2022 Report
Compelled Disclosure
In 2022, Shopify received a total of 2,114 requests, 1,673 of which were valid legal requests. Of those valid legal requests, we objected to 693 (41% of these requests).
This report includes data from January 1, 2022 to December 31, 2022.
Our Guiding Principles
Shopify is committed to protecting the privacy of our merchants, customers, partners, and everyone who entrusts us with their personal information. We are publishing this Transparency Report to make commerce better for everyone by building consumer confidence through transparency, and support an informed public debate on privacy rights by joining other members of our industry in reporting on government and other legal requests for access to data.
Our Process
To protect the privacy of our merchants, customers, and partners, we endeavor to minimize the amount of personal information we disclose. Our process upon receipt of a request to produce information about a merchant, a merchant’s customer, or a partner is as follows:
We will refuse to disclose personal information without a subpoena or court order issued by a body that has jurisdiction over Shopify, or where an order is legally enforceable in the merchant’s jurisdiction.
Legal requests must be addressed to the correct Shopify entity (such as Shopify Inc. or Shopify International Limited).
We will always notify affected individuals before we disclose information, unless prohibited by law, and minimize the amount of personal information that we disclose.
We review the following factors in determining whether we will comply with a legal request:
Jurisdiction and authority of requester
Type of legal request
Shopify entity and type of information requested
In 2022, we received legal requests for information from 37 countries.
As outlined in our Guidelines on Legal Requests for Information, we will only respond to enforceable subpoenas or court orders issued by bodies that have the authority to compel the production of information, where the requesting body:
has jurisdiction over the specific Shopify entity from which information is being requested; or
is located in the same jurisdiction as the merchant.
If neither of these elements are met, we require that the requesting body follow the Mutual Legal Assistance Treaty or Hague Evidence Convention (“Letters Rogatory”) processes.
2022 received requests by country Jurisdiction of Requestor Record Count France 513 United States of America 496 Brazil 184 Germany 178 Spain 107 Netherlands 87 Argentina 69 India 59 United Kingdom of Great Britain and Northern Ireland 42 Canada 27 Australia 24 Italy 16 Hong Kong SAR 7 New Zealand 7 Belgium 7 Japan 5 Switzerland 5 Denmark 4 Singapore 4 Ireland 3 Lithuania 3 Malaysia 2 Norway 2 Romania 2 Poland 2 Hungary 2 Israel 1 South Africa 1 Mexico 1 Puerto Rico 1 Bulgaria 1 Czechia 1 Russian Federation 1 Indonesia 1 Sweden 1 Philippines 1 In 2022, we received different types of legal requests for information, including Grand Jury Subpoenas, Summons, Preservation Orders, Information Subpoenas, and Certifications of Trustee in Bankruptcy.
2022 received requests types Type of Data Request Number received Law Enforcement Request 530 Regulator/Consumer Protection Request 505 Takedown Request 343 Information Subpoena 130 Grand Jury Subpoena 91 Temporary Restraining Order 76 Court Order 57 Request Improperly Routed through Legal Access Portal 51 Buyer Complaint 36 General Email Contact 25 Search Warrant 20 Consumer Complaint 18 Summons 16 Preservation Order 16 Injunction (Preliminary or Permanent) 4
Information on Active Monthly Users for purposes of the Digital Services Act
The Digital Services Act (DSA) creates new obligations for certain digital service providers within the European Union (EU). Among these obligations, Article 24(2) of the DSA requires providers of ‘online platforms’ and ‘online search engines’ to publish ‘information on the average monthly active recipients of the services’ in the EU. This information is used to determine whether an online platform is a ‘very large online platform’ (VLOP), meaning it reaches an average of at least 45 million users per month in the EU.
Shopify does not operate ‘online search engines’ or ‘online platforms,’ as those terms are defined by the DSA. To the extent that any of Shopify's offerings may be considered 'online platforms' under the DSA, we concluded that during the period 1 July 2022 to 31 December 2022, the average number of monthly active recipients of those services in the EU was well below the 45 million user threshold for being designated as VLOPs.
We will continue to monitor the number of average monthly active recipients of any potentially relevant services in the EU, and publish updated information in accordance with Article 24(2) of the DSA.