2022 Report

Compelled Disclosure

In 2022, Shopify received a total of 2,114 requests, 1,673 of which were valid legal requests. Of those valid legal requests, we objected to 693 (41% of these requests).

This report includes data from January 1, 2022 to December 31, 2022.

Our Guiding Principles

Shopify is committed to protecting the privacy of our merchants, customers, partners, and everyone who entrusts us with their personal information. We are publishing this Transparency Report to make commerce better for everyone by building consumer confidence through transparency, and support an informed public debate on privacy rights by joining other members of our industry in reporting on government and other legal requests for access to data.

Our Process

To protect the privacy of our merchants, customers, and partners, we endeavor to minimize the amount of personal information we disclose. Our process upon receipt of a request to produce information about a merchant, a merchant’s customer, or a partner is as follows:

  • We will refuse to disclose personal information without a subpoena or court order issued by a body that has jurisdiction over Shopify, or where an order is legally enforceable in the merchant’s jurisdiction.
  • Legal requests must be addressed to the correct Shopify entity (such as Shopify Inc. or Shopify International Limited).
  • We will always notify affected individuals before we disclose information, unless prohibited by law, and minimize the amount of personal information that we disclose.

We review the following factors in determining whether we will comply with a legal request:

  • Jurisdiction and authority of requester
  • Type of legal request
  • Shopify entity and type of information requested

Information requests by country

Information requests by country

In 2022, we received legal requests for information from 37 countries.

As outlined in our Guidelines on Legal Requests for Information, we will only respond to enforceable subpoenas or court orders issued by bodies that have the authority to compel the production of information, where the requesting body:

  • has jurisdiction over the specific Shopify entity from which information is being requested; or
  • is located in the same jurisdiction as the merchant.

If neither of these elements are met, we require that the requesting body follow the Mutual Legal Assistance Treaty or Hague Evidence Convention (“Letters Rogatory”) processes.

2022 received requests by country
Jurisdiction of Requestor Record Count
France 513
United States of America 496
Brazil 184
Germany 178
Spain 107
Netherlands 87
Argentina 69
India 59
United Kingdom of Great Britain and Northern Ireland 42
Canada 27
Australia 24
Italy 16
Hong Kong SAR 7
New Zealand 7
Belgium 7
Japan 5
Switzerland 5
Denmark 4
Singapore 4
Ireland 3
Lithuania 3
Malaysia 2
Norway 2
Romania 2
Poland 2
Hungary 2
Israel 1
South Africa 1
Mexico 1
Puerto Rico 1
Bulgaria 1
Czechia 1
Russian Federation 1
Indonesia 1
Sweden 1
Philippines 1

Types of information requests

Types of information requests

In 2022, we received different types of legal requests for information, including Grand Jury Subpoenas, Summons, Preservation Orders, Information Subpoenas, and Certifications of Trustee in Bankruptcy.

2022 received requests types
Type of Order Record Count
Law Enforcement Request 530
Regulator/Consumer Protection Request 505
Takedown Request 343
Redirect to Another Team 196
Information Subpoena 130
Grand Jury Subpoena 91
Temporary Restraining Order 76
Court Order 57
Request Improperly Routed through Legal Access Portal 51
Buyer Complaint 36
General Email Contact 25
Search Warrant 20
Consumer Complaint 18
Summons 16
Preservation Order 16
Injunction (Preliminary or Permanent) 4

Individual Rights

Individual Rights

Shopify believes strongly that individuals should have control over their personal information. In this spirit, and in accordance with our Privacy Policy, we respond directly to requests from our merchants, partners, and app users to access or delete their personal information. That said, when it comes to personal information about our merchants’ customers, we do not control that information - we only process that information as a “data processor” or a “service provider” for our merchants.

As a result, we do not respond to requests from a merchant’s customer directly. Instead, we relay these requests to the relevant merchant, and have built tools for our merchants to enable them to act on these requests in our platform.

In 2022, we fulfilled these data subject requests:

Access

2022 Individual Access Rights
Merchant Access 144
Partner Access 20
Shop Access 59
Employee Access 11

Deletion

2022 Individual Deletion Rights
Merchant Deletion 5,133
Partner Deletion 156
Shop Opt-Out 4,49,862
Employee Deletion 3

Information on Active Monthly Users for purposes of the Digital Services Act

The Digital Services Act (DSA) creates new obligations for certain digital service providers within the European Union (EU). Among these obligations, Article 24(2) of the DSA requires providers of ‘online platforms’ and ‘online search engines’ to publish ‘information on the average monthly active recipients of the services’ in the EU. This information is used to determine whether an online platform is a ‘very large online platform’ (VLOP), meaning it reaches an average of at least 45 million users per month in the EU.

Shopify does not operate ‘online search engines’ or ‘online platforms,’ as those terms are defined by the DSA. To the extent that any of Shopify's offerings may be considered 'online platforms' under the DSA, we concluded that during the period 1 July 2022 to 31 December 2022, the average number of monthly active recipients of those services in the EU was well below the 45 million user threshold for being designated as VLOPs.

We will continue to monitor the number of average monthly active recipients of any potentially relevant services in the EU, and publish updated information in accordance with Article 24(2) of the DSA.