Shopify EU Alternative 2026: Canada Five Eyes, GCP CLOUD Act Chain, and GDPR E-Commerce Data Sovereignty

Post #1 in the sota.io EU E-Commerce Platform Series

Shopify is the dominant hosted e-commerce platform for small and medium-sized businesses worldwide. With over two million merchants in more than 175 countries and an estimated 10–15% share of US e-commerce, Shopify has become the default choice for businesses launching their first online store. Its simplicity — set up in hours, no hosting required, integrated payments — made it a category-defining product.

For EU merchants and their data protection officers, Shopify raises a compliance question that is more nuanced than it first appears. Shopify is not a US company. It is incorporated in Canada. Canada has an EU adequacy decision. Shopify has a Dublin-registered EU entity. Shopify provides a Data Processing Agreement. Shopify has signed Standard Contractual Clauses. On paper, the compliance box appears checkable.

Beneath the paper, the picture is more complicated. Canada is a founding member of the Five Eyes intelligence alliance, with signals intelligence sharing arrangements that EU courts have never treated as equivalent to EU GDPR protections. Shopify runs on Google Cloud Platform — a US company explicitly subject to the CLOUD Act. And as an NYSE-listed company, Shopify is exposed to US civil discovery in a way that purely Canadian companies are not. This guide unpacks each of these layers.

Shopify Inc.: Corporate Structure and Jurisdictions

Shopify Inc. was incorporated in Ontario, Canada in 2004 by Tobias Lütke, Daniel Weinand, and Scott Lake. Its registered office is in Ottawa. This makes Shopify legally Canadian — not American — and means that US federal law, including the CLOUD Act, does not apply to Shopify Inc. itself in the same direct way it applies to US-incorporated entities.

The corporate structure involves several relevant entities:

For EU merchants, the contractual relationship is with Shopify International Limited, registered with the Irish Data Protection Commission (DPC). Shopify International Limited acts as both a data controller (for account data) and data processor (for merchant customer data), depending on the data category and context.

This Dublin entity structure matters, but it does not resolve all jurisdictional questions.

Canada and the Five Eyes Intelligence Alliance

Canada is a founding member of the Five Eyes intelligence alliance, formalised through the UKUSA Agreement signed in 1946 between the United States, United Kingdom, Canada, Australia, and New Zealand. The Five Eyes alliance coordinates signals intelligence collection and sharing at a level that has no equivalent in EU or EEA jurisdiction.

Within Canada, the Communications Security Establishment (CSE) — Canada's signals intelligence agency, equivalent to the NSA or GCHQ — operates under the Communications Security Establishment Act (2019) and its predecessor legislation. CSE collects foreign signals intelligence and shares it with alliance partners under the UKUSA framework. CSE can, under specific circumstances, conduct incidental collection of communications involving Canadian persons or data.

PIPEDA and EU Adequacy

Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), governs how Canadian private-sector companies collect, use, and disclose personal information in commercial activities. The European Commission granted Canada an adequacy decision in January 2002 (Commission Decision 2002/2/EC), recognising PIPEDA as providing adequate protection for personal data transferred from the EU.

This adequacy decision means that EU-to-Canada data transfers can proceed without Standard Contractual Clauses or other Art.46 GDPR safeguards, as long as the Canadian recipient is subject to PIPEDA.

However, the adequacy decision has important limitations:

First, the adequacy decision applies to PIPEDA, not to Canadian national security law. CSE's intelligence activities are not covered by PIPEDA. If CSE collects data about EU individuals through its signals intelligence activities — or receives such data from NSA under the UKUSA framework — the adequacy decision provides no protection.

Second, the adequacy decision was last substantively reviewed in 2023. The European Data Protection Board (EDPB) has noted that Canada's law has evolved since 2002, and the Commission's continued assessment of adequacy is not guaranteed. Canada's Consumer Privacy Protection Act (CPPA), enacted in 2022 but not yet fully in force, will eventually replace PIPEDA — triggering a new adequacy assessment.

Third, the adequacy decision was designed for commercial data flows, not for intelligence community access. The Schrems II judgment (Data Protection Commissioner v Facebook Ireland and Schrems, Case C-311/18) established that adequacy decisions must account for national security law. Canada's Five Eyes membership is directly relevant to this analysis.

What Five Eyes Membership Means Practically

The Five Eyes relationship means:

1. Signals intelligence sharing: CSE shares collected intelligence with NSA and GCHQ. Data about EU individuals that CSE collects — or receives from partner agencies — can flow to US authorities without any GDPR process.

2. No MLAT requirement for intelligence: Unlike law enforcement mutual legal assistance treaty (MLAT) requests — which require judicial oversight and notification — intelligence sharing under UKUSA operates without judicial process and without notification to data subjects.

3. Historical precedent: The Snowden disclosures (2013) revealed the extent of Five Eyes data sharing, including bulk collection of telecommunications metadata. EU courts have consistently treated this as a material factor in data protection analysis.

4. EU court position: The CJEU has not directly ruled on the PIPEDA adequacy decision post-Schrems II. However, the reasoning of Schrems II — which struck down Privacy Shield based on NSA's PRISM and Upstream collection programmes — applies with equal logic to any Five Eyes member where intelligence agencies can access data through channels outside PIPEDA's scope.

GCP CLOUD Act Chain: Google LLC as US Person

Shopify's primary cloud infrastructure is Google Cloud Platform (GCP), operated by Google LLC, a limited liability company incorporated in Delaware, USA. Shopify has confirmed GCP as a primary infrastructure provider in its data processing documentation.

This subprocessor relationship creates what compliance practitioners call a CLOUD Act chain: even if Shopify International Limited (Dublin) is the data controller, and even if data is stored in GCP's European regions (such as europe-west4 in the Netherlands or europe-west1 in Belgium), the infrastructure is operated by a US legal entity.

The CLOUD Act Applied to GCP

The Clarifying Lawful Overseas Use of Data Act (CLOUD Act), enacted in March 2018, requires US providers to comply with US legal process for data wherever stored in the world — including in EU data centres. Google LLC is unambiguously a US provider subject to this requirement.

The key provision, 18 U.S.C. § 2713, states:

"A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States."

When Shopify stores EU merchant customer data on GCP infrastructure in a European region, Google LLC holds that data "within its possession, custody, or control" — and can be compelled by US courts to produce it. Standard Contractual Clauses between Shopify International Limited and Google LLC do not override a US court order directed at Google LLC.

EU Data Stored in EU Regions Is Not Protected

A common misconception is that selecting a GCP European region — such as europe-west4 (Netherlands) or europe-west3 (Frankfurt) — eliminates CLOUD Act exposure. It does not. The CLOUD Act's extraterritorial reach applies regardless of where data is physically stored. What matters is who operates the infrastructure: Google LLC is a US person whether the data centre is in Frankfurt or Iowa.

Google has acknowledged this in its own documentation. The company's Government Requests for User Data policy notes that it evaluates all legal demands for data regardless of where data is stored, and complies with US federal legal process that meets statutory requirements.

Shopify's Subprocessor Disclosure

Shopify's Data Processing Agreement lists its subprocessors. As of the most recent public version, GCP (Google) appears as a primary infrastructure subprocessor, alongside some additional service providers. EU merchants relying on Shopify's DPA should review the current subprocessor list and apply CLOUD Act analysis to each US-incorporated entry.

NYSE Listing and US Civil Discovery

Shopify Inc. is listed on the New York Stock Exchange (NYSE: SHOP) and has been a component of the S&P 500 since 2020. This US listing creates a distinct category of legal exposure separate from both PIPEDA and the CLOUD Act.

SEC Subpoena Authority

As an NYSE-listed company, Shopify is subject to oversight by the Securities and Exchange Commission (SEC). The SEC has broad subpoena authority under the Securities Exchange Act of 1934. In SEC investigations, the agency can compel production of records from Shopify Inc. — including business communications, transaction records, and potentially data about merchants or customers relevant to a securities fraud investigation.

The SEC's jurisdiction over Shopify flows from its US listing, not from Shopify's Canadian incorporation. This is not merely theoretical: the SEC has pursued investigations against foreign-incorporated companies listed on US exchanges, and courts have generally upheld the SEC's authority to compel document production.

US Civil Litigation Discovery

Beyond SEC enforcement, NYSE listing exposes Shopify to US civil litigation. In US federal courts, discovery rules (Federal Rules of Civil Procedure, Rule 26) are among the broadest in the world. A party in US civil litigation involving Shopify can seek discovery of documents held by Shopify or its US subsidiaries, including data that relates to EU merchants or their customers.

The CLOUD Act does not govern civil discovery — it governs criminal and national security legal process. Civil discovery of data related to EU individuals held by a US subsidiary of an NYSE-listed company operates through separate rules, and courts have often ordered production of documents regardless of where data is stored or which entity nominally holds it.

Shopify International Limited: The Dublin Entity Analysis

For EU merchants, the contractual counterparty is Shopify International Limited, a private company limited by shares incorporated in Ireland and registered with the Irish Data Protection Commission. Shopify International Limited is registered with the DPC under the GDPR one-stop-shop mechanism, making the Irish DPC the lead supervisory authority for EU matters.

Data Processing Agreement and SCCs

Shopify provides a Data Processing Agreement (DPA) for EU merchants, addressing GDPR Art.28 requirements for data processor relationships. The DPA includes:

• Standard Contractual Clauses (SCCs) based on the 2021 Commission Implementing Decision (EU) 2021/914, specifically Module 2 (Controller to Processor) and Module 3 (Processor to Sub-Processor)
• A list of approved subprocessors with change notification mechanisms
• Technical and organisational security measures (TOMs)
• Data subject rights procedures
• Breach notification timelines

The DPA establishes Shopify International Limited as a data processor for merchant customer data, with the merchant as data controller. For merchant account data — the merchant's own information — Shopify acts as a co-controller or independent controller.

What the DPA Does Not Resolve

The DPA and SCCs do not resolve the GCP CLOUD Act chain issue. SCCs govern contractual obligations between Shopify International Limited and Google LLC. They do not prevent a US federal court order directed at Google LLC. The Schrems II judgment acknowledged this explicitly: SCCs are valid as a contractual mechanism but require supplementary measures where the legal framework of the recipient country does not ensure equivalent protection to EU law.

The EDPB's supplementary measures guidance (Recommendations 01/2020) identifies data encryption as one potential technical measure — but notes that the effectiveness of encryption depends on whether the data importer (Google LLC) holds encryption keys. If Google LLC holds keys (which it does for standard GCP storage), encryption does not protect against CLOUD Act compulsion.

In practice, this means:

Shopify's DPA satisfies the formal requirements of GDPR Art.28. It does not eliminate the substantive risk that US authorities could access EU merchant customer data through Google LLC under the CLOUD Act.

E-Commerce Data Categories Under GDPR

Shopify processes a wide range of personal data categories on behalf of EU merchants. Each category carries specific GDPR compliance considerations:

Payment card data handled through Shopify Payments is processed by Stripe, Inc. — a US company incorporated in Delaware, subject to the CLOUD Act independently of Shopify. EU merchants using Shopify Payments inherit this additional US jurisdiction layer.

IP addresses are personal data under EU law following the CJEU's ruling in Breyer v Bundesrepublik Deutschland (Case C-582/14, 2016). Shopify's server-side collection of IP addresses and device fingerprinting data for fraud prevention constitutes personal data processing requiring a lawful basis.

Browsing and cart data — including product views, abandoned carts, and session duration — is subject to the ePrivacy Directive (2002/58/EC, implemented in national law) in addition to GDPR. EU merchants using Shopify's analytics features or enabling third-party tracking apps must obtain cookie consent and manage the resulting data flows carefully.

Shopify's GDPR Compliance Posture

Shopify has invested significantly in GDPR compliance infrastructure, particularly following the regulation's May 2018 application date. The company's compliance posture includes:

What Shopify does well:

• Publishes a comprehensive Privacy Policy with explicit GDPR references
• Provides a DPA with SCCs and subprocessor list
• Offers data subject rights tools enabling merchants to facilitate erasure and portability requests
• Maintains Shopify International Limited (Dublin) as EU data controller with DPC registration
• Provides GDPR compliance documentation and merchant guides
• Offers EU data residency options for certain Shopify Plus tiers
• Provides transparency reports on government requests

Where gaps remain:

• GCP CLOUD Act chain cannot be contractually resolved
• Five Eyes intelligence access is outside GDPR's enforcement scope
• NYSE-listing creates US litigation discovery exposure
• EU data residency (Shopify Plus only) does not apply to all merchant tiers
• Third-party app ecosystem (8,000+ apps in Shopify App Store) creates uncontrolled data processor chains — merchants are responsible for vetting each installed app's GDPR compliance
• Shopify Payments via Stripe (US) adds an additional US CLOUD Act layer for payment data

The Third-Party App Risk

One compliance dimension specific to hosted e-commerce platforms deserves emphasis. The Shopify App Store contains over 8,000 apps from third-party developers. Many of these apps — marketing automation, customer service, reviews, loyalty, analytics — access Shopify store data through the Shopify API and operate their own data processing infrastructure.

Under GDPR, EU merchants are responsible as data controllers for all data processing performed by apps they install. Each installed app is an additional data processor under Art.28, requiring a separate DPA and data processing assessment. The nationality and cloud infrastructure of each app developer is relevant to CLOUD Act analysis.

This is not a problem unique to Shopify — WooCommerce has a similar plugin ecosystem challenge. But it is a material compliance burden that EU merchants operating on hosted platforms must manage actively.

EU-Native E-Commerce Alternatives

For EU merchants for whom jurisdictional protection is a material compliance requirement — regulated industries, public sector procurement, healthcare, financial services — several EU-incorporated platforms exist:

Shopware AG — Germany

Shopware AG is headquartered in Schöppingen, North Rhine-Westphalia, Germany. Founded in 2000 by Stefan Hamann, it is one of the largest e-commerce platforms in the DACH market. Shopware 6 is open-source (MIT licence for the core) with commercial editions (Rise, Evolve, Beyond) for larger merchants.

For self-hosted deployments, Shopware Community Edition can run on any Linux server. Deploying on sota.io (Hetzner Germany infrastructure) eliminates AWS CLOUD Act exposure entirely.

PrestaShop SA — France

PrestaShop SA is headquartered in Paris (La Défense), France. Founded in 2007 at École Centrale Paris, PrestaShop is one of the largest open-source e-commerce platforms globally, with over 300,000 live stores. The platform is open-source (OSL 3.0 licence) and self-hostable.

PrestaShop's open-source core has no mandatory cloud dependency. EU merchants can deploy it on EU-native infrastructure and configure all third-party modules to maintain EU data residency.

Medusa — Denmark

Medusa Commerce ApS is incorporated in Copenhagen, Denmark. Founded in 2020, Medusa is a headless, open-source e-commerce engine built for developers, using Node.js/TypeScript. The MIT-licensed core is designed for composable commerce architectures.

Medusa's headless architecture makes it particularly suitable for deployment on container-based EU-native PaaS platforms. Running Medusa on sota.io gives EU merchants a GDPR-clean stack with Danish corporate lineage and German infrastructure.

Sylius — Poland

Sylius (Sylius sp. z o.o.) is incorporated in Warsaw, Poland. Built on Symfony, it is a headless e-commerce framework with a strong developer ecosystem, particularly in the DACH and CEE markets.

Odoo — Belgium

Odoo SA (formerly OpenERP) is incorporated in Ramillies, Belgium. Founded in 2005, Odoo offers an integrated ERP suite including an e-commerce module. For EU businesses already considering ERP integration, Odoo provides a Belgian legal entity with EU infrastructure options.

Compliance Verdict

Shopify is not a reckless GDPR choice. The company has invested in compliance infrastructure, provides strong contractual documentation, and has an EU-registered entity. For many EU merchants — particularly SMBs without a public sector, healthcare, or financial services customer base — the practical risk of CLOUD Act compulsion may be tolerable.

For EU merchants operating under sector-specific data protection requirements — healthcare (MDR/IVD, GDPR Art.9), financial services (DORA, PSD2), defence supply chain (NIS2), or public sector procurement rules — Shopify's combination of Five Eyes jurisdiction, GCP infrastructure, and NYSE listing creates a risk profile that is difficult to certify under strict data protection impact assessment (DPIA) frameworks.

The EU E-Commerce Platform Landscape

This post is the first in a six-part series examining major e-commerce platforms under EU GDPR and CLOUD Act analysis:

1. Shopify (Canada / Five Eyes + GCP CLOUD Act) — this post
2. WooCommerce / Automattic (US, Delaware — WordPress.com infrastructure)
3. BigCommerce (Austin, Texas — NASDAQ: BIGC)
4. Magento / Adobe Commerce (Adobe Inc., San Jose, California)
5. Wix (Israel + US Delaware listing)
6. EU E-Commerce Platform Comparison 2026 — Shopware / PrestaShop / Medusa / Sylius compliance ranking

Conclusion

Shopify's GDPR compliance story is more nuanced than either its critics or its advocates suggest. The company is not a US entity. Canada has an EU adequacy decision. Shopify provides a real DPA with real SCCs.

But the adequacy decision pre-dates Schrems II and does not account for Five Eyes intelligence sharing. The DPA covers contractual obligations, not CLOUD Act compulsion of GCP. The NYSE listing adds US litigation discovery exposure that no Irish subsidiary structure eliminates.

For EU merchants seeking genuine jurisdictional protection, the EU-native alternatives — Shopware (Germany), PrestaShop (France), Medusa (Denmark), Sylius (Poland) — offer e-commerce capabilities without the layered US jurisdiction exposure. All can be self-hosted on EU-native infrastructure. All are open-source. All have EU supervisory authorities.

The practical question for each EU merchant is not whether Shopify is compliant on paper — it is. The question is whether the residual risk of GCP CLOUD Act exposure, Five Eyes intelligence access, and US civil discovery is acceptable given the sensitivity of customer data the store processes and the regulatory framework it operates under.

For a general consumer goods store: the risk is likely tolerable. For a medical devices e-commerce platform, a financial services marketplace, or a B2B procurement system handling EU public sector clients: the DPIA conclusion will almost certainly require an EU-native alternative.

This post is for informational purposes and does not constitute legal advice. EU organisations should conduct data protection impact assessments with qualified data protection counsel.