Shopify's customer redaction included all orders associated with respective customer

Webhooks and Events
1

When a customer requests their personal data to be deleted and the store owner initiates the redaction process, could you please confirm whether Shopify includes all order IDs associated with that customer in the orders_to_redact field, or only specific order IDs are passed?

2

Hey @Rahul_Rakesh, reviewing the documentation here, the webhook will contain all of the customers associated id’s that you will need to delete or redact.

If your app has been granted access to the store’s customer or order data, then it will receive a redaction request webhook with the resource IDs that you need to redact or delete.

3

Yeah, but the documentation says the following, and it doesn’t clearly mention whether Shopify always sends all orders or just specific IDs. Could you please confirm this point?

“If your app has been granted access to the store’s customer or order data, then it will receive a redaction request webhook with the resource IDs that you need to redact or delete. In some cases, a customer record contains only the customer’s email address.”

4

We will send all of the specific resource id’s that you are required to delete.

5

Do you mean all the order IDs associated with that specific customer?

6

I apologize if I’m not fully understanding the question. All of the relevant specific order ID’s from that specific customer that you will need to redact are included in the response.

ie: "orders_to_redact": [299938, 280263, 220458]

7

Thanks for clarifying.
So just to confirm — the orders_to_redact field will always contain all the order IDs associated with that specific customer that need to be redacted, correct?

1 Like
8

Yes, that is correct. :slight_smile:

1 Like
9

I’d like to clarify the following:

Is there a way, either through the Shopify Admin UI or via any Shopify APIs, for merchants (or apps) to request deletion of specific orders for a customer, rather than all orders associated with that customer?

Specifically:

  • How does Shopify determine which order IDs appear in the orders_to_redact field of the customers/redact webhook?

  • Is there an option for merchants to selectively redact individual orders, or does Shopify always send all orders when a customer redaction is requested?

10

Hey Rahul,

There’s no mechanism to selectively redact individual orders when it comes to privacy compliance. When a customer exercises their data deletion rights, the customers/redact webhook includes all orders associated with that customer in the orders_to_redact field. This “all or nothing” approach aligns with privacy regulations that give customers the right to have their complete personal data deleted, not just portions of it.

Are you perhaps thinking about deleting specific orders for business operational purposes rather than privacy compliance? If so, merchants can delete individual orders directly from the Shopify admin or API under certain conditions (like manual payment methods, draft orders, or test orders). However, this is completely separate from privacy redaction requests.