Does my Shopify or online store need a privacy policy in Canada?

Online stores collect more personal information than founders expect: every checkout, every abandoned cart, every pixel firing on a product page. That makes the privacy policy one of the store’s working documents, not a footer formality.

Does a Shopify store legally need a privacy policy?

Yes, in practice. PIPEDA applies to personal information collected in the course of commercial activities (s. 4), and its openness principle requires you to make information about your practices readily available. Quebec’s private sector act requires anyone who collects personal information through technological means to publish a privacy policy on their website (s. 8.2). See do I need a privacy policy in Canada.

What does Shopify require?

Shopify’s Terms of Service (section 4) require merchants to provide public-facing contact information, terms of service, a refund policy and shipping policies, including order fulfilment timelines, and say contact information should include your name, address, telephone number and email. Merchants who receive what Shopify calls Enhanced Services must also link to Shopify’s Consumer Privacy Policy in their own privacy policy, post a link to their privacy policy prominently in the store, and disclose that Shopify collects and processes customers’ personal data. Shopify’s policy templates are described as informational only and not legal advice.

Stripe’s website checklist lists a privacy policy, customer service contact details, and refund, return, shipping and cancellation policies.

What should an online store’s privacy policy cover?

Topic	What to say for a store
What you collect	Name, shipping and billing address, email, phone, order history, account details, reviews, support messages, device and browsing data
Payments	That card details are handled by your payment processor, and what you receive back from it
Apps and integrations	Categories of apps that receive customer data: email marketing, reviews, subscriptions, loyalty, shipping, fraud prevention, customer support
Advertising and analytics	Pixels and tags, such as Meta, Google, TikTok or Pinterest, what they collect and how to opt out
Marketing emails and texts	What people sign up for, and how to unsubscribe
Where data goes	That your platform and apps may store or process data outside Canada, and outside Quebec
Retention	How long you keep order and account records, and why
Access and contact	How to request a copy of their information or correct it, and who to contact

The full list is in what a Canadian privacy policy must include.

Do I need a cookie banner for my store?

Possibly. The Privacy Commissioner’s online behavioural advertising guidelines accept opt-out consent for ad tracking only where notice is clear and prominent and the opt-out is easy and persistent, and not for sensitive information. Quebec requires you to tell people first about technology that can identify, locate or profile them and how to activate those functions (s. 8.1). Stores selling health, wellness or children’s products should be especially careful with ad pixels. See do I need a cookie banner in Canada.

Can I send abandoned cart and marketing emails?

That’s a CASL question, separate from the privacy policy. A purchase within the past two years creates an existing business relationship that gives implied consent to send commercial messages (CASL s. 10), and an inquiry gives implied consent for only six months. An abandoned cart isn’t a purchase, and whether it counts as an inquiry is open to argument, so the safer course is to collect express consent at checkout with an unticked box and keep the record. See CASL for SaaS and e-commerce and the CASL consent checker.

What else does a store need?

• Terms and conditions of sale: for Ontario consumers, the internet agreement rules require prescribed disclosures before the sale, an express opportunity to accept or decline and correct errors, and a copy within 15 days, where the consumer could pay more than $50 (Consumer Protection Act, 2002, ss. 37 to 40). See consumer protection rules for online terms.
• Refund and shipping policies, consistent with your terms and with what customer service actually does.
• Health or wellness products: claims and labelling rules apply. See health claims advertising.

What to do next

We prepare privacy policies and terms of service for online stores, matched to the apps and pixels you actually use, at fixed fees on our fees page. Selling on social platforms too? See selling on social platforms in Canada.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To check your store’s policies, book a free 15-minute consult.