A customer emails you: delete everything you have on me. You installed a cookie banner eight months ago and assumed this was covered. It is not. A banner collects consent at the moment of a visit. A data subject request is a different obligation — access, correction, deletion, opt-out, each with its own clock.

The part almost nobody writes about is that Shopify already ships the fulfilment side. Open a customer profile, click More actions, and there are Request customer data and Erase personal data. No app required.

The part that should worry you comes after you click. Shopify forwards the erasure to every app you have installed — and then its own help page tells you that confirming any of them deleted anything is your job, done by contacting each developer one at a time.

This article is general information, not legal advice; Shopify's own help pages carry the same caution. Which laws apply to your business is a question for counsel.

What a consent app does, and what it never touches

Consent and requests are separate machinery. Shopify's Customer Privacy API handles the first: setTrackingConsent, currentVisitorConsent, the visitorConsentCollected document event, and getRegion() returning ISO 3166-2 values like USCA. A cookie banner app writes into that layer. Nothing in it accepts a deletion request, verifies who is asking, or logs a response.

Shopify also covers two things merchants often buy an app for. The Data sharing opt-out page in Settings > Customer privacy auto-inserts a "Your Privacy Choices" icon when you add its link to a menu. And in regions configured for data sale opt-out, Shopify honors Global Privacy Control automatically, setting sale_of_data to false; California's Attorney General states GPC must be honored "as a valid consumer request to stop the sale or sharing of personal information." Shopify's native banner, though, governs only its own cookies and Pixels, and under automatic settings targets UK and EEA markets rather than US traffic.

What Shopify natively does when a request arrives

Access is Customers > the customer > More actions > Request customer data. Refresh the profile to see the data; store owners also get it by email. The scope is what Shopify processed from that customer's visits to your store.

Erasure is More actions > Erase personal data. Shopify's wording is precise and routinely misread: it erases personal data such as name and address, while what was sold and the date and time of the sale stay visible in your admin. The customer profile and the order history remain. This is a redaction, not a deletion. It also cancels that customer's subscription contracts and pre-authorized payments, and it does not reach data Shopify holds through Shop or Shop Pay, which the customer requests at privacy.shopify.com.

Then the timing, which is what breaks naive process documents.

Behavior	Detail
Cancellation window	10 days after submitting, via Cancel request in the Erasure request submitted section
No order in past six months	Shopify sends the customers/redact payload to apps 10 days after the request
Ordered in past six months	The payload is withheld until six months have passed

That last row deserves a second read: for the customers who ordered most recently, the fan-out to installed apps does not leave Shopify for half a year. Identity verification is not solved either — Shopify says you may need to verify the customer's identity as applicable law permits or requires, and provides no mechanism to do it.

What every installed app is obliged to do

Every app distributed through the Shopify App Store must subscribe to three compliance webhook topics — customers/data_request, customers/redact, and shop/redact — regardless of whether it collects personal data. An app that does not is rejected at review. (These were formerly referred to as GDPR webhooks; Shopify now calls them mandatory compliance webhooks.)

Topic	Trigger	Obligation
customers/data_request	A customer requests their data	Respond 200, then provide the data to the store owner directly
customers/redact	You submit an erasure, subject to the timing above	Respond 200, then erase
shop/redact	48 hours after you uninstall the app	Respond 200, then erase all customer PII for that shop

The developer must complete the action within 30 days of receiving the request, unless legally required to retain the data. So uninstalling is a real privacy action, but a slow one. And note the wording on customers/data_request: the app hands the resource IDs to the store owner directly. No dashboard in Shopify admin collects app responses.

The confirmation gap

Shopify's help page on finding and choosing apps says that when you request erasure for one customer, "the same request is sent to every app you have installed" that might hold their information. The next sentence is why this article exists: to confirm the data was deleted, you "need to check with the app's developer directly."

That is Shopify accurately describing its own architecture: it cannot verify a third party's database, so it does not claim to. The consequence is operational. Run twenty apps, and proving erasure across your stack means twenty emails and twenty replies, retained as evidence. A DSAR app can give you intake, a case log and an export — it cannot audit another developer's database. Start by inventorying what is installed: Settings > Customer privacy lists Installed privacy apps, and your Apps list covers the rest.

The clocks

For a business subject to the CCPA as amended, the California Privacy Protection Agency states the timings plainly: receipt confirmed within 10 business days, and a substantive response to a request to delete, correct, or know within 45 calendar days, extendable by another 45 — 90 total — if you notify the consumer. Opt-out of sale or sharing, and requests to limit the use of sensitive personal information, must be honored within 15 business days.

Whether you are covered turns on three thresholds, any one of which is enough: annual gross revenue of $26,625,000 or more (effective January 1, 2025); buying, selling or sharing the personal information of 100,000 or more California residents or households; or deriving 50% or more of annual revenue from that. The second catches stores that assume they are too small. California is also not the only state with a comprehensive privacy law, and the count changes — check the IAPP US State Privacy Legislation Tracker rather than trust a number in a blog post.

The tension is now obvious: you owe a substantive answer in 45 days, while your own redaction may not reach your apps for six months.

Which apps run a request workflow, and which are a banner

The organizing question is not which cookie banner is best. It is: does this app give you customer-facing request intake, a case log, and something you can export? Some do. At least one, by its own listing, does not.

All figures are from the ?locale=en listings as verified on September 3, 2026, and all charges are billed in USD. "Not listed" means the listing does not describe the feature — not that it does not exist.

App	Rating (reviews)	Built for Shopify	Metering	Free plan intake	Case log / export
Consentmo GDPR Compliance	5.0 (1,898)	Yes	None stated	Yes — "Customer data requests (DSAR) & Logs"	DSAR management tab (vendor doc)
Pandectes GDPR Compliance	5.0 (2,904)	Yes	None stated	Yes — "Customer Data Requests"	Email alerts + DSAR CSV export
Enzuzo Data Privacy	3.5 (34)	Not shown	Data Requests / month	Yes — 3 requests/month	DSAR forms from Growth $29/mo
Avada GDPR Cookies Consent	5.0 (848)	Yes	None stated	Yes — "Customer Data request"	Not listed
PieEye	5.0 (1)	Not shown	Listed as Free	Yes — DSR portal	Workflows, tasks and notifications
CookieYes GDPR Cookie Banner	4.8 (7)	Not shown	Pageviews / month	Not listed	Not listed

Consentmo GDPR Compliance

Source: Shopify App Store (Consentmo GDPR Compliance), retrieved September 3, 2026

Free Plan, Standard Plan $10/month, Plus Plan $37/month, Enterprise Plan $64/month, 7-day trial on paid plans. Free includes customer data requests and logs, so intake is not the upsell.

Its help documentation is unusually clear about what those pages do. They are generated at install, and customers can request account edits, order exports, a report, erasure, or "Do not Sell My Personal Information." The vendor states that "all of the information is taken directly from Shopify," and that the app stores no personal data beyond the requester's email address. Everything except the Do Not Sell request is handled automatically.

So the shape is a self-service front end and a log on top of Shopify's native flow — it does not reach into other apps' databases, and does not claim to.

Pandectes GDPR Compliance

Source: Shopify App Store (Pandectes GDPR Compliance), retrieved September 3, 2026

Basic is free, Plus $9/month, Premium $29/month, Enterprise $49/month, 7-day trial. Basic includes Customer Data Requests.

One listing bullet is the reason to consider it here: "Collect your customers' data requests, send email alerts, and export DSAR CSV." An export is what turns a log into something you can hand over. Identity verification steps and retention periods are not documented, and its customer-side data access is view rather than edit — consistent with intake-and-log rather than performing erasure itself.

One caution, as a single review rather than a pattern. On August 28, 2026 a US store four days in posted a one-star review describing anomalous direct traffic in GA4 that stopped when the app was disabled; support pointed to bot blocking, an Enterprise-only feature. The developer replied the next day, disputing that the app generates bot traffic.

Enzuzo Data Privacy

Source: Shopify App Store (Enzuzo Data Privacy), retrieved September 3, 2026

The pricing here is the most useful fact in the comparison, because Enzuzo's plans are metered on the thing this article is about: Data Requests per month. Free covers 3, Starter $9/month covers 10, Growth $29/month covers 50, Pro $79/month is unlimited. Count last year's access and deletion emails, divide by twelve, and the plan picks itself.

A distinction the listing draws but does not explain: DSAR forms (GDPR & CCPA) appear from Growth $29/month, while lower plans list "Data Requests." Its features also cover policy generation.

It carries the lowest rating in this group, 3.5 from 34 reviews, and thin recent volume. One April 2025 review from a Canadian store alleges double charging across Shopify and the vendor's own site with no resolution — one allegation, not a pattern. Its listing showed no Data access section when checked; that is an absence of published information, not evidence of narrow permissions.

Avada GDPR Cookies Consent

Source: Shopify App Store (Avada GDPR Cookies Consent), retrieved September 3, 2026

Free, Professional $9.95/month, Advanced $23.95/month, Enterprise $34/month, 7-day trial. The Free plan lists both "Customer Data request" and "Data sales opt-out," plus a custom preferences page and a privacy policy generator — enough to stand up a public opt-out page and an intake route at no cost.

Where it stops is documentation: case management, audit logging and identity verification are not described, and Consent logs from Advanced $23.95/month are consent records, not request records. So intake is listed and DSAR depth is not, which is not the same as missing. Ask before making it your system of record.

Its cost advantage is elsewhere: at Enterprise $34/month it is the least expensive of the three apps here listing a checkout consent banner, against Pandectes Enterprise $49/month and Consentmo Enterprise $64/month — though Avada's bullet reads Checkout & Account consent banner while the other two say "for Shopify Plus stores," so confirm scope before buying on that basis.

PieEye

Source: Shopify App Store (PieEye), retrieved September 3, 2026

On paper this is aimed squarely at the problem: the listing bullets describe a Data Subject Request portal, automatic data discovery and DSR fulfilment, and dynamic workflows with tasks and notifications. Its overview says the app creates a portal for shoppers to submit a DSR, "retrieving info from any source," and delivering results within the required time frame.

That phrase is exactly the confirmation gap this article is about — and it is vendor marketing copy we did not verify. Ask for a demonstration against your own app stack.

The evidence base is the constraint. PieEye has one review: five stars, posted August 3, 2026 by a US merchant after five months of use, with no written content. The admin is English-only and the App Store shows it as Free with no higher tiers displayed. One observation and nothing more: its Data access section lists no customer or order data at all — only store owner and blog contributor details, plus edit access to Online Store script tags and pages — while Shopify sends customers/data_request and customers/redact to apps granted customer or order data access. Those sections are not always complete — a fair question for the developer, based in San Jose, California.

CookieYes GDPR Cookie Banner — the contrast case

Source: Shopify App Store (CookieYes GDPR Cookie Banner), retrieved September 3, 2026

This is a consent management platform, and its listing is honest about that: banner, cookie scanner, script blocking, consent logs, policy generators. There is no mention of DSARs, data subject requests, or customer data requests anywhere on the listing. Its Data access section is consistent — store owner information and view access to the Online Store theme only.

That is not a criticism — it is the point of the article. If CookieYes is what you installed, you have a consent tool, and your access and deletion workflow is still whatever you and Shopify admin do by hand.

Pricing is metered on pageviews per month: Free covers 5,000, Basic $10/month covers 100,000, Pro $25/month covers 300,000, Ultimate $55/month is unlimited, with a 14-day trial. The listing also carries a warning the others do not — external charges may be billed by CookieYes Limited separately from your Shopify invoice.

Decide in this order

1. Count last year's requests. A handful annually, by email, logged in a spreadsheet? Shopify admin plus Settings > Customer privacy is sufficient. Do not buy anything.
2. Need a public request page or a Do Not Sell or Share My Personal Information link? The free tiers of Consentmo GDPR Compliance, Pandectes GDPR Compliance and Avada GDPR Cookies Consent all list request intake; Enzuzo Data Privacy allows 3 a month.
3. Need an exportable register? Pandectes GDPR Compliance lists DSAR CSV export — what turns a log into evidence.
4. High or unpredictable volume? Enzuzo's per-request metering scales with you, $79/month past 50; the feature-priced apps state no request limits.
5. Checkout consent banner? Avada Enterprise $34/month, then Pandectes Enterprise $49/month, then Consentmo Enterprise $64/month — check the Plus wording with each vendor first.
6. Want case management with tasks and notifications? PieEye is designed for it and listed as free, with one review. Pilot it; do not migrate to it.
7. Whatever you choose, build the step nobody sells: a list of every installed app, a template email to each developer after an erasure, and a folder of the replies.

The clock starts when the email arrives, not when you click. Write the process down before the first request.

Sources

• Shopify Help Center: Processing customer data requests, Finding and choosing apps, Configuring customer privacy settings, Understanding customer privacy settings
• Shopify.dev: Privacy law compliance, Customer Privacy API, Privacy requirements for apps
• California Privacy Protection Agency: FAQ — response deadlines and applicability thresholds
• California Attorney General: CCPA, Global Privacy Control
• IAPP US State Privacy Legislation Tracker
• Consentmo support documentation: Privacy request pages and their request emails and pages explained
• Shopify privacy portal — where customers file requests relating to Shop and Shop Pay
• Shopify App Store listings, pricing tabs, data access sections and public reviews for all six apps, retrieved September 3, 2026