Most Shopify stores go live with a beautiful theme, a working checkout and a legal position that would not survive one annoyed customer or one regulator with an afternoon free. Nobody plans it that way. The pages that protect a store are boring, none of them sells anything, and the launch checklist is always about the hero image.
This is the eighteen-point list we run before a store we manage takes its first order, grouped into the six places trouble actually comes from. Each item has the five-minute way to check it. None of this is legal advice, the rules differ by country and change, and a store selling to the EU, the UK and California at once has three sets of them. It is the list that stops you finding out which set applies from a letter.
Documents: the five pages that have to exist
1. Privacy policy. What you collect, why, who you share it with (Shopify, your email app, your ad pixels), how long you keep it, and how someone asks for it to be deleted. Shopify generates a template under Settings, Policies. Read it before publishing, because the template does not know which apps you installed, and an inaccurate privacy policy is worse than a thin one.
2. Terms of service. Who the contract is with, what happens when an order cannot be fulfilled, governing law. Same generator, same warning.
3. Refund and returns policy. The one customers actually read. It has to be findable from the footer and the checkout, and it has to be true: if the policy says 30 days and your supplier only takes returns for 14, you are the one holding the difference.
4. Cookie policy. A list of what sets cookies on your store and why. Shopify itself, your analytics, your pixels, your chat widget, your review app. Most stores have twice as many as the owner thinks.
5. Shipping policy. Timescales, countries, who pays customs. Missing this is the most common source of chargebacks we see, because a customer who expected three days and waited three weeks calls the card company, not you.
Check: open your footer on a phone. All five links, all five pages, all five with real content rather than the placeholder that says Lorem or the template’s square brackets. We have found “[Your Company Name]” in live policies on stores taking real money.
Consent: asking before you take
6. A cookie banner that actually gates things. A banner that says “we use cookies” with one OK button does not obtain consent under the EU or UK rules; it announces. Shopify has a built-in banner under Settings, Customer privacy, that can be shown by region and that blocks tracking until accepted. Turn it on for the regions that require it, and make declining as easy as accepting.
7. Form consent. Every form that collects an email says what the email will be used for, and marketing consent is a separate, unticked box. Pre-ticked boxes do not count in Europe, and a newsletter signup that is quietly also a marketing consent for SMS is how brands end up on the wrong side of the TCPA in the United States.
8. Collect only what you need. If the checkout asks for a phone number and you never call anyone, stop asking. If the account page asks for a date of birth and you sell socks, stop asking. Every field is something you now have to protect.
Check: open the store in a private window from an EU IP if you can, or with a VPN. Do the pixels fire before you have touched the banner? The Network tab in the browser’s developer tools will tell you in ten seconds.
Tracking: what your store sends without telling you
9. Analytics and pixels. Know which ones are installed. Shopify’s Customer Events and the official Google and Meta channels respect the consent banner; a pixel pasted into theme.liquid by a freelancer two years ago does not. Route every pixel through Shopify’s pixel manager so consent applies to all of them at once.
10. Third-party embeds. The Instagram feed, the review carousel, the size-chart popup, the chat bubble, the map on the contact page. Each is a script from another company, and each sets its own cookies and sends its own data before your banner has been read. List them. Remove the ones nobody would miss. For the rest, find out whether the app honours Shopify’s consent settings; the good ones say so on their listing.
Check: load the home page with the developer tools open and count the domains in the Network tab. If you cannot name what each one is for, you cannot describe it in your privacy policy either.
Accessibility: the law caught up in 2025
Since 28 June 2025 the European Accessibility Act applies to e-commerce services sold in the EU, and the standard everyone points at is WCAG 2.2 level AA. In the United States, accessibility suits against online stores are a settled industry. The four items below are the ones that fail most and cost least to fix.
11. Alt text on images. Every product image and every banner with words in it. Shopify has an alt-text field on each image; the theme demo you started from did not fill it, and neither did the CSV import.
12. Colour contrast. Normal text needs a 4.5 to 1 ratio against its background. Grey-on-white body copy, the light-grey placeholder in the search box and the white text over a bright hero image are the usual failures. Themes ship with tasteful greys that do not pass.
13. Keyboard. Press Tab from the top of the page and go all the way to the checkout button. Can you see where you are at every step? Can you open the menu, the size selector and the cart drawer without a mouse? If focus disappears into a carousel and never comes out, so does the customer.
14. Button labels that say what they do. “Add to cart”, not “Click here”. Icon-only buttons (the cart, the search, the close cross) need a text label a screen reader can speak. Most themes do this; most apps do not.
Check: a free browser extension such as axe or WAVE will find the contrast and alt-text failures in a minute. The keyboard test needs a human and takes five.
Honesty: the claims and the reviews
15. No fake reviews, and no bought ones. In the United States the FTC’s rule on consumer reviews took effect in October 2024 and carries civil penalties per violation for fake reviews, reviews written by insiders without disclosure, and paying for positive reviews. The UK’s consumer law reforms treat the same things as banned practices. This includes the review app’s “import reviews from AliExpress” button. If a review was not written by a customer of your store about the product on the page, take it down.
16. No claims you cannot support. “Clinically proven”, “dermatologist recommended”, “best-selling”, “as seen in”, before-and-after photographs, “only 3 left” when there are three hundred, countdown timers that reset on reload. Each of these is either true and documented or it is a problem. The fake-scarcity ones are the easiest to find, because the app that makes them advertises itself.
Check: read your own home page and product pages as if you had to prove every sentence to a stranger with a clipboard. Circle the ones you could not.
Rights: what you are allowed to use and where you are allowed to sell
17. Image copyright. The lifestyle photographs in the theme demo are licensed to the theme developer for the demo, not to you for your store. Product photos copied from a supplier’s site belong to the supplier. Photos found on Google belong to whoever took them. Use your own, buy a licence, or use a stock library whose licence covers commercial use and keep a record of which image came from where. Stock photo licensing letters arrive years after the fact and they are priced to be paid rather than fought.
18. Local law where your customers are. Selling online to the UK or the EU gives the customer a 14-day right to cancel most orders for any reason, and your returns policy has to allow it whatever it says. Some products need age verification, some need labelling in the customer’s language, some cannot be shipped to some countries at all, and sales tax registration thresholds arrive without warning as a store grows. Know which three countries you actually sell to and read their rules for your product category before the first order, not after the first complaint.
Check: Shopify Analytics, Sales by billing country, last ninety days. Those are your jurisdictions.
The order to do it in
Documents first, because they are an afternoon and their absence is the easiest thing to spot. Then consent and tracking together, because they are the same job seen from two sides. Then reviews and claims, because those are the ones that draw fines rather than letters. Accessibility and rights are the long tail, and they are also the ones that improve the store rather than merely protecting it: a store you can use with a keyboard and read in bright sun sells better to everyone.
We run this list on every store before launch and again once a year, because apps get added and policies drift. If you would like it run on yours, the contact page is the place; put “launch check” in the message and we will send back the eighteen answers for your store, with what we would fix first.
