Does your Shopify store need a privacy policy?
Yes. Your store collects personal information with every order, so privacy laws such as the GDPR, the CCPA and CalOPPA require you to explain what you collect and how you use it. Payment providers and marketplaces also expect a privacy policy, and customers look for one before they buy.
Adding the policy to your Shopify store
In your Shopify admin, go to Settings > Policies. Shopify has fields for a privacy policy, refund policy, terms of service, shipping policy and contact information, and it links them in your checkout. Paste your policy text there. You can draft and maintain the text in Legiflare, and use the hosted version anywhere else you sell, such as marketplaces or social storefronts.
What a store privacy policy should cover
- Order information: name, shipping and billing address, email, phone number and order history
- Payments: card details are processed by Shopify Payments or your payment gateway, not stored by you
- Customer accounts: if customers can create accounts, what is stored and how to delete it
- Shopify as a service provider: your store runs on Shopify, which processes data on your behalf; link to Shopify's own privacy policy
- Shipping and fulfillment partners: carriers and fulfillment services receive addresses to deliver orders
- Retention: order records are usually kept for years for tax and accounting reasons; say so
- Rights: how customers can access, correct or delete their data, and a contact email
Apps, pixels and cookies
Most of the privacy complexity in a store comes from apps and tracking. Review the apps you have installed, because many of them receive customer data: email marketing, reviews, loyalty programs, upsell tools and analytics. Tracking pixels, such as the Meta Pixel, Google tags and TikTok Pixel, share browsing and purchase events with ad platforms.
Disclose these in your policy. If you have customers in the EU or the UK, use a cookie banner that asks for consent before marketing cookies load; Shopify's customer privacy settings can help with that. For California customers, sharing data with ad platforms for targeted advertising has to be disclosed, with an opt-out, if the CCPA applies to your business.
Email and SMS marketing
Explain how customers subscribe, what you send and how to unsubscribe. In the EU and the UK, marketing emails generally require consent, with a limited exception for existing customers. In the US, CAN-SPAM requires an unsubscribe link in marketing emails, and marketing text messages need the recipient's prior express written consent under the TCPA.
Checklist for your store
- Order, payment and account data are described.
- Every installed app that receives customer data is covered.
- Tracking pixels and cookies are disclosed, with a consent banner where needed.
- Email and SMS marketing and unsubscribing are explained.
- The policy is added under Settings > Policies and linked in your footer.
- A refund policy and terms of service are published too.
Frequently asked questions
Can I use Shopify's privacy policy template?
It's a starting point. Generic templates don't know which apps, pixels and marketing tools your store uses, so review it and add those details.
Do I need a separate cookie policy for my store?
Not necessarily. You can include a cookies section in the privacy policy. A separate cookie policy is useful if you use many tracking tools and want a page to link from your cookie banner.
Which other policies does an online store need?
Usually a refund policy, a shipping policy and terms of service, in addition to the privacy policy. Shopify has a field for each of them.