. Work through each source of personal data:
| Where data comes from | Where to check | What to write |
|---|---|---|
| Checkout and orders | Settings > Checkout, payment and shipping settings | Contact, shipping and billing details and order contents; used to process, deliver and support orders; shared with payment providers and carriers |
| Customer accounts | Account settings and any account apps | Login email, saved addresses, order history; how to close an account |
| Email, SMS or WhatsApp marketing | Settings > Checkout > Marketing opt-in, your email or SMS app | Which platform sends messages, how consent is collected, how to unsubscribe |
| Installed apps | Each app's install screen and App Store listing | What each app or provider receives and why |
| Analytics and ad pixels | Settings > Customer events, theme code, tag manager | Analytics and advertising purposes, which platforms receive browsing data, how to consent or opt out |
| Cookies and consent banner | Settings > Customer privacy or your banner app | Cookie categories, a link to your cookie policy, how to change a choice |
| Reviews and photos | Your reviews app | Name, email and content collected; what is shown publicly; the provider |
| Contact forms, chat and helpdesk | Theme forms, chat or helpdesk app | Messages and contact details, the support provider, retention |
| Shopify itself | Settings > Customer privacy, Shop Pay, Network Intelligence | That Shopify hosts the store and processes data; Shopify's extra wording if Network Intelligence is on |
| Privacy requests | Customers > profile > More actions | How customers request a copy or deletion, and how you verify them |
How to build the list from your admin
- Apps. Review every installed app. Shopify shows the personal data an app can access on its install screen and says to ask the developer how the app uses data (App permissions and personal information).
- Pixels. Open Settings > Customer events and list every app pixel and custom pixel. Pixels can run on your online store, customer account pages and checkout (Pixels and customer events), and each custom pixel has a setting for whether customer permission is required (Manage your custom pixels). Then check your theme for scripts outside Customer events; our Shopify customer events guide covers moving them into custom pixels, and our GA4 conversion tracking checklist helps map Google tags.
- Marketing consent. In Settings > Checkout, the Marketing opt-in section shows whether email and SMS checkboxes appear, and where the email checkbox is preselected (Collecting customer contact information).
- Customer privacy. In Settings > Customer privacy, note what is automated and view your installed privacy apps. For banner setup, see our guide to the Shopify cookie banner; our Customer Privacy API guide explains how the visitor's choice reaches pixels and apps.
- Requests. In Customers, open a profile and find More actions > Request customer data and Erase personal data. Shopify says contacting other companies you shared the data with is your responsibility (Processing customer data requests).
Shopify privacy policy template: a section outline
This is an outline, not finished legal text. Replace each [placeholder] with facts from your audit and delete sections that don't apply.
PRIVACY POLICY
Last updated: [Date]
1. Who we are
[Business legal name], [Business address], [Privacy email].
Our store at [Store domain] is hosted on Shopify.
[DPO or UK/EU representative contact, if you have one.]
2. Personal data we collect
- From you: [Checkout fields], [Account details],
[Newsletter or SMS sign-up], [Reviews], [Contact form or chat]
- Automatically: [Device and browsing data from cookies and pixels]
- From others: [For example payment or fraud-check providers]
3. Why we use it and our legal basis
- [Purpose, e.g. fulfil orders]: [Legal basis, e.g. contract]
- [Purpose, e.g. marketing emails]: [Legal basis, e.g. consent]
- [Purpose, e.g. analytics]: [Legal basis]
4. Who we share it with
Shopify (store platform); [Payment providers]; [Shipping carriers];
[Email/SMS platform]; [Analytics tools]; [Advertising platforms];
[Reviews app]; [Helpdesk or chat app]; [Other apps]
5. Cookies, tracking and marketing
[Cookie categories]. Details: [Cookie policy URL].
Change your choice: [Cookie settings link].
Unsubscribe from marketing: [Method].
6. International transfers
[Countries or regions]. Safeguards: [Safeguards used].
7. How long we keep data
[Order records: period]. [Marketing: until you unsubscribe].
[Accounts: until closed, plus period].
8. Your rights and complaints
[Rights that apply to your customers]. Requests: [Email or form].
We verify requests by [Method] and reply within [Period].
Complaints: [Supervisory authority].
9. US state privacy rights
[If applicable: categories, sale or sharing, opt-out link, GPC].
10. Children and security
[Statement about children's data]. [Summary of your measures].
11. Changes and contact
[How you notify customers of changes]. [Privacy email].If you would rather have the draft written for you, ShopOpsy's Privacy Policy Setup is a one-time $79 service that drafts the policy from your installed apps, tracking tools and the way you handle orders and customer accounts. It is a draft, not legal advice.
How to publish or update it in Shopify
- From your Shopify admin, go to Settings > Policies.
- In Written policies, click the privacy policy. If it isn't listed there, go to Settings > Customer privacy and click Privacy policy.
- If Use automated policy is on, copy the current text, then turn it off.
- Paste or edit your policy.
- Click Save to publish.
Then open /policies/privacy-policy, check the checkout footer and footer menu links, and review any translations against your default-language policy. While you're in Settings > Policies, check that your refund policy and shipping policy match how you work today.
When should you update your Shopify privacy policy?
Update it before the change goes live:
- New or removed app that touches customer data. When you uninstall an app, Shopify sends the developer a request to erase your customers' personal information after 48 hours.
- New tracking, such as a pixel, tag or advertising platform.
- New messaging channel or email, SMS or WhatsApp provider.
- New market. The automated template switches sections when you sell to the US or to the EEA, UK or Switzerland. A manual policy doesn't change by itself.
- New purpose or new data, such as birthdays for a loyalty program. The ICO says to update your privacy information before you start the new processing and to bring the change to people's attention (Should we test, review and update our privacy information?).
Review the policy regularly even when nothing obvious has changed. Shopify keeps past policy versions for 2 years and lets you export them, but says keeping your own records of changes is your responsibility. Update the "Last updated" date each time.
Frequently asked questions
Does Shopify automatically create a privacy policy?
For new stores, yes: automated privacy settings are on by default and generate a privacy policy from Shopify's template. Existing stores can turn them on in Settings > Customer privacy. Review the result, because it won't list your specific apps, pixels or email tools.
Do I need a separate cookie policy on Shopify?
Shopify's written policies don't include a cookie policy type. You can cover cookies in the privacy policy, publish a separate cookie page, or both. Link a separate page from your privacy policy and footer menu, and from your banner if your consent app has a field for policy links. Our Shopify cookie policy guide lists the cookies Shopify sets on storefronts and includes a fill-in template. ShopOpsy also offers a Cookie Policy Setup draft if you want one written from your tracking setup.
Can I copy another store's privacy policy?
You shouldn't. It describes another store's apps, providers and retention choices, and your policy has to match what your store actually does. Start from Shopify's template and your own data-flow list.
Sources
- Adding store policies — Shopify Help Center, accessed 28 October 2026.
- Configuring customer privacy settings — Shopify Help Center, accessed 28 October 2026.
- Using Shopify to help comply with GDPR — Shopify Help Center, accessed 22 October 2026.
- App permissions and personal information — Shopify Help Center, accessed 22 October 2026.
- Pixels and customer events — Shopify Help Center, accessed 22 October 2026.
- Manage your custom pixels — Shopify Help Center, accessed 22 October 2026.
- Collecting customer contact information — Shopify Help Center, accessed 22 October 2026.
- Processing customer data requests — Shopify Help Center, accessed 22 October 2026.
- Free privacy policy generator — Shopify, accessed 22 October 2026.
- UK GDPR Article 13: Information to be provided where personal data are collected from the data subject — legislation.gov.uk, accessed 22 October 2026.
- Principles of personal data processing under the GDPR — European Commission, accessed 22 October 2026.
- The right to be informed — Information Commissioner's Office, accessed 22 October 2026.
- Should we test, review and update our privacy information? — Information Commissioner's Office, accessed 22 October 2026.
- California Consumer Privacy Act (CCPA) — California Attorney General, accessed 22 October 2026.
- Updated Monetary Thresholds in CCPA — California Privacy Protection Agency, accessed 22 October 2026.
- Consumer privacy — Federal Trade Commission, accessed 22 October 2026.
