Shopify has quietly changed how it handles customer erasure requests. Since 10 November, a request to delete a customer's data is processed 5 days after it's submitted, not held for 10. It's labelled as an update rather than "action required", so it's easy to scroll past. But if you've got a custom app or an integration that copies Shopify customer data somewhere else, it's a good excuse to check that the delete actually deletes.
What changed
The changelog entry from 11 November says erasure requests are no longer kept pending for 10 days. They're now processed 5 days after submission, regardless of the customer's most recent order date. There's one exception: if the customer is due to receive a scheduled gift card, the request waits until the gift card has been delivered.
For apps, the request arrives as the customers/redact webhook. Shopify's privacy compliance docs list it alongside two others:
- customers/data_request: a customer wants to see what you hold on them.
- customers/redact: a customer wants their data deleted. Now sent 5 days after the request.
- shop/redact: sent 48 hours after a store uninstalls your app, asking you to delete that shop's data.
Once your app receives a redact request, Shopify's docs say to complete the action within 30 days, unless you're legally required to keep the data. App Store apps must subscribe to all three. The docs are written with public apps in mind, but the underlying obligation isn't Shopify's invention. It's UK GDPR, and that applies to the data whatever kind of app is holding it.
Why a shorter wait matters
On its own, five days instead of ten doesn't change much. The webhook still turns up, your app still has to deal with it. What it does is shorten the gap between a customer asking and your systems being asked to act, which is a sensible moment to ask a slightly awkward question: when that webhook lands, what does your code actually do?
In some custom builds the honest answer is "returns a 200 and nothing else". The endpoint was wired up to get through app review or because a checklist said so, and the handler was left as a stub. Shopify deletes its copy, the customer thinks they've been forgotten, and their name, email and address are still sitting in your database, your ERP and your email platform.
Where Shopify customer data ends up
The Shopify side is Shopify's problem. The bit you own is everything your integrations copied out. It's worth listing it properly, because it's usually more places than anyone remembers:
- Your app's own database, including any order or customer tables you mirror for reporting.
- Connected systems: ERP, warehouse or 3PL software, CRM, accounting, review and loyalty tools.
- Email and SMS platforms that were fed a customer list.
- Log files. If your webhook handlers log the full payload (it's a common habit when debugging), every order webhook has written personal data to disk.
- Queues and dead letter stores, where failed jobs sit with their payloads intact.
- Exports, CSVs and that spreadsheet someone downloaded "just for this once".
- Backups.
Backups trip people up. The ICO's guidance on the right to erasure says a valid request extends to backup systems too, though it can be acceptable for the data to stay there until it's overwritten on your normal cycle, provided it's put beyond use. In practice that means knowing your retention period and making sure a restore doesn't quietly bring a deleted customer back. If you've never tried a restore at all, I've written about how to check your backups actually work, which is worth doing first.
What a decent handler looks like
None of this is hard to build. It just has to be built on purpose. A sensible customers/redact handler does roughly this:
- Verifies the HMAC first. Shopify's docs say an invalid signature must get a 401 Unauthorized. Without that check, anyone who finds the URL can ask you to delete customers.
- Acknowledges quickly. Return a 200 series status, then do the actual work in a background job. Don't make Shopify wait while you call three other systems.
- Works out what you hold. The payload identifies the shop, the customer and the orders involved. Use those to find every record, not just the obvious customers row.
- Deletes or anonymises, then tells the other systems. If your app pushed the customer to an ERP or CRM, it should pass the request on, or at least raise a task for a person to do it.
- Keeps what the law says you must. Invoices and tax records usually have to stay. The trick is keeping the financial record while stripping out what isn't needed.
- Records that it happened. A simple log of the request ID, the date and what was removed. Without the personal data in it, obviously.
- Copes with retries. Webhooks can arrive more than once. Running the same deletion twice should be harmless.
Do the same for shop/redact. If a store uninstalls your app, 48 hours later you're asked to remove that shop's data. For a custom app built for one business that might never fire, but for anything installed on more than one store it will.
A quick check you can do this week
Find the code that handles customers/redact in your app and read it. If it's three lines long and one of them is "return 200", you have your answer. Then pick a test customer, follow their data through every system your integration touches, and write down where it lives. That list is the spec for the handler.
If the person who built the app has moved on, or the integration was put together with an AI tool and nobody's quite sure what it does, that's the sort of thing our code audit is for. It's £250 + VAT and you get a plain account of what the code does, including what happens when a webhook like this arrives. If you'd rather someone just kept an eye on it, our Look after it service starts from £355 a month + VAT and covers fixes, security updates and changes like this one as Shopify rolls them out.
And if the real problem is that customer data is being copied into five systems with nobody owning the joins, we build Shopify integrations with this sort of thing designed in from the start, rather than bolted on after someone asks.
Shopify has made its part quicker. It's worth making sure yours keeps up. If you'd like us to take a look at your app, get in touch and we'll tell you honestly what we find.
Cheers, Rob
