CRA Tried to Grab Shopify User Data—It Cost Taxpayers $90,000

Shopify has won a legal fight with the Canada Revenue Agency (CRA), after a federal judge ruled against the agency’s demand for mass data on Canadian Shopify merchants.

The CRA had sought over six years’ worth of personal and financial records, including names, addresses, birthdates, phone numbers, bank account details, Shopify IDs, store types, and transaction histories. The goal was to check if merchants were complying with Canadian tax laws—and in part, to fulfill a request from the Australian Tax Office.

But Judge Guy Régimbald rejected the CRA’s request, siding with Shopify’s argument that the agency’s demand was far too broad and lacked clear justification. The court found that the CRA failed to define a specific group of individuals and instead made a sweeping grab for data on unnamed parties.

Shopify CEO Tobi Lütke called it “blatant overreach” in a post on X, praising the ruling and reaffirming the company’s stance on protecting its merchants’ privacy.

Back in June 2023, the Shopify CEO said, “I don’t particularly want a fight with the CRA (Canada’s tax authority)- but we got asked to backchannel them 6 years of records for all Canadian Shopify stores. This feels like low-key overreach to me. We will fight this.”

To make matters worse for the CRA—and Canadian taxpayers—the court ordered the agency to pay $45,000 in legal costs for each of the two related cases, totalling $90,000 in wasted public funds, according to the Canadian Press. Ouch.

While the CRA says it is still reviewing the court’s decision, the case is a clear rebuke of its tactics. Shopify, meanwhile, is being applauded for standing firm in defence of its merchants—and setting a precedent against unchecked government data grabs.