Shopify GDPR: Customer Privacy Settings, Banner and Policy

Shopify gives you the tools for GDPR, but compliance stays your responsibility. The core of the setup is Settings > Customer privacy, where you configure your privacy policy, the cookie banner, the data sales opt-out page and privacy settings per country or region. Behind it sits Shopify’s Data Processing Addendum, which makes Shopify a processor that follows your instructions for most customer data. If Shopify Network Intelligence is on, your privacy policy has extra things it must say.

Everything below comes from the Shopify Help Center pages on complying with GDPR, customer privacy settings and customer data requests, read on October 23, 2026. Shopify notes that this information is not legal advice, and neither is this article; for your own situation, ask a lawyer who knows GDPR.

Shopify’s position is that it provides tools and information that help you comply, and that you are responsible for understanding your obligations and configuring the platform correctly. Three facts frame the rest:

Storage location. GDPR does not require personal data to be stored in Europe. It requires European residents’ data transferred outside Europe to be protected under the applicable rules.
Processor and controller. Under the Data Processing Addendum, when Shopify acts as a processor or service provider it follows your instructions on handling your customers’ personal data. Appendix E of the addendum covers Shopify’s role as a controller when you use Enhanced Services.
Data rights. Shopify offers tools to access, edit and delete customer data on request, so you can answer access, correction and erasure requests.

Set up Customer privacy settings

In the admin go to Settings > Customer privacy.
Privacy policy. Create or edit your policy here. Shopify offers policy templates; adapt them to what you actually collect and which apps you use.
Cookie banner. Turn on Shopify’s cookie banner for the regions that need it, such as the EU and the UK. Customize the text and appearance.
Regions. Privacy laws differ by place, so the settings can be customized for each country and region you sell to.
Data sales opt-out page. Set it up where it applies; Shopify also respects the Global Privacy Control signal when Network Intelligence is on.
Installed privacy apps. The same page shows privacy apps you have installed. If you use a third-party consent app instead of Shopify’s banner, it should integrate with Shopify’s Customer Privacy API, so Shopify and your other tools respect the customer’s choices.

Test the banner after setup: open your store in a private window, decline non-essential cookies, and check that analytics and ad pixels do not fire. We do the same on our own sites, where every tracker loads only after consent and is listed in the privacy policy.

Your privacy policy: what it must cover

Beyond your own data uses, Shopify’s Help Center lists obligations that apply if you have Shopify Network Intelligence enabled and receive Enhanced Services:

Include a link to Shopify’s Consumer Privacy Policy in your privacy policy, and link your privacy policy prominently in the store, for example in the footer.
Tell customers, in your terms of service and privacy policy, that your store is hosted by Shopify and that Shopify collects and processes their personal data, including to provide Enhanced Services.
Tell customers that information about their activity is shared with Shopify and with third parties that may be in other countries.
Link to privacy.shopify.com, where customers can opt out of or object to certain uses of their data by Shopify.
State the legal bases you rely on to process personal data. Shopify relies on consent for personalized advertising under Enhanced Services, and names legitimate interests for other purposes.

Email and SMS marketing need the customer’s consent, recorded on the customer profile: Customer agreed to receive marketing emails in the admin, or the Accepts Email Marketing and Accepts SMS Marketing columns (yes or no) when you import customers. Shopify’s import guidance warns against buying lists; mailing people who never opted in damages your reputation and deliverability. Signup forms and consent wording are covered in the email and popups hub.

Data requests

When a customer asks for their data or asks you to delete it, use Shopify’s customer data request tools rather than editing records by hand. If Network Intelligence is on, a deletion request you process also deletes the customer’s data from Network Intelligence. The steps for exporting and erasing data are in our guide to export or erase Shopify customer data.

Apps and trackers

Every app and pixel that collects visitor data is part of your GDPR picture:

List each one in your privacy policy, with what it collects and why.
Make sure each respects the cookie banner choice; Shopify honors the choice made in its own banner or in a consent app properly integrated with the Customer Privacy API.
Remove apps you no longer use, since some leave code behind after uninstalling.

Analytics is a typical case; consent for Google Analytics is covered in GA4 on Shopify. The running a store hub has the other legal and setup topics.

Frequently asked questions

Does Shopify store customer data in the EU? GDPR does not require personal data to be stored in Europe; it requires data of European residents that is transferred outside Europe to be protected under the applicable laws. Shopify’s Data Processing Addendum sets out how Shopify handles that data as a processor.

Do I need a cookie banner on Shopify? If you sell to customers in the EU or UK and use non-essential cookies such as analytics or advertising pixels, you need consent first. Shopify’s Customer privacy settings include a cookie banner you can turn on for those regions.

Is Shopify a data processor or a controller under GDPR? Shopify acts as a data processor or service provider for your customer data under its Data Processing Addendum, following your instructions. For Enhanced Services, Appendix E describes Shopify’s role as a controller.

Who answers a customer’s request to see or delete their data? You do, as the merchant: open the customer in your admin and use Request customer data or Erase personal data. If Shopify Network Intelligence is on, customers also have direct rights with Shopify, which your privacy policy has to mention.