Shopify now bars using its data to copy product catalogs beyond limited previews

The change

Shopify updated its API License and Terms of Use on October 7, 2026. The previous version was dated February 27, 2026. Anyone who accesses or uses the Shopify API agrees to these terms, and Shopify defines the API broadly, including its SDKs, developer tools, and Model Context Protocol (MCP) servers.

The main edit to existing text is in a clause that already banned using Shopify data to train AI. It now covers two more uses. Developers may not use any information derived from the Shopify API, merchant data, or merchant stores to:

"reproduce substantial portions of a source's product pages, catalogs or content feeds beyond limited previews used for product discovery, or route purchases through a checkout not authorized by Shopify or the relevant merchant"

The update also adds a new section on Shop and Shop Pay features, with its own rules for user data and for payments.

What changed

• Copying catalogs. Information derived from Shopify may not be used to reproduce substantial portions of product pages, catalogs, or content feeds, beyond limited previews used for product discovery.

• Routing purchases. The same information may not be used to route purchases through a checkout that Shopify or the merchant has not authorized.

• Consent as the way out. Both limits, like the existing AI training ban, can be lifted with Shopify's prior written consent or, for a specific merchant's data or store, that merchant's consent.

• Shop Functionality. A new section covers "Shop and Shop Pay features made available through the Shopify API," and treats anyone who uses them as a Developer, "whether or not through an Application."

• Shop User Data. Information about Shop and Shop Pay users may be used or disclosed "only as agreed by the user to whom that Shop User Data relates and in compliance with applicable law."

• Payment rules. Anyone using Shop Functionality for payments must respect "the transaction and exposure limits set by the user" and follow card-network rules and payment-card security standards.

• Derived information disclaimed. The warranty disclaimer now covers the Service and the API "(and any information derived therefrom)."

Copying catalogs and routing purchases

In February, the clause read as one ban: no using information derived from Shopify "to create, develop, train, fine tune, or improve any machine learning or artificial intelligence systems, models, or technologies, including large language models." In October, that ban becomes item (i), and a new item (ii) adds the catalog and checkout limits quoted above.

The clause is broad about what counts as information from Shopify. It covers anything derived from "the Shopify API, Merchant Data, any Merchant Store, the Services, or any aspect or portion thereof (including any anonymous, aggregate, or derived forms of data)." So the limit is not only on data pulled straight from the API. It also reaches data that has been processed, combined, or anonymized along the way.

Two things stay allowed. "Limited previews used for product discovery" are outside the limit, and both the catalog and checkout limits can be lifted "with: (a) Shopify's prior written consent, or (b) solely with respect to Merchant Data or a specific Merchant Store, the relevant Merchant's consent." The terms do not define what counts as a "substantial" portion or a "limited" preview, and they do not define what "a source" means.

Parts of this were already restricted elsewhere in the terms. Developers already could not use the API "to build any commerce or product index," and could not use "an alternative to Shopify Checkout for checkout or payment processing for Shopify Merchants" without Shopify's written authorization. The new item applies to information derived from Shopify, not only to direct use of the API.

Shop and Shop Pay features, with or without an app

The new Shop Functionality section starts with a definition: "Shop Functionality" means "Shop and Shop Pay features made available through the Shopify API." It then widens who the terms apply to: "For those features, 'Developer' includes any individual or entity accessing or using them, whether or not through an Application." Elsewhere in the terms, a Developer is someone who develops, owns, or operates an Application that uses the API.

The section creates a new category, "Shop User Data," meaning "information about Shop or Shop Pay users that Shopify makes available through Shop Functionality, including information derived from it." It can be used or disclosed only as the user agreed and as the law allows.

The section also clarifies that some of the usual requirements do not apply. Developers who "solely use Shop Functionality" do not need a Merchant Agreement or merchant-facing documents, such as the privacy policy that apps must otherwise present to merchants. And the rules that limit access to and use of merchant data and contact with customers "do not prohibit access to or use of Shop User Data, or communications with users, necessary for your permitted use of Shop Functionality."

New rules for paying with Shop Pay

The last paragraph of the section is about payments. "When using Shop Functionality for payments, you must comply with the transaction and exposure limits set by the user." Payment credentials may be used "only within the scope, validity period and usage limits specified by Shopify in the Developer Documentation, or otherwise communicated by Shopify."

The developer must also comply, and make sure any service providers involved in those payments comply, "with card-network rules and payment-card security standards applicable to your or their activities," and must make sure "that purchases you initiate or facilitate through the Shop Functionality comply with applicable law." The terms do not list what the user's limits look like or where they are set.

Smaller edits

The plain-language summary at the top of the page, which Shopify says is not legally binding, used to say: "Don't use the API for any purpose other than providing an application to merchants." It now ends "to merchants or as otherwise permitted by these Terms." The definition of Developer Documentation dropped the word "Application," so it now refers to "Shopify's development requirements" in general.

The warranty section now disclaims warranties for information derived from the API as well. Shopify says the Service and the API "(and any information derived therefrom)" are provided "as-is," and disclaims any promise that they satisfy your requirements or "will be uninterrupted, error-free or free from harmful components."

What did not change

The ban on using Shopify-derived information to train AI models was already in the February version, with the same consent exceptions. So were the bans on scraping, on building a commerce or product index, and on using an alternative to Shopify Checkout for Shopify merchants. Shopify's liability to developers is still capped at $100, the terms are still governed by the laws of Ontario, and continued use of the API after an update still counts as acceptance. The terms still say that for a significant change, Shopify will give reasonable notice by email, on the Shopify Partner Blog, in the Partner Dashboard, or in the Merchant Store Admin.

Why this matters

Shopify is opening its stores to AI agents. On September 28, PYMNTS reported that Shopify now lets browser agents check out on the websites of its eligible merchants, including with Shop Pay. On October 13, six days after the new terms, Shopify's developer changelog announced Shop MCP, which "lets your agent or app search Shopify Catalog, build carts, and complete Shop Pay checkout."

The new terms do not mention AI agents. But the Shop Functionality section applies to anyone using Shop and Shop Pay features, with or without an app, and sets rules for user-set transaction limits and payment credentials. Other vendors have also been writing rules for software that acts and pays on someone's behalf: Stripe legitimized agentic commerce and shifted liability to users, Stripe now lets AI agents access your financial account data, and HubSpot now makes customers answer for what its AI agents do.

The catalog limit matters beyond agents. Product feeds, comparison tools, marketplaces, and analytics products often work with store data. Under the new wording, using Shopify-derived information to reproduce substantial portions of product pages, catalogs, or content feeds needs consent from Shopify or from the relevant merchant, even if the data was anonymized or aggregated first.

Potential impact

The update raises five practical questions:

• Does anything you build show product pages, catalogs, or feeds that came from Shopify, and is it more than a limited preview for product discovery?

• Does any flow you run use Shopify-derived information to route purchases through a checkout that Shopify or the merchant has not authorized?

• If you rely on merchant consent, can you show you have it from each merchant whose data or store you use?

• If you use Shop or Shop Pay features, do you know what the user agreed to and what transaction limits they set?

• Do you check data you derive from Shopify yourself, now that Shopify disclaims warranties for it?

How Venpo detected it

Venpo monitors Shopify's API License and Terms of Use and keeps each version it reads. The comparison with the February 27, 2026 version showed exactly which words were added, so this article can separate the new catalog and checkout limits from the AI training ban and the checkout rules that were already there. Every quote from the current terms was checked against the live page, and every February quote against the version Venpo stored.

Business outcome

Teams that track Shopify's terms have the old and new clauses side by side: the two new limits on Shopify-derived information, the consent that lifts them, and the new rules for Shop and Shop Pay. That is what a product or legal team needs to decide whether a feed, a comparison feature, or a shopping agent needs Shopify's or a merchant's consent.

Key takeaway

Shopify's October 7 API terms bar using its data to reproduce substantial portions of product pages, catalogs, or content feeds, or to route purchases through unauthorized checkouts, and set new rules for anyone using Shop and Shop Pay features, with or without an app. Telling these limits apart from the older ones takes a line-by-line comparison, which is why you monitor vendor terms of service over time.