There is no published study that answers "what percentage of Shopify stores have a privacy policy" with a clean number, because no organization has run that audit at scale. What is verifiable, as of February 2026, is the size of the store base itself, 2,846,874 actively trading stores per Store Leads, and the exact legal text in Shopify's Merchant Terms of Service that makes a privacy policy mandatory for a large share of them. The rest of this page walks through what is actually documented, and why the obvious-sounding question does not have a clean answer.
How many Shopify stores actually exist in 2026?
Two trackers answer this differently because they count different things. BuiltWith's technology detection tool found 6,903,597 domains running Shopify's tech stack as of February 2026, a figure its own methodology notes includes test stores, parked domains, and abandoned installations alongside working businesses. Store Leads, which verifies stores weekly against DNS and storefront signals, counted 2,846,874 stores it classifies as actively trading, a filter meant to isolate real merchants from the much larger pool BuiltWith detects.
Figure 1: BuiltWith counts every detectable Shopify installation; Store Leads filters to stores that look like real, trading businesses. Sources: BuiltWith technology tracker (February 2026), Store Leads store index (February 2026).
Neither number is wrong. They are measuring different populations, the same pattern that shows up whenever two independent trackers count the same underlying activity with different filters. Treat 6.9 million as the outer bound of anything that has ever run Shopify's code, and 2.85 million as the closer estimate of stores actually selling to customers today.
Does Shopify legally require merchants to have a privacy policy?
Yes, but the requirement is not universal in the way the content-plan question implies. Shopify's Merchant Terms of Service, Section 9.2.5, states that merchants receiving Enhanced Services, a category that includes Shopify Payments, Shop Pay Installments, and several other built-in tools, are "required to include a link to Shopify's Consumer Privacy Policy in your privacy policy, and to post a link to your privacy policy prominently in your Store." Section 4.3 separately requires every merchant, regardless of which services they use, to "comply with all applicable laws, rules, regulations, and rights of third parties," which functions as an indirect privacy policy requirement in any jurisdiction where GDPR, CCPA, or a comparable law already mandates one.
Figure 2: The two contract paths that make a privacy policy mandatory for a Shopify merchant. Source: Shopify Merchant Terms of Service, Sections 4.3 and 9.2.5.
Shopify Payments is the default payment processor offered to new stores in supported countries, which means the Enhanced Services clause reaches a large share of active merchants in practice. Shopify does not publish what share of its 2.85 million active stores actually use Enhanced Services, so this page reports the contract text rather than an estimated compliance rate. Merchants closing this gap can generate a privacy policy built for e-commerce data collection that covers payment processing, order data, and marketing consent in one document.
How does this compare to privacy policy adoption on the rest of the web?
No Shopify-specific audit exists, but general web research gives useful context for how far self-reported requirements typically diverge from measured reality. A Princeton and KU Leuven study of 9.6 million archived homepages found a detectable privacy policy link on 37.2% of top-1,000-ranked sites, falling to just 9.6% for sites ranked below 1 million; see our full breakdown of how many websites have a privacy policy for the complete rank-tier data. That study did not isolate e-commerce platforms or Shopify stores specifically, so it cannot be read as a Shopify compliance rate. It does establish that a legal requirement and an actual published policy are two different things almost everywhere researchers have measured the gap.
Figure 3: Apparel is the single largest active-store category, but no category tops even a third of the total. Source: Store Leads store index, February 2026.
The category mix matters for privacy exposure specifically because apparel and beauty stores collect more sensitive data by default, sizing information, health and fitness data, and repeat purchase history, than a typical dropshipping storefront selling a narrow product line. A store's product category does not change what Shopify's contract requires, but it does change how much regulators in a state like California, which has its own retail-specific enforcement history, are likely to scrutinize the store's actual privacy disclosures.
Where are Shopify's active stores located, and why does that matter for privacy law?
Store location determines which privacy law actually applies, and Store Leads' country breakdown shows the exposure is concentrated in a small number of jurisdictions. The United States accounts for roughly 2.67 million of the 2.85 million actively trading stores Store Leads counted in February 2026, with the United Kingdom, Australia, Germany, and Canada making up most of the rest.
| Country | Active Shopify stores | Share of global total |
|---|---|---|
| United States | 2,670,000 | 39% |
| United Kingdom | 193,000 | 3% |
| Australia | 120,000 | 2% |
| Germany | 85,000 | 1% |
| Canada | 75,000 | 1% |
Source: Store Leads store index, February 2026.
A US-based store selling only to US customers is not directly bound by GDPR, but a US store shipping internationally, or a German store selling into the EU single market, faces a different and stricter privacy policy bar than Shopify's own Merchant Terms describe. Store location is the variable that turns Shopify's general "comply with applicable law" clause into a specific, enforceable requirement.
Does the Shopify App Store require apps to have a privacy policy?
Yes, and this requirement is considerably more explicit than the merchant-level one. Shopify's official app requirements checklist for developers lists a privacy policy as required for any app listed in the Shopify App Store, reinforced in the checklist's data-and-user-privacy section, which expects listed apps to disclose their data practices transparently. Merchants who install third-party apps for reviews, upsells, or marketing are therefore relying on a Shopify-enforced app-level requirement that is separate from, and stricter than, the store-level clause covering the merchant's own storefront.
Figure 4: Shopify stopped publishing exact merchant counts after 2018, which is why every current figure comes from a third-party tracker rather than Shopify itself. Sources: Shopify Q4 2015 press release, Shopify 2017 shareholder letter.
The app-level requirement being clearer than the store-level one is not an accident of drafting. Shopify directly controls what gets listed in its App Store and can reject a submission that omits a privacy policy link before it ever reaches a merchant. Shopify does not directly control what a merchant publishes on their own storefront once the store is live, which is exactly why Section 4.3's general compliance clause, rather than a hard technical gate, is doing the enforcement work at the store level.
The Bottom Line
The honest answer to "what percentage of Shopify stores have a privacy policy" is that nobody has published that number, and the two available store-count trackers already disagree with each other by more than 4 million stores before compliance even enters the picture. What is fully documented is the contract text: Shopify's Merchant Terms of Service require a privacy policy from any merchant using Enhanced Services like Shopify Payments, and require every merchant to follow applicable law regardless of which Shopify tools they use, while the Shopify App Store enforces a stricter, pre-publication privacy policy requirement on every listed app. For a merchant deciding whether their own store needs one, the practical test is not Shopify's contract at all, it is whichever privacy law actually applies to where their customers live, and a current, accurate privacy policy is the cheapest way to satisfy both Shopify's terms and that underlying law at the same time.
Frequently Asked Questions
What percentage of Shopify stores have a privacy policy? No independent audit publishes that figure. What is verifiable is that Shopify's Merchant Terms of Service require a privacy policy from merchants who receive Enhanced Services such as Shopify Payments, out of the 2,846,874 actively trading stores Store Leads counted in February 2026.
How many Shopify stores exist in 2026? BuiltWith counted 6,903,597 live Shopify installations in February 2026, while Store Leads counted 2,846,874 stores it classifies as actively trading real merchants, filtering out test stores and parked domains.
Does Shopify legally require merchants to have a privacy policy? Shopify's Merchant Terms of Service, Section 9.2.5, requires merchants who receive Enhanced Services, which includes Shopify Payments, to post a link to their own privacy policy prominently in their store. Section 4.3 separately requires every merchant to comply with all applicable laws, which functions as an indirect privacy policy requirement anywhere GDPR, CCPA, or a similar law applies.
Does the Shopify App Store require apps to have a privacy policy? Yes. Shopify's official app requirements checklist lists a privacy policy as required for any app listed in the Shopify App Store, separate from the store-level requirement that applies to merchants.
Where the Numbers Come From
- Shopify. "Shopify Merchant Terms of Service." Section 4.3 general legal compliance clause and Section 9.2.5 Enhanced Services privacy policy requirement, current as of July 2026.
- Shopify. "App Requirements Checklist." Privacy policy listed as required for Shopify App Store listing, current as of July 2026.
- BuiltWith. Shopify technology usage tracker. 6,903,597 live installations detected, snapshot dated February 2026.
- Store Leads. Shopify store index. 2,846,874 actively trading stores, country and category breakdowns, snapshot dated February 2026.
- Amos, R., Acar, G., Lucherini, E., Kshirsagar, M., Narayanan, A., and Mayer, J. (2021). "Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset." Proceedings of WWW '21. General web detection rates of 37.2% and 9.6% cited for comparison, not specific to Shopify or e-commerce.
Note: All figures verified as of July 2026. Third-party store counts from BuiltWith and Store Leads change continuously and are not audited by Shopify itself; the 2015 to 2018 figures are Shopify's own last published disclosures before the company stopped reporting a precise merchant count. Figures are refreshed at least twice a year as newer tracker snapshots become available.
