Quick Answer: What does a Shopify store selling to Brazil need to do?
A foreign Shopify store can fall within Brazil's LGPD when processing is aimed at offering or providing goods or services to people located in Brazil, relevant processing occurs in Brazil, or personal data is collected from a person located in Brazil. Compliance is not achieved simply by using Shopify. The merchant should map the customer journey, identify purposes and legal bases, configure privacy and cookie controls, review apps and processors, document international transfers, provide a clear privacy notice, support data-subject rights, maintain security and incident procedures, and control retention and deletion.
Key Takeaways
- Foreign Shopify merchants can be subject to the LGPD. Headquarters location alone does not decide scope.
- Shopify provides privacy tools, not an automatic compliance result.
- Every app expands the data map.
- Checkout data and advertising data are different purposes.
- Pixels need technical control, not just a banner.
- Customer rights extend beyond the Shopify customer profile.
- International transfers require a Brazil-specific analysis.
Does the LGPD Apply to a Foreign Shopify Store?
Potentially, yes. Article 3 of the LGPD applies regardless of where an organization is headquartered or where the data is physically located when one of the statute's territorial triggers is met.
For a foreign Shopify merchant, the most commercially important trigger is often Article 3(II): processing whose purpose includes offering or providing goods or services to individuals located in Brazil, or processing personal data of individuals located in Brazil. Article 3(III) also covers personal data collected in Brazil, and the law says data is considered collected in Brazil when the data subject is located there at the moment of collection.
A store that deliberately sells to Brazil—Brazilian shipping, Portuguese-language content, BRL pricing, Brazil-targeted advertising or other local commercial activity—should assess LGPD applicability instead of assuming that a foreign corporate address keeps it outside the law.
Map the Entire Shopify Customer Journey
A typical Shopify privacy flow
Visitor → Cookies / Pixels → Product View → Cart → Checkout → Payment → Order → Shipping → Customer Account → Email / WhatsApp → Reviews / Loyalty → Support → Analytics / Remarketing → Retention / Deletion
Each stage can involve different data, purposes, recipients and legal bases. A practical processing map for a Shopify store can include:
| Stage | Typical data | Main LGPD question |
|---|---|---|
| Store visit | IP address, device/browser data, cookies, session identifiers. | Which technologies are necessary, analytical or advertising? |
| Product/cart | Viewed products, cart contents, session activity. | Is the data required for the shopping experience or used for optional profiling? |
| Checkout | Name, address, email, phone, order information. | Which fields are genuinely necessary to fulfill the order? |
| Payment | Payment metadata, transaction identifiers, fraud signals. | Who controls each payment/fraud purpose and what data is retained by the merchant? |
| Shipping | Name, address, contact details, order details. | Which carrier or fulfillment provider receives the data and why? |
| Marketing | Email, phone, purchase history, audiences, pixel events. | Consent, legitimate interest, transparency and opt-out by purpose/channel. |
| Apps | Potentially customer, order or behavioral data exposed to the app. | Role, purpose, permissions, security, subprocessors and transfers. |
| Support | Tickets, messages, attachments, order/account details. | Retention, sensitive information, vendor access and rights handling. |
Who Is the Controller: The Merchant or Shopify?
Do not reduce the answer to one universal label. Under Article 5, the controller makes decisions about the relevant processing and the operator processes personal data on behalf of the controller. Roles should be assessed per processing operation.
For many store-level activities, the merchant determines why it wants to collect customer information—for example, to fulfill orders, run customer service or send marketing. Shopify's current Data Processing Addendum governs customer-data processing under Shopify services and states that merchants are responsible for required notices, rights or permissions, and customer-rights handling for processing in which the merchant is the controller.
Shopify's own documentation also shows why the analysis should not be oversimplified: some additional or enhanced services can involve different role allocations. Read the current Terms and DPA for the services actually enabled and map each purpose rather than writing “Shopify is always our processor.”
For a deeper framework, read LGPD Vendor Compliance: What to Check Before Using a Processor.
Use Shopify's Privacy Settings—But Verify Them
Shopify currently provides a Customer privacy area where merchants can configure privacy-related settings by country or region. Its Help Center says merchants can manage a privacy policy, cookie banner, data-sharing opt-out settings and related privacy features.
Shopify also tells merchants to review whether default privacy content and settings accurately reflect their business operations and third-party integrations. That is exactly the right compliance mindset for a Brazil-facing store.
Describe the store's real collection, purposes, vendors, transfers, rights channels and marketing—not merely a generic template.
Configure the appropriate region and ensure consent-dependent technologies actually wait for the applicable choice.
Adding an app can make the existing privacy notice, cookie inventory or transfer map obsolete.
Can you use Shopify's automated privacy policy?
It can be a useful starting point, but it should not replace the data map. Reconcile the policy with actual checkout fields, marketing tools, analytics, installed apps, shipping providers, customer-service platforms and international processing.
See LGPD Privacy Policy Requirements for Foreign Websites.
Shopify Cookies, Pixels and Advertising
Shopify currently provides Customer privacy settings that can be used for cookie banners and regional privacy controls. Its pixel documentation also provides permission settings that can determine whether customer permission is required before a custom pixel collects data for marketing, analytics or preference purposes.
Shopify's app-pixel documentation notes that where a region's privacy settings require consent, the relevant consent should be provided through the cookie banner before the pixel operates under that configuration.
Necessary store functions
Session, security, cart and checkout technologies that are genuinely necessary for the service can present a different analysis from optional advertising technologies.
Analytics
ANPD's cookie guidance allows legitimate interest to be considered in some lower-risk audience-measurement contexts, especially when processing is limited to aggregate patterns or trends without combining multiple tracking mechanisms or constructing user profiles.
Advertising and remarketing
ANPD says legitimate interest is generally harder to justify for advertising cookies involving third-party behavioral profiling, preference prediction or cross-site tracking. Consent may be more appropriate in those situations.
That distinction matters for Meta, Google, TikTok and other advertising integrations. A merchant should identify whether a channel, app or pixel performs basic measurement, conversion attribution, customer matching, behavioral targeting or cross-site remarketing.
Read LGPD Cookie Consent Requirements and LGPD for Marketing Teams.
Checkout, Payment and Order Fulfillment
Core checkout data can often be linked to the customer's requested transaction. Article 7(V) allows processing when necessary for performance of a contract with the data subject or requested pre-contractual procedures. But “contract” is not a blanket basis for everything a merchant later wants to do with order history.
| Purpose | Possible starting analysis | Caution |
|---|---|---|
| Fulfill order | Contract necessity | Use only data needed to perform the purchase. |
| Tax/accounting retention | Legal/regulatory obligation where applicable | Identify the actual retention requirement. |
| Fraud/security | Potential legitimate interest for ordinary data; Article 11 analysis for sensitive data | Do not label biometric or sensitive data as Article 7 legitimate interest. |
| Promotional reuse | Consent or legitimate-interest analysis depending on context | Separate marketing from fulfillment. |
| Behavioral remarketing | Consent may be more appropriate in intrusive tracking contexts | Review pixel settings and audience flows. |
Every Shopify App Is a New Privacy Review
Shopify stores often depend on many third parties: reviews, subscriptions, loyalty, chat, email, WhatsApp, fraud prevention, returns, logistics, search, personalization, analytics and AI.
Before installing an app, determine which permissions it requests; what purposes it performs; whether it acts on your instructions or has independent purposes; whether it uses data for AI/model training or benchmarking; which subprocessors it uses; where data is processed; how it handles incidents; whether it can support access, correction and deletion; and how long data remains after uninstalling.
Email, WhatsApp and Abandoned-Cart Marketing
Shopify customer and order data can make marketing operationally easy, but the LGPD still requires purpose-by-purpose analysis.
Order emails
Receipts, order-status messages and service communications can serve the contractual or operational purpose of the transaction. Do not assume the same basis automatically supports a promotional newsletter.
Abandoned-cart communications
An abandoned-cart email or message should be assessed based on what the person did, what the store disclosed, whether contact is reasonably expected, the selected legal basis and how easily the person can stop further promotional messaging. There is no special “abandoned cart” legal basis in the LGPD.
A phone number collected for shipping or support does not automatically authorize promotional WhatsApp use. Map the new purpose, expected context, legal basis and opt-out.
Customer Data Subject Rights in Shopify
Shopify currently gives merchants tools for responding to customer-data requests. Its Help Center describes a merchant workflow for requesting or exporting customer data and another for requesting erasure of a customer's personal data.
Shopify also warns that merchant responsibility does not end with the platform: if the merchant shared customer data with other companies, the merchant remains responsible for addressing those other recipients where applicable.
Access
A Shopify merchant can request data associated with a customer through the customer profile workflow described by Shopify. For LGPD confirmation or access, the merchant still needs to apply Brazil's requirements and verify the requester's identity proportionately.
Deletion
Shopify's erasure workflow redacts certain customer personal information while some order information can remain visible. This illustrates an important distinction: a customer-data erasure process is not necessarily identical to deleting every order record.
See LGPD Data Subject Rights: Access, Deletion and Correction Requests.
Privacy Notice for a Shopify Store
A useful Shopify privacy notice should cover merchant/controller identity; store and checkout data; purposes and legal bases; Shopify and other providers; payments and shipping; marketing and CRM; cookies and advertising; international processing; retention; rights and request channels; and how the notice is updated.
Do not copy a Shopify-generated policy, add “LGPD” to the title and publish without reviewing the real apps and data flows.
Shopify and International Data Transfers
Shopify states in its current DPA that merchant customer personal data may be transferred and processed in countries where Shopify, its affiliated companies or third-party service providers are located, including countries such as Canada and Singapore. Shopify also publishes information about contracting entities, transfers and subprocessors.
For a merchant subject to the LGPD, that operational reality should feed a separate Article 33 analysis. Resolution 19/2024 provides mechanisms including adequacy, Brazilian Standard Contractual Clauses, equivalent standard clauses recognized by ANPD, specific clauses approved by ANPD and binding corporate rules approved by ANPD.
ANPD's current transfer repository says the European Union has been recognized as adequate under Resolution 32/2026. A merchant should not assume that another country is adequate unless ANPD has actually made that determination or another Article 33 route applies.
Read LGPD International Data Transfers: A Practical Guide for Global Businesses.
Security and Incident Response for Shopify Merchants
Article 46 requires processing agents to adopt technical and administrative security measures. For a Shopify merchant, that means looking beyond Shopify infrastructure and securing the merchant-controlled layer as well.
Examples include strong administrator authentication, least-privilege staff access, controlled app installation, secure staff devices and email, careful handling of exported customer CSV files, incident contacts for key apps, removal of former employees and agencies, and a documented incident assessment process.
See LGPD Data Breach Notification.
20-Point LGPD Checklist for Shopify Stores Selling to Brazil
Common Shopify LGPD Mistakes
“Shopify is compliant, so my store is compliant.”
Platform controls cannot choose your purposes, legal bases, marketing strategy, apps, retention or public disclosures for you.
“Our privacy policy template covers every installed app.”
It may not. Reconcile the notice with actual app permissions, recipients and international processing.
“Checkout consent covers remarketing.”
No blanket rule supports that conclusion. Order fulfillment and behavioral advertising are materially different purposes.
“We added a cookie banner.”
Test whether relevant pixels are actually governed by the choice. Visual disclosure alone is not a technical consent control.
“Deleting the customer profile deletes everything.”
Shopify distinguishes profile deletion from customer-data erasure, and other apps or companies can hold separate copies.
“The store is hosted outside Brazil, so the LGPD does not apply.”
Article 3 can apply based on Brazil-facing offering or data collection regardless of foreign headquarters.
Turn Your Shopify Store Into a Documented LGPD Process
The Brazil LGPD Compliance Playbook — 2026 Edition includes a Data Mapping Worksheet, Processing Inventory / ROPA, Legal-Basis Decision Record, Cookie and Tracking Inventory, Vendor Privacy and Security Review, Data-Subject Request tools, International Transfer Review, Privacy Notice Framework, Retention Schedule, 100-point audit and 30-day implementation roadmap.
Get the Brazil LGPD Compliance Playbook · $47Frequently Asked Questions
Does the LGPD apply to a U.S. Shopify store selling to Brazil?
It can. Article 3 applies regardless of headquarters country when processing is aimed at offering or providing goods or services to individuals located in Brazil or relevant data is collected in Brazil.
Does Shopify automatically make my store LGPD compliant?
No. Shopify provides privacy tools, but merchants still need to configure the store around actual purposes, legal bases, apps, notices, marketing, vendors, rights and transfers.
Does Shopify have privacy-policy and cookie-banner features?
Yes. Shopify's current Customer privacy settings include privacy-policy and cookie-banner functionality and can be managed by region. Merchants should verify that settings accurately reflect actual operations and integrations.
Can Shopify pixels respect consent settings?
Shopify provides pixel permission and Customer Privacy functionality. Its documentation notes that app and custom pixels can depend on regional customer privacy and consent settings. Merchants should test the exact implementation.
Can I use contract as the basis for all Shopify customer data?
No. Contract necessity can support data needed to perform a purchase, but marketing, behavioral advertising and other secondary purposes require their own legal-basis analysis.
Can a Shopify merchant erase customer data?
Shopify provides an erasure workflow. Its documentation says certain personal data can be erased or redacted while some order information remains visible, and the merchant remains responsible for other companies with whom it shared customer data.
Does deleting a Shopify customer profile equal erasure?
No. Shopify expressly distinguishes customer-data erasure from deleting a customer profile.
Do Shopify apps need LGPD review?
Yes. Installed apps can introduce new purposes, roles, permissions, subprocessors, retention, security risk and international transfers.
Does using Shopify create an international-transfer issue?
It can. Shopify states that merchant customer personal data may be transferred and processed where Shopify, affiliates or service providers are located. Brazilian flows should be mapped against Article 33 and Resolution 19/2024.
Is the European Union adequate for Brazil-to-EU transfers?
As of August 2026, ANPD lists the European Union as adequate under Resolution No. 32/2026. Other destinations need their own Article 33 analysis unless another applicable mechanism is available.
Official Sources Used for This Guide
- Law No. 13,709/2018 — LGPD, current compiled text Territorial scope, definitions, principles, legal bases, rights, agents, security and international transfers.
- Shopify — Managing Customer Privacy Settings Current Shopify privacy controls and regional configuration.
- Shopify — Understanding Customer Privacy Settings Privacy policy, cookie banner, sharing controls and regional settings.
- Shopify Data Processing Addendum Merchant notices, permissions, customer rights, security, breaches, service providers and international processing.
- Shopify — Processing Customer Data Requests Merchant export/access and erasure workflows.
- Shopify — Custom Pixel Privacy Settings Permission configuration for marketing, analytics and preference collection.
- ANPD — International Transfers Current Resolution 19/2024 mechanisms and adequacy information.