Shop Campaigns privacy law compliance

The following information is made available to help you understand and fulfill your obligations under applicable United States state privacy laws. These laws give residents of their states more control over their personal information, and also require you to make certain disclosures about how you collect and use personal information. If your website is available to residents of those states, or you're involved in the collection, processing, sale, or sharing of their personal information, then these laws might be applicable to you. This is informational only, and Shopify can’t give you legal advice. If you have any further questions, then consult a local lawyer or privacy professional.

Respecting customer opt-outs

Under certain United States state privacy laws, customers must be able to opt out of the "sale" or "sharing" of their personal information used for targeted advertising in or by your store.

To manage customer opt-outs related to your use of post-purchase ads, you must implement a data sales opt out page and a cookie banner that uses the Customer Privacy API. These tools allow you to surface notice and opt-out, and exclude customers who have opted out of certain "sale" or "sharing" of their information for targeted advertising in your store that Shopify provides. Shopify is unable to accept opt-out signals from cookie banners set up using other methods.

Learn how to implement the Customer Privacy API.

Personalized and contextual advertising

Post-purchase ads use the shopify_pay cookie to identify the relevant Shop Pay users to display personalized offers to. Before you activate post-purchase ads, review your privacy policy, cookie policies, and applicable laws to ensure that your policies are sufficient to permit such use.

Where non-personalized offers are displayed, Shopify uses information from your customer’s transaction, such as shopping cart information, to provide contextual advertising.

Reviewing your privacy policy

After you review legal requirements for each state that you do business in, ensure that your privacy policy contains the required information, you have implemented any necessary opt-outs, and that your customers have adequate notice of your policy and any changes that you make to offer post-purchase ads. This includes, but isn't limited to, how you use, share, sell, or disclose personal information as defined by United States state privacy laws.