2022 Report

Compelled Disclosure

In 2022, Shopify received a total of 2,114 requests, 1,673 of which were valid legal requests. Of those valid legal requests, we objected to 693 (41% of these requests).

This report includes data from January 1, 2022 to December 31, 2022.

Our Guiding Principles

Shopify is committed to protecting the privacy of our merchants, customers, partners, and everyone who entrusts us with their personal information. We are publishing this Transparency Report to make commerce better for everyone by building consumer confidence through transparency, and support an informed public debate on privacy rights by joining other members of our industry in reporting on government and other legal requests for access to data.

Our Process

To protect the privacy of our merchants, customers, and partners, we endeavor to minimize the amount of personal information we disclose. Our process upon receipt of a request to produce information about a merchant, a merchant’s customer, or a partner is as follows:

  • We will refuse to disclose personal information without a subpoena or court order issued by a body that has jurisdiction over Shopify, or where an order is legally enforceable in the merchant’s jurisdiction.

  • Legal requests must be addressed to the correct Shopify entity (such as Shopify Inc. or Shopify International Limited).

  • We will always notify affected individuals before we disclose information, unless prohibited by law, and minimize the amount of personal information that we disclose.

We review the following factors in determining whether we will comply with a legal request:

  • Jurisdiction and authority of requester

  • Type of legal request

  • Shopify entity and type of information requested

  • In 2022, we received legal requests for information from 37 countries.

    As outlined in our Guidelines on Legal Requests for Information, we will only respond to enforceable subpoenas or court orders issued by bodies that have the authority to compel the production of information, where the requesting body:

    • has jurisdiction over the specific Shopify entity from which information is being requested; or

    • is located in the same jurisdiction as the merchant.

    If neither of these elements are met, we require that the requesting body follow the Mutual Legal Assistance Treaty or Hague Evidence Convention (“Letters Rogatory”) processes.

    Jurisdiction of RequestorRecord Count
    United States of America496
    United Kingdom of Great Britain and Northern Ireland42
    Hong Kong SAR7
    New Zealand7
    South Africa1
    Puerto Rico1
    Russian Federation1
  • In 2022, we received different types of legal requests for information, including Grand Jury Subpoenas, Summons, Preservation Orders, Information Subpoenas, and Certifications of Trustee in Bankruptcy.

    Type of Data RequestNumber received
    Law Enforcement Request530
    Regulator/Consumer Protection Request505
    Takedown Request343
    Information Subpoena130
    Grand Jury Subpoena91
    Temporary Restraining Order76
    Court Order57
    Request Improperly Routed through Legal Access Portal51
    Buyer Complaint36
    General Email Contact25
    Search Warrant20
    Consumer Complaint18
    Preservation Order16
    Injunction (Preliminary or Permanent)4

Information on Active Monthly Users for purposes of the Digital Services Act

The Digital Services Act (DSA) creates new obligations for certain digital service providers within the European Union (EU). Among these obligations, Article 24(2) of the DSA requires providers of ‘online platforms’ and ‘online search engines’ to publish ‘information on the average monthly active recipients of the services’ in the EU. This information is used to determine whether an online platform is a ‘very large online platform’ (VLOP), meaning it reaches an average of at least 45 million users per month in the EU.

Shopify does not operate ‘online search engines’ or ‘online platforms,’ as those terms are defined by the DSA. To the extent that any of Shopify's offerings may be considered 'online platforms' under the DSA, we concluded that during the period 1 July 2022 to 31 December 2022, the average number of monthly active recipients of those services in the EU was well below the 45 million user threshold for being designated as VLOPs.

We will continue to monitor the number of average monthly active recipients of any potentially relevant services in the EU, and publish updated information in accordance with Article 24(2) of the DSA.

Start your 3-day free trial today!

Try Shopify free for 3 days, no credit card required. By entering your email, you agree to receive marketing emails from Shopify.