Shopify now processes customer data erasure requests 5 days after submission, cut from 10 days, according to a developer changelog entry dated November 11.
If you run a high-ticket store, that leaves you five days, not ten, between a customer’s erasure request and the moment Shopify wipes their name and address. I track platform changes like this for store owners at Ecommerce Paradise, and this one touches open deposits, chargeback evidence and every other tool that still holds the same customer.
It also follows a week of customer data news, including the Nitori breach I covered earlier today. Below you get what Shopify posted, how the window shrank from 180 days in March, what a 5-day clock does to disputes and pre-orders, and five steps to finish before Black Friday. If you are still picking a business model, start with my guide to what high-ticket dropshipping is.
Erasing a customer in Shopify does not clean your email list. Shopify’s help center says other companies you shared data with are your job, so run your store email from a platform where you can find a profile and delete it. Set up your store email with Klaviyo →
Shopify Erasure Requests Now Process in 5 Days, Down From 10
According to Shopify’s developer changelog entry published November 11, erasure requests are no longer held in a pending state for 10 days. They now process 5 days after submission, regardless of when the customer’s most recent order was placed.
The entry says the change applies as of November 10, 2026. Shopify’s stated reason is that it “simplifies the overall experience for managing customer data requests.” One exception remains. If the customer is the recipient of a gift card scheduled to send, the request stays pending until the gift card is delivered.
The entry is short. It is tagged Platform and Update, it does not say whether merchants, apps or both are affected, and it lists no required action.
Shopify’s help center page on customer data requests shows how the tool works. You open the customer’s profile, choose More actions, then Erase personal data. Shopify processes the erasure for you. It erases personal data such as name and address, while what was sold and the date and time of the sale stay visible in your admin. The page says the erasure applies to your store and to any apps and channels you have installed.
The same page gives you 5 days after submitting to cancel a pending request. For requests submitted through the admin, only users in your store can cancel. For customers with pre-orders or subscriptions, remaining payments are not charged and subscription contracts are canceled. If the customer has not paid the remaining amount before you submit the request, the page says you take the loss on those partial sales.
Two more details matter for your stack. The help center says you must contact any other companies you have shared the customer’s personal data with, and it calls that your responsibility. Shopify’s app privacy compliance documentation covers the app side. It says App Store apps subscribe to a customers/redact webhook, that Shopify sends it 5 days after the deletion request, and that the app must complete the requested action within 30 days of receiving it.
That documentation does not say whether its 5-day figure was updated for this change. Treat it as the current number, not as a confirmed timeline.
From 180 Days to 5: How Shopify Shortened Erasure Since March
This is the second cut this year. Per Shopify’s March 23 changelog entry, erasure requests used to stay pending for 180 days after the customer’s most recent order. From March 23, they processed 10 days after submission. From November 10, they process after 5.
That is 180 days down to 5 in under eight months, a 97% reduction. Both entries keep the same gift card exception.
Merchant control has moved the other way in one case. A May 31, 2025 changelog entry says erasure requests started by partner apps can only be cancelled by whoever started them, so merchants cannot cancel them in the admin. Since GraphQL Admin API version 2024-01, Shopify’s Customer Data Erasure API has let merchants queue and cancel requests through two mutations, customerRequestDataErasure and customerCancelDataErasure.
Shopify has tightened app rules twice this month. Its November 5 changelog required IP allowlists for public apps, which I covered in Shopify delists apps without IP allowlists Nov. 20. A November 11 entry extends the requirement to custom apps installed on stores outside the owning organization, with new installs affected from November 20 and existing installs from January 1, 2027. My earlier post on the Jan. 1 app token deadline covers another change on the same calendar.
The law sets much longer clocks. The UK Information Commissioner’s Office says you must respond “without undue delay and within one month of receipt” of an erasure request, per its right to erasure guidance. California’s attorney general page on the CCPA gives businesses 45 calendar days to respond, with a possible 45-day extension.
Neither right is absolute. The ICO says the right does not apply where you must process data to comply with a legal obligation or to establish, exercise or defend legal claims. California lists exceptions for legal obligations, completing a transaction and certain warranty or product recall purposes. The help center describes no step where Shopify weighs those exceptions for you.
What a 5-Day Erasure Clock Does to Chargebacks and Deposits
Opinion from here. My read is that this change is small on paper and real in practice. It turns a decision you used to have weeks to make into a decision you have about one work week to make, and a high-ticket order carries more that depends on the customer’s file.
Start with disputes. According to Stripe’s dispute documentation, card networks typically allow cardholders to start a dispute within 120 days of the original payment, with more time in some situations. After a chargeback is created, merchants usually get 7 to 21 days to respond, and issuers usually take 60 to 75 days to decide. A 120-day dispute window is 24 times longer than a 5-day erasure clock.
Here is a hypothetical to show the shape. A buyer orders a $3,200 patio set. It is delivered on day 20. On day 30 the buyer submits an erasure request, and Shopify processes it on day 35. On day 70 the buyer’s bank opens a dispute, well inside the typical 120-day window. By then Shopify has erased the buyer’s name and address from the order, while what was sold and when it sold are still there.
Your carrier’s delivery proof sits in the carrier’s system. The link between that proof and a named person on your side is the part Shopify erased. I cannot tell you how an issuer would weigh that, so ask your processor before you need the answer.
The fix is boring. Save the evidence packet before day 5, not after the dispute arrives. My chargeback prevention guide for high-ticket stores covers the habits that stop disputes early, and my post on service disputes in contested chargebacks is worth a read before Black Friday.
If you want a vendor in the loop on fraud and chargebacks for your Shopify store, ClearSale is the one I point store owners to.
Now deposits. Say you sell a $3,200 spa with $1,000 paid up front and $2,200 due at delivery. If that flow counts as a pre-order under Shopify’s rule and the customer submits an erasure request before paying the balance, the help center says the remaining amount is not charged and you take the loss on the partial sale. Shopify’s page names pre-orders and subscriptions, so I would not assume a deposit flow from another app behaves the same way. My comparison of Shopify pre-order apps is a good place to see how stores structure staged payments, and your app’s support team can tell you which rule applies.
Then your other tools. Shopify erases inside Shopify and, per its help center, inside installed apps and channels. Your email platform, helpdesk, reviews app, 3PL and shared spreadsheets may hold the same name and address. If that customer then gets a Black Friday email, the erasure looks like it never happened. That is the real exposure, and it is a trust problem more than a legal one.
Klaviyo’s help center article on GDPR and CCPA requests says deleting a profile cannot be undone, redacts identifying information in event history and lets you keep a record of the request. Fulfillment partners deserve the same question. Neither Shopify page I reviewed says what happens inside a 3PL’s own system, and my 3PL performance metrics post lists what to track after you outsource. Data handling belongs on that list.
Keep the tax side separate. The IRS says the default period to keep income tax records is 3 years, and longer in some cases, per its record keeping guidance. Your invoices and payment records should live in your bookkeeping system, not only in a Shopify customer field. My guide to the Shopify and QuickBooks integration covers the options. I am not a lawyer or an accountant, so settle your retention rules with one.
Now the counterpoint. Shopify lists no required action, and a store that gets one erasure request a year may never feel this. Shopify also does not say whether the 5-day cancel window closes the moment processing starts. I would treat day 4 as the deadline and plan around that.
Fewer tools make every request faster. That is my argument for a short stack. If you would rather have a team build and run a lean one for you, the turnkey done-for-you service is the route.
Want a second set of eyes on your store’s data and dispute workflow before Black Friday? Get the coaching details →
Five Steps to Finish Before Black Friday Orders Start Landing
Here are five steps, in order. None of them needs a developer.
- Write your retention rule. Decide which records you keep after a customer asks for erasure, and for how long. Invoices, tracking, delivery proof and order notes are the usual candidates. Keep the financial side in bookkeeping software such as QuickBooks, and ask your attorney or CPA to confirm the periods.
- Save an evidence packet at delivery. Put the order summary, invoice, carrier tracking, signed delivery proof and customer emails in one folder per order. Keep that folder in a business account, such as the shared docs that come with Google Workspace, not on a personal laptop. Shopify erasing the name and address on the order will not touch the copy you saved, and step 1 tells you whether you may keep it.
- Put a day-4 check on every erasure request. When one comes in, look for open orders, unpaid balances, pending disputes and subscriptions. If a request should not go through, cancel it from the customer’s profile before day 5. That works for admin-submitted requests only.
- Map where else the customer lives. List every tool with customer data and write down how each one deletes. Start with your email platform, your helpdesk such as Gorgias, your reviews app, your 3PL and any export your assistant keeps. If you hire help through OnlineJobs.ph, put data deletion in the written handoff and give each person their own login.
- Tell customers how to ask. Make sure your privacy policy says how a customer requests erasure and who reads that email. If you need a policy, Termly is the compliance tool I would look at first. Then test the whole path once with your own email address and a test order.
Two more tools hold customer records, so they belong on your map. My Zendesk pricing breakdown covers one helpdesk option, and my HubSpot free setup guide covers a CRM. A reviews app also holds names and emails, as in my Judge.me review.
If you want a hand mapping your stack, start with my discovery page. For a wider look at protecting customer records, my guide to protecting high-ticket stores from cyber threats is the place to go next.
Frequently Asked Questions
How long does Shopify take to process an erasure request now?
Five days after submission, according to the changelog entry dated November 11, effective November 10. It was 10 days after March 23 and 180 days before that. Requests tied to scheduled gift cards stay pending until delivery.
Can I cancel an erasure request?
Shopify’s help center gives you 5 days after submitting, and for admin-submitted requests only users in your store can cancel. A May 2025 changelog entry says merchants cannot cancel requests started by partner apps.
What does erasure remove from my orders?
Personal data such as name and address, per the help center. What was sold and the date and time of the sale stay visible in your admin.
Do I have to erase data whenever a customer asks?
It depends on where the customer lives and which law applies. The ICO and California both list exceptions, including legal obligations, so confirm with an attorney before you cancel or speed up a request. I am not a lawyer.
Does the CCPA apply to a small store?
The California attorney general’s page says it covers for-profit businesses that do business in California and meet any one of three tests: revenue above $25 million, handling the personal information of 100,000 or more California residents or households, or earning 50% or more of revenue from selling that information. Many small stores sit below those lines, but Shopify’s tool takes a request from any customer and other laws differ.
Does Shopify erase my customer’s data in Klaviyo and my other tools?
Shopify says erasure applies to installed apps and channels and calls contacting other companies your responsibility. I could not confirm which installed apps act on a request automatically, so check each one. Klaviyo’s help center explains how to delete a profile.
I am still choosing a niche. Does this matter yet?
It matters from your first order, because data handling is easier to build in than to bolt on. Start with my free high-ticket niches list.
Black Friday brings orders, disputes and data requests in the same week. Want my team to scale the store you already have? See the scaling service →
I wish you guys the best of luck out there. If you want to work through your setup with other store owners and me, the Skool community starts with a 7-day free trial, then it is paid. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.
Related Articles
If this was useful, these go deeper:
- How to Protect High-Ticket Ecommerce Stores From Cyber Threats
- Chargeback Prevention for High-Ticket Stores: Stopping Disputes Before They Cost You
- Shopify Delists Apps Without IP Allowlists Nov. 20
- Nitori Breach May Expose 37.6M Customer Records
- Shopify Pre-Order Apps in 2026: 5 Apps Compared by Price and Fit
Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.
He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.
