accountcraft Install free
All articles

AccountCraft Journal

How to Export Consent Records From Shopify

Export Shopify customer consent: what the Customers CSV includes, what it leaves out, how to read consent fields through the API, and how to keep a proper audit trail.

11 min read

You can export current marketing consent from Shopify in a couple of minutes: go to Customers in your Shopify admin, click Export, and download the customer CSV. That file shows each customer’s present opt-in status. It does not show the history behind it, meaning when someone consented, what they were shown and how. If you need to prove consent, not just list it, you need a second layer, and this guide covers both.

AccountCraft
apps.shopify.com
Let Customers Manage Their Consent
AccountCraft lets Shopify customers view and edit their information, with built-in consent management that keeps data in Shopify.
Install AccountCraft

TL;DR

  • The Customers export gives you a snapshot: yes or no columns for email, SMS and WhatsApp marketing consent.
  • It is not an audit trail. It has no history of consent events and no record of the consent text a customer saw.
  • For event-level detail, read the consent fields through the Admin API, and store a dated copy of every form wording you use.
  • Keep consent collection inside Shopify, so exports reflect one source of truth instead of several tools that disagree.
  • Compliance is your responsibility. Check the rules that apply to you with legal counsel.

Table of Contents

What the native Shopify export gives you

Shopify’s customer CSV export includes the marketing consent columns Accepts Email Marketing, Accepts SMS Marketing and Accepts WhatsApp Marketing, each holding a yes or no value for the customer’s current state. That is the quickest way to answer the question “who can I market to right now?”

Here is how to run it.

  1. In your Shopify admin, open Customers.
  2. Click Export at the top of the page.
  3. Choose the scope: all customers, selected customers, or the current search or segment if it is offered in your admin.
  4. Choose the CSV format you want, then confirm the export.
  5. Download the file. Per Shopify, exports of 50 or fewer customers download in the browser, larger ones are emailed to the store owner, and files are limited to 15 MB.

That last point matters for planning. If your list is large, the export lands in the owner’s inbox, so make sure that address is monitored. If a file hits the size limit, export segments instead of the whole list.

What the file does not tell you

The CSV is a snapshot. It says a customer accepts email marketing today. It does not say when they agreed, which signup form they used, what the form said, or whether they have flipped their choice three times since. Shopify’s own documentation describes the export as current values, with no event log attached.

For a newsletter you may never be challenged on this. If you sell in the EU or the UK, or you are ever asked to demonstrate consent, a bare yes is thin evidence.

The UK regulator’s guidance on recording consent says that when processing relies on consent, the controller must be able to demonstrate that the person consented. In practice, the ICO points to keeping who consented, when, what they were told, and how they consented.

That gives you four fields to think about for every opt-in:

What to record Why it matters Where it comes from in Shopify
Who Ties the consent to one customer Customer ID or email in the export
When Shows the consent predates your first message Consent timestamp in the API, not in the CSV
What they were told Proves the wording was specific and clear Your own dated copy of the form text
How Shows an active opt-in, not a pre-ticked box Your form setup, plus the opt-in level in the API

The ICO also lists consent among the records you need to keep to show compliance, alongside your processing records and breach log. Treat the CSV as one input to that file, not the file itself.

Pull the timestamps with the Admin API

If you or your agency can run a GraphQL query, Shopify exposes more than the CSV does. The email consent state object has these fields:

  • marketingState: the current status.
  • marketingOptInLevel: the opt-in level the customer gave, such as single or confirmed opt-in.
  • consentUpdatedAt: when the consent was recorded.
  • sourceLocation: the location tied to the consent, where one applies.

Reading these requires the read_customers access scope. A custom app created in your Shopify admin can hold that scope, and a developer can write a query that lists customers with these fields and saves the result as a dated file.

Two cautions from Shopify’s documentation. First, the consent state reflects the record with the most recent consentUpdatedAt, so you see the latest event rather than every event. Second, if no date is sent when consent is recorded, Shopify uses the time the information arrived. That is why imports deserve care, as covered below.

So even the API gives you a better snapshot, not a full ledger. If you want a real history, you build it by exporting on a schedule and keeping the files.

This is a practical routine for a store that sells to EU or UK customers or just wants clean records. It uses only what Shopify gives you plus files you keep yourself.

  1. Freeze the wording. Every time you change a signup form, checkout checkbox or account consent text, save a screenshot and the exact copy with the date. File names like 2026-10-23-footer-signup.png are enough.
  2. Export on a schedule. Run the Customers export monthly or quarterly and store the CSVs in a restricted folder. Each file is a dated snapshot, and together they show when states changed.
  3. Pull API timestamps. If you have developer help, save the consentUpdatedAt and opt-in level alongside the snapshot.
  4. Test each consent path. Submit each form yourself, export, and check the resulting values. A recent Shopify community thread makes the same suggestion: capture the form copy, submit each consent type, export, then opt out and check again.
  5. Log withdrawals. Honoring an unsubscribe is part of the record. Keep the date you processed it.
  6. Limit who can export. A consent file is customer data. Shopify staff permissions let you restrict customer exports under Settings > Users and permissions, where you can edit what each staff member may do.

Exports often go hand in hand with imports: you clean a list in a spreadsheet and bring it back. Be careful here.

The same Shopify help page notes that the customer CSV carries the Accepts Email Marketing column with valid entries of yes or no. Setting a column to yes in a file is not the same as a customer giving consent. Only import a yes for people who actually opted in, and keep the evidence outside the file.

Bulk changes are also limited. According to a Shopify developer forum answer, the email and SMS consent mutations are not available as bulk operation mutations, so updates generally go through individual API calls within rate limits, or through a re-import of customer CSVs. And Shopify’s reference for customerUpdate states that marketing consent must be set with the dedicated email or SMS consent mutations instead.

Before any import, export the current list and keep it. If something goes wrong, that file is your restore point.

Importing and updating consent without erasing evidence — overview diagram

If you run a cookie banner or consent platform on top of Shopify, exports get more complicated, because some consent decisions live in that tool. Before you swap or remove one, export its logs separately. Shopify’s Customer Privacy API is the browser-side API used to apply consent decisions to Shopify-managed surfaces, so a banner that does not integrate with it can leave pixels and checkout out of step with what the visitor chose. Confirm the integration, then test with a real browser session.

Also keep cookie consent and marketing consent apart in your records. They are different things: one governs trackers on your storefront, the other governs whether you may email or text someone. The customer CSV only covers the second.

We build AccountCraft, so we look at this problem from the account page. Most consent mess we see comes from the same cause: consent is collected in three places, a footer form, a checkout box and a popup tool, and each one writes something different. When it is time to export, nobody can say which one is right.

Our view is that the cleanest export is the one you do not have to reconcile. That means collecting and changing consent inside Shopify, through Shopify’s own customer privacy APIs, so the customer record you export is the record that counts. AccountCraft keeps customer data in Shopify and has no separate customer database. There is no second place to export from, and no sync to break.

Perspective: keep consent where the customer data lives — overview diagram

The second part is withdrawal. The ICO’s guidance says withdrawing consent should be as easy as giving it. If a customer can only unsubscribe through an email footer link, you depend on that link working. If they can also change their choice from their account page, you get fewer complaints and a record that matches what they actually want.

One limit, stated plainly: no app, ours included, makes a store compliant. We help you collect, record and honor consent through Shopify’s APIs. Deciding what the law requires of your store is your job, with legal counsel.

— Ivan Signorile

If you use New Customer Accounts, AccountCraft lets you build account pages with a visual Block Builder, no code and no theme changes. Among its 14 block types are an SMS consent block and a privacy consent block, plus update forms bound to customer metafields. Consent is handled through Shopify’s consent APIs, so what customers change on their account page is what your next export reflects.

There is a free plan, and the paid plans, Pro and Plus, are billed through Shopify. See the AccountCraft plans for what each includes, and check the Shopify App Store listing for current pricing. You can install AccountCraft free from the Shopify App Store.

For a walkthrough of testing your pixels and adding account consent, read our guide to Shopify customer consent without code.

A few neighboring topics change what your export means:

  • Double opt-in. A confirmed opt-in gives you stronger proof than a single checkbox. We cover the trade-offs in our piece on double opt-in for Shopify.
  • Consent that ages. If you have EU customers and are wondering whether old opt-ins expire, see Shopify consent expiry for EU stores.
  • US state privacy laws. For California-style opt-out requirements, our CCPA admin steps walk through the Customer Privacy API settings.

As a general rule, the more consent types you collect (email, SMS, cookies, account data), the more important it is to name each one in your records and keep their files separate.

  • Treating the CSV as proof. It shows current state only.
  • Not saving form copy. If you cannot show what the customer saw, the timestamp helps little.
  • Importing yes values for convenience. A list from a trade show or a purchase is not consent to email.
  • Overwriting old files. Keep every dated snapshot, not just the newest.
  • Leaving exports open to all staff. Restrict the permission and keep the files in a controlled folder.
  • Forgetting SMS and WhatsApp. The CSV has separate columns for each, so check all three.

FAQ

In your Shopify admin, go to Customers and click Export. The CSV includes Accepts Email Marketing, Accepts SMS Marketing and Accepts WhatsApp Marketing columns with yes or no values. Large exports are emailed to the store owner rather than downloaded in the browser.

Not in the standard customer CSV, which shows current status only. The Admin API’s consent state includes a consent timestamp, which a developer can read with the read_customers scope. Even there you see the latest recorded event, so save dated exports to build history.

Partly. You can re-import a customer CSV, but only mark yes for customers who really opted in. Shopify’s consent mutations are not available as bulk operations, so API updates happen customer by customer within rate limits.

No. An export is a record, and compliance depends on how you collected consent, what you told people and the laws that apply to you. Talk to legal counsel about your specific markets, such as the EU, the UK or California.

Sources