Do Not Sell My Data on Shopify: The Opt-Out Page Explained
A “Do Not Sell My Personal Information” link on a Shopify store is Shopify’s data sales opt-out page, which you set up under Settings > Customer privacy. It lets visitors opt out of the sale or sharing of their personal data, and pixels marked as selling data stop running for those visitors; with Shopify Network Intelligence on, Shopify also treats a browser’s Global Privacy Control signal as an opt-out. Apps that handle data outside Shopify’s pixel system follow their own settings, so the second half of the job is checking your apps. This is general information, not legal advice; Shopify’s own pages say you are responsible for your compliance.
When a store “sells” or “shares” data
Under several US state privacy laws, such as California’s CCPA as amended by the CPRA, passing personal data to a third party for something of value, or for targeted advertising, can count as a “sale” or “sharing”, even when no money changes hands. For a Shopify store, the usual sources are advertising pixels (Meta, Google, TikTok), audience tools, and apps that send customer lists to an ad platform. Shopify’s pixels manager page, read on October 23, 2026, puts it in its own terms: pixels configured as data sale do not run for customers who have opted out of data sales or sharing, unless the pixel supports limited data use.
Whether your store must offer an opt-out depends on where your customers live and on your size and activity under each law, which is a question for a lawyer. If you run ad pixels and sell to US consumers, assume the question applies to you and set the page up.
Set up the opt-out page
Shopify’s GDPR compliance page, read on October 23, 2026, places the controls together: under Settings > Customer privacy you configure your privacy policy, the cookie banner and the data sales opt-out page, and see your installed privacy apps.
- Go to Settings > Customer privacy.
- Set up the data sales opt-out page; Shopify notes that customer privacy settings can differ by country and region.
- Add a link to it in your footer menu under Content > Menus, with the wording the law in your main markets expects, such as “Do Not Sell or Share My Personal Information”.
- Check the privacy policy mentions the opt-out and the categories of data you share; Shopify’s policy templates can be adapted for it.
- Test it: open the page in a private window, submit an opt-out, and confirm in your browser’s developer tools (the Network tab) or with the ad platform’s pixel helper extension that ad pixels set as data sale no longer send events for that visitor.
What it covers and what it doesn’t
| Covered | Not covered on its own |
|---|---|
| Pixels in Shopify’s pixels manager that are configured as data sale | Scripts pasted into theme code outside the pixels manager |
| Shopify Network Intelligence: an opt-out through the page, a GPC signal or an integrated privacy tool marks the customer’s activity accordingly | Data an app has already copied to its own servers |
| Apps and cookie banners properly integrated with Shopify’s Customer Privacy API | Customer lists you upload to an ad platform by hand |
| Email and SMS marketing consent, which is a separate setting |
Global Privacy Control (GPC) is a browser setting that tells every site the visitor does not want their data sold or shared. Shopify’s GDPR page says that with Shopify Network Intelligence on, a customer who opts out through the GPC header, the opt-out page or an integrated third-party tool has their activity on your site treated as opted out. Customers can also request deletion, or opt out of Shopify’s own sharing for ads, directly through the Shopify privacy portal.
Checklist for your apps
For every app that touches customer data or loads a script on the storefront:
- Does it load through the pixels manager as an app pixel, so Shopify’s consent and opt-out settings apply?
- Is it integrated with the Customer Privacy API, so it reads the visitor’s choice?
- Does it send customer lists to an ad platform, and if so, does it respect opt-outs?
- Is it named in your privacy policy, with what it collects?
- Did you remove old tracking code from
theme.liquidwhen you moved a pixel into the pixels manager?
We list every tracker on our own sites in the privacy policy and load them only after consent; the list is the document you hand a lawyer when you ask whether you “sell” data. Requests to export or erase a customer’s data are covered in export or erase customer data, and the European side in Shopify GDPR. Other operations guides are in the running a store hub.
Frequently asked questions
Do I need a data sales opt-out page? It depends on where your customers live and on the laws that apply to your business, so ask a lawyer. If you run advertising pixels and sell to US consumers, setting up Shopify’s opt-out page under Settings > Customer privacy is a low-effort step.
What is Global Privacy Control? GPC is a browser signal that asks websites not to sell or share the visitor’s personal data. Shopify treats a GPC header as an opt-out of sale or sharing for Shopify Network Intelligence, alongside its opt-out page.
Can I sell my customer list? Selling or sharing customer data is regulated in many places and limited by what your privacy policy told customers when they gave you the data. Do not do it without legal advice and the customers’ consent where the law requires it.