The short version of ecommerce customer data rules for a small store is this. Collect only what you need to fulfill orders and run the business. Tell customers in a privacy policy what you collect and why. Keep the data secure and limit who can see it. Respond to requests to see or erase personal data. Send marketing email only in line with the email laws that apply to you and your customers, with a working unsubscribe. Which specific laws apply depends on where you and your customers are and on the size of your business, so confirm the details with a qualified professional. This article is general information, not legal advice.
If you have just moved from a marketplace, this is one of the biggest quiet changes. The platform used to hold most of your buyers' data. Now you do.
Last checked: 2026-10-02, on Shopify's help center and the US Federal Trade Commission's website. Privacy and email rules change and differ by country and state. Confirm current requirements before you rely on any of this.
Why this is new if you came from a marketplace
On a marketplace, buyer data mostly lives inside the platform. You see what you need to ship an order, and the platform's own rules govern what you may do with it. On your own store, the customer's name, email, address, order history and marketing choices sit in your admin, under your control.
Shopify's help center page on processing customer data requests (checked on 2026-10-02) puts the responsibility plainly: as a Shopify merchant, you are responsible for complying with the privacy and data protection laws and regulations that apply to your business. The platform gives you tools. The obligations are yours.
That is not a reason to be nervous about owning customer data. It is a reason to handle it on purpose.
Ecommerce customer data rules for a small store: map what you hold first
Before you can follow any rule, you need to know what data you have. Most small stores have never written this down. A one-page data map answers five questions for each kind of data.
| Question | Example for email addresses |
|---|---|
| What do you collect? | Customer email address |
| Why do you need it? | Order confirmations, shipping updates, and marketing for those who agreed |
| Where is it stored? | Store admin, email marketing app, accounting software |
| Who can access it? | You, plus any staff or contractors with admin access |
| How long do you keep it? | Your decision, informed by your legal and tax record-keeping needs |
Do the same for names, shipping addresses, phone numbers, order history, payment details, and any data your analytics or advertising tools collect. The "where is it stored" column is usually the surprise. Data spreads into every app you connect.
This map is the foundation for everything below. It tells you what your privacy policy has to describe, what you need to secure, and where to go when a customer asks you to delete their data.
What you may collect
A practical rule that fits many privacy frameworks: collect what you need for a clear purpose, and no more.
- To fulfill an order, you need a name, a delivery address, a way to contact the buyer, and payment. Payment details are normally handled by your payment provider rather than stored in your store.
- To run the business, you need order records for bookkeeping and tax. Ask your accountant how long to keep them.
- For marketing, you need the person's agreement in whatever form the law where they live requires.
Fields you add "just in case," such as a birthday or phone number you never use, are data you now have to protect and explain. If you do not use it, consider not asking for it.
What you must tell customers
Customers should be able to find out what you collect, why, who you share it with and how to contact you about it. That is the job of a privacy policy. Many privacy laws expect one, and the details they require vary by jurisdiction.
Two habits matter more than the wording:
- Make the policy match reality. A template that describes tools you do not use, or misses ones you do, is a problem. Your data map is the source for what goes in it.
- Update it when your setup changes. Adding an email app, a review app or an advertising pixel changes what you collect and who you share it with.
A clear, findable privacy policy also helps a new store earn trust, which a marketplace used to lend you. That wider job is covered in trust signals the marketplace supplied, and how to rebuild them.
How to store it
Security is mostly about access and habits:
- Give each person who works on your store their own login, with only the permissions they need.
- Use two-step authentication on every account with access to customer data, including your email marketing and accounting tools.
- Remove access as soon as someone stops working with you.
- Do not copy customer lists into personal spreadsheets, shared drives or chat messages unless you have a clear need and know where those copies end up.
- Review installed apps and remove any you no longer use, since each one may hold or access customer data.
When a customer asks to see or erase their data
Some privacy laws give people the right to access or delete the personal data a business holds about them. Whether those laws cover your store depends on where your customers are and your business's size. Either way, it helps to know how your platform handles it.
According to the same Shopify help center page (checked on 2026-10-02), you can erase a customer's personal data from the admin by opening Customers, selecting the customer, then choosing More actions and Erase personal data. The page says personal identifiers such as the name and address are redacted, while details of what was purchased and when stay visible in your admin. The request is also sent to apps and channels you installed from your Shopify admin, and you have 10 days to cancel it after you submit it.
The same page adds one important line: it is your responsibility to contact any other companies you have shared the customer's personal data with. That is where your data map pays off. If an email address also lives in a separate email platform or a spreadsheet, the erasure in Shopify does not reach it.
What you may email
Email is where most small stores meet data law day to day.
In the United States, the Federal Trade Commission's CAN-SPAM Act compliance guide for business (checked on 2026-10-02) says the law covers all commercial messages, not only bulk email. Among its requirements, the guide lists accurate header information, subject lines that are not deceptive, identifying the message as an advertisement, a valid physical postal address, a clear and conspicuous way to opt out, and honoring opt-out requests within 10 business days. It also says you remain responsible when you hire another company to handle your email marketing. At the time of writing (October 2026), the guide states that each separate email in violation of the law is subject to penalties of up to $53,088.
That covers US law only. Other countries have their own rules, and some require a person's clear agreement before you send them marketing at all. If you sell internationally, check the rules where your customers are with a qualified professional.
The safest working habit for a small store, wherever you sell: send marketing only to people who chose to receive it, record when and how they signed up, and make leaving the list easy. How to build that list from the start is covered in an email list from zero: the first 90 days.
Marketplace buyers are a separate question
Buyers who bought from you on a marketplace are not automatically your email list. Their data came to you under the marketplace's rules, and those rules govern what you may do with it, alongside the law.
I could not read Etsy's help and policy pages on the day I checked, so this article does not state what Etsy allows. Before you contact any marketplace buyer outside the platform, or invite them to your store, read the marketplace's current seller policies on its own site. The broader question of how buyers find a store after a marketplace is covered in where your customers come from after you leave a marketplace.
A data checklist for a small store
- I have a one-page map of what customer data I collect, why, where it is stored, who can access it and how long I keep it.
- My privacy policy matches that map and is easy to find.
- Every person with access has their own login and only the permissions they need.
- Two-step authentication is on for my store, email and accounting accounts.
- I know how to process an erasure request in my store, and which other tools I would need to update by hand.
- I send marketing only to people who agreed, with a working unsubscribe and my postal address.
- I have checked the marketplace's current rules before contacting any buyer from it.
- I have asked a qualified professional which privacy and email laws apply to my store.
When to get professional advice
Get advice when you start selling to customers in another country, when you add tracking or advertising tools, when you handle sensitive data or sell to children, or when a customer or regulator raises a complaint. A short consultation with a privacy professional is a small cost next to getting this wrong.
FAQ
What customer data can a small online store collect?
Collect what you need for a clear purpose: the details required to fulfill and support an order, records for bookkeeping and tax, and marketing data only from people who agreed. Which laws apply depends on where you and your customers are.
Do I need a privacy policy for a small ecommerce store?
Many privacy laws expect a business that collects personal data to explain what it collects, why and who it shares it with. Make your policy match what your store actually does and confirm requirements with a qualified professional.
How do I delete a customer's data in Shopify?
Shopify's help center says to open Customers, select the customer, then choose More actions and Erase personal data. Order details stay visible, and you must contact any other companies you shared the data with yourself.
Can I email customers who bought from me?
In the US, the FTC's CAN-SPAM guide sets requirements for commercial email, including a clear opt-out honored within 10 business days. Other countries may require prior agreement. Sending marketing only to people who opted in is the safest habit.
Can I add my Etsy buyers to my email list?
Check Etsy's current seller policies on its own site before you contact any buyer outside the platform. Their data reached you under the marketplace's rules, which govern how you may use it.