Shopify & GDPR: Key updates in 2023

Introduction

Understanding the Shopify GDPR key updates in 2023 is essential to protect customer data and comply with the law if you oversee a Shopify store. Shopify has targeted crucial aspects such as revamped development guidelines, stricter data privacy controls, and new regulatory requirements. This article simplifies these updates, showing you how to incorporate them and keep your Shopify store in compliance easily.

Key takeaways

• Shopify has enhanced GDPR compliance through development document revisions, data minimization enforcement, privacy policy bolstering, and the introduction of mandatory webhooks, underscoring a secure shopping environment for merchants and customers.

• Shopify apps provide features for additional data protection and/or compliance, such as consent management, data subject requests management, to reinforce customer trust and ensure a secure online shopping experience.

• Shopify’s Customer Privacy API enables store owners to manage customer consent regarding data processing, which is crucial for adhering to GDPR and new privacy laws like CPRA and VCDPA to avoid severe financial penalties.

Shopify’s GDPR compliance efforts in 2023

In 2023, Shopify demonstrated its commitment to data privacy by taking active steps towards enhancing its GDPR compliance. The significance of GDPR compliance is immense. Non-compliance can lead to hefty fines and damage a business’s reputation and customer trust. As a platform and partner, Shopify plays a significant role in helping businesses navigate the complex landscape of data privacy regulations and achieve GDPR compliance.

Shopify has undertaken wide-ranging efforts towards GDPR compliance, including:

• Revising development documents

• Enforcing data minimization

• Bolstering privacy policies

• Introducing mandatory webhooks to ensure the management of personal data aligns with privacy regulations

These developments underscore Shopify’s dedication to GDPR compliance and set a benchmark for other platforms in the digital commerce ecosystem.

Moreover, Shopify has taken several steps to ensure data protection and compliance with the General Data Protection Regulation (GDPR).

These steps include:

• Revising its development documents to provide extensive resources for developers and merchants to understand and comply with data protection regulations, helping them to protect data effectively.

• Enhancing its privacy policy to provide comprehensive information on data protection practices.

• Emphasizing the importance of data protection and privacy on its website.

These measures demonstrate Shopify’s commitment to protecting user data and complying with relevant regulations as well as to supporting GDPR applications such as Pandectes GDPR Compliance to have a better integration with Shopify stores.

Given the increasing prevalence of data breaches in the industry, Shopify’s efforts symbolize more than just regulatory compliance; they exemplify their dedication to nurturing a safe and secure shopping environment for merchants and customers.

Development document updates

Shopify’s development documentation has seen significant updates, especially in the context of GDPR compliance. The modifications, made available in October 2023, altered the data collection process, integrating data minimization practices into Shopify’s privacy-by-design strategy for commerce. These updates provide a roadmap for developers to navigate the intricacies of data privacy laws and implement robust data protection measures within their apps.

The revisions also catered to GDPR stipulations for data transferring, incorporating technical and organizational safeguards for data and delineating the responsibilities of Shopify and merchants in the Data Processing Addendum (DPA). Furthermore, the documents recommend implementing a process for receiving and responding to requests for data access, including sensitive data, to address individuals’ rights under GDPR. These recommendations, among others, are a testament to Shopify’s commitment to not only achieving but also facilitating GDPR compliance across its platform in collaboration with data protection authorities and the guidance of a data protection officer.

Privacy policy enhancements

Aligning with its devotion to data privacy, Shopify has significantly upgraded its privacy policy, encapsulating alterations in the collection and management of personal data. The emphasis has been on safeguarding personal information, maintaining customers’ trust and confidence, and ensuring responsible data collection practices. This transparency is key to GDPR compliance, and Shopify has gone above and beyond to ensure that its users are well-informed about processing personal data.

In addition to enhancing its privacy policy, the platform has upgraded its store preferences interface by introducing a new preferences management feature. These improvements provide clear guidance on collecting, using, and sharing personal information, ensuring compliance with privacy regulations and requiring businesses to be transparent about their data protection practices. This assists users and developers in navigating the path to compliance with data protection laws and promotes a culture of transparency and accountability.

Store preferences page update on customer privacy

Shopify has streamlined its store preferences page regarding customer privacy, presenting only two methods for handling customer data instead of the previous three. This change reflects a more focused approach to GDPR compliance and simplifies the decision-making process for merchants.

The figure below presents how the preference options were before about customer privacy.

Previously, the options included ‘Collected before consent,’ ‘Partially collected before consent,’ and ‘Collected after consent.’ Removing the ‘Partially collected before consent’ option is a significant move, as this method did not offer a level of compliance compatible with GDPR standards. Under GDPR, any collection of personal data before obtaining explicit consent from the user is a potential violation of privacy rights. The initial option may have led to confusion or inadvertent non-compliance, which could result in severe penalties for store owners.

Now, Shopify store owners can choose between ‘Collected before consent’ for necessary operational data, which is permissible under GDPR for the functioning of the store, and ‘Collected after consent’ for all other types of data. This adjustment ensures that Shopify merchants are not inadvertently collecting any data requiring prior consent under GDPR, thus maintaining a clear path to compliance and reducing the risk of legal repercussions.

The simplification of the store preferences page underscores Shopify’s commitment to privacy, compliance, and ease of use for its merchants. By providing clear and concise options, Shopify aids merchants in making informed decisions about customer data collection and reinforces the importance of adhering to GDPR.

The figure below presents how these preferences options are today.

Mandatory webhooks for data protection

To maintain uniform management of personal data across all apps, Shopify unveiled mandatory webhooks in 2023. Callback methods that Shopify mandates for apps listed on the Shopify App Store, these webhooks play a pivotal role in overseeing the management of personal data collected by an app. They ensure privacy rights for personal data across all apps, irrespective of the user’s location.

Apps must subscribe to privacy webhook topics that handle requests to view stored customer data, requests to delete customer data, and requests to delete shop data when a store owner uninstalls an app. Subscription to these webhooks is done through the Partner Dashboard in Shopify, using HTTPS webhook addresses with valid SSL certificates to ensure secure communication. Non-compliance with these webhooks could result in the app being rejected from the Shopify App Store, underscoring the importance of these measures in maintaining GDPR compliance.

Key GDPR-related features in Shopify apps

Beyond platform-wide initiatives, Shopify also provides various GDPR-related app features, including consent management. These features provide additional layers of data protection and compliance, enhancing the overall security profile of a Shopify store.

Consent management apps, for instance, offer streamlined compliance management, implementation of privacy policies, and safeguarding customer data.

These features, coupled with Shopify’s ongoing efforts to promote apps with specific story pages on the app store and the integration of Shopify analytics, ensure that achieving GDPR compliance is feasible and manageable for Shopify merchants.

Consent management apps

Consent management apps are among the pivotal GDPR-related features on Shopify. These apps contribute to GDPR compliance by offering features such as transparent cookie banner management, ensuring adherence to global data protection laws, and simplifying compliance with privacy laws. Their role in GDPR compliance is invaluable, especially in managing customer consent and ensuring that Shopify stores operate within data privacy regulations.

For Shopify stores looking to enhance their GDPR compliance, the Pandectes GDPR Compliance app stands out as a robust solution. Our app is designed to help store owners manage customer consent seamlessly and ensure compliance with the latest GDPR regulations. Pandectes GDPR Compliance is an app with more than 1200 positive reviews from merchants around the world. Any store needs to be compliant with GDPR, CCPA/CPRA, VCDPA, LGPD, PIPEDA, APPI, PDPA, FADP, and other data regulations, and avoid getting fined. The app is ready for EU/EEA, Switzerland, UK, Brazil, California (US), Virginia (US), Canada (Alberta, British Columbia, and Quebec), Japan, or Thailand-based stores. A must-have for dropshipping and print-on-demand (POD) stores. It works also with Shopify’s Consent API, Google Consent Mode v2, Online Store 2.0, & Headless Stores. Finally, it offers email & chat support from GDPR experts.

On the Shopify app store, Pandectes GDPR Compliance offers a comprehensive set of tools for transparent cookie banner management, adherence to global data protection laws, and simplifying privacy law compliance. Its utility in enhancing data privacy on the Shopify platform is unmatched, making it an indispensable tool for merchants aiming to navigate the complexities of GDPR.

Shopify’s customer privacy API

Shopify’s Customer Privacy API is critical to GDPR compliance endeavors. The API oversees customer consent and inquires about data processing permission, enabling store owners to adhere to privacy regulations. The API supports the recording of customer consent for:

• preferences

• analytics

• marketing

• sale of data

This offers a comprehensive tool for managing customer privacy.

The Customer Privacy API provides the following features:

• Facilitates the development of a personalized cookie consent banner, which can be customized to meet the specific requirements of the storefront

• Utilizes the userDataCanBeSold and shouldShowBanner methods to handle the opt-outs for selling data and to determine if the cookie consent banner should be displayed for visitors in states such as California and Virginia

• Provides control and customization to adapt to the specific privacy requirements of different regions and ensure GDPR compliance.

Adapting to new privacy laws in the US

Beyond GDPR compliance, Shopify store owners must also accommodate new US privacy laws, including the California Privacy Rights Act (CPRA) and Virginia’s Consumer Data Protection Act (VCDPA). These new laws introduce new rights for consumers and heightened obligations for businesses, and Shopify store owners must understand these laws to maintain compliance and avoid penalties.

Shopify store owners can comply with the CPRA and VCDPA regulations by:

• Adding a Cookie Consent Bar to inform visitors about the use of cookies

• Adjusting their store’s Customer Privacy Settings

• Creating a comprehensive Privacy Policy

• Implementing a system to manage customer personal data requests

Non-compliance can lead to hefty fines, with CPRA fines amounting to as much as $7,500 per intentional violation and VCDPA fines reaching up to $2,500 per violation and $7,500 for an intentional violation per incident. It is, therefore, imperative for Shopify store owners to stay abreast of these new laws and ensure their compliance.

Tips for ensuring GDPR compliance on your Shopify store

Several crucial steps are involved in ensuring GDPR compliance on your Shopify store. Privacy-focused applications, for instance, play a crucial role in safeguarding customer data and simplifying the process of complying with privacy laws. Regular risk assessments are also instrumental in identifying and mitigating risks associated with processing personal data.

Staying informed about recent changes in GDPR is equally important. Shopify is committed to updating its users about these changes through its platform updates and resources. Establishing a GDPR-compliant privacy policy is another integral step. Shopify store owners can integrate the Pandectes GDPR Compliance app to manage customer consent effectively and ensure their privacy policies align with GDPR requirements. This app assists in obtaining explicit customer consent for data processing activities and establishing a GDPR-compliant privacy policy on their Shopify store.

What’s next for Shopify in 2024

Shopify has announced significant changes to the checkout customization process, which will impact Shopify Plus merchants and developers. As of August 13, 2024, the checkout.liquid file used for customizing the information, shipping, and payment pages will be deprecated and no longer supported. Furthermore, on August 28, 2025, the checkout.liquid file for the thank you and order status pages will also be turned off and no longer supported. This deprecation extends to the discontinuation of apps using script tags and additional scripts under the post-purchase and order status pages.

Shopify Scripts will remain functional up to these dates, working in tandem with checkout extensibility. Shopify Plus merchants are encouraged to transition to Checkout Extensibility, which offers a more efficient, high-performing, secure, and upgrade-safe alternative for checkout customizations. Checkout Extensibility is designed to integrate seamlessly with Shop Pay, enhancing the overall checkout experience for customers.

In line with GDPR compliance, Shopify plans to integrate consent management features into the checkout journey. While cookies and other tracking data are essential for analytics, personalization, and marketing, GDPR and other data protection regulations require that customers consent to collecting their data in certain jurisdictions. The data necessary for operating the storefront and checkout will continue to be collected regardless of consent or data sale opt-out preferences. Shopify is committed to aligning the checkout process with data regulations by incorporating user consent mechanisms throughout the customer journey.

Of course, the Pandectes GDPR Compliance app will be part of this process and will be supported on the checkout journey as well. So stay tuned!

Conclusion

To sum up, GDPR compliance is not just a regulatory requirement but also a testament to a business’s commitment to data privacy. Shopify has made significant strides towards ensuring GDPR compliance on its platform through updates in development documents, privacy policy enhancements, and mandatory webhooks for data protection. The platform also offers GDPR-related app features, including consent management. Adapting to new privacy laws in the US and conducting regular risk assessments are also vital for Shopify store owners. Several successful case studies of GDPR compliance further attest to the importance of prioritizing data privacy and implementing effective compliance strategies.