The moment you sell to a buyer in the EU or UK, you become a data controller for their name, address and order details — and their privacy rights come with them, whatever country your shop is in. Etsy handles a lot of the plumbing, but the policy that lists what you collect and the rights buyers have is yours to write. This guide explains when you actually need one, gives you a full fill-in template with the GDPR and UK-GDPR sections, and shows how to add it to your shop — grounded in the published rules, with nothing invented.
The short version
- Selling to EU or UK buyers makes you a data controller under GDPR / UK-GDPR, with obligations that attach to you as the seller, not just to Etsy.
- A GDPR-aware policy must list six data-subject rights: access, rectification, erasure, restriction, data portability and objection.
- Outside the EU and UK your burden is lighter — there is no single international rulebook, so a clear, plain policy plus a note that you check your local law is the honest baseline.
- Your policy should name the real third parties who see buyer data: Etsy, your payment processor and your shipping carrier.
- This is a plain-English template, not legal advice — check your own obligations before publishing.
01Do you need a privacy policy on Etsy?
Etsy does not force every listing to carry a privacy policy the way it requires a return policy. But that is not the same as not needing one. The moment personal data — a name, a delivery address, an order history — passes through your shop, data-protection law can apply to you as the seller.
The clearest trigger is geography. If you sell to buyers in the EU or the UK, GDPR and UK-GDPR treat you as a data controller for their information, and those obligations travel with the buyer whatever country your shop is registered in (source: gdpr.eu; ico.org.uk). A shop selling only elsewhere has a lighter burden, but no zero burden — a clear privacy policy is still the honest, low-effort way to meet buyers' expectations, and Etsy gives you a place to put one.
→ generate a tailored privacy policy — free, no account
02What Etsy already covers, and what your policy must add
Etsy runs the marketplace, so it has its own privacy policy covering how Etsy itself handles data, and it processes payments and hosts the checkout. That covers the platform — not you.
What your policy adds is the part only you know: what you personally collect and do with buyer data once an order reaches you. That includes the buyer's name and address (to ship), any personalisation details they send, and any direct contact you keep. Your policy names those, says why you hold them and for how long, lists the third parties who see them, and tells buyers how to exercise their rights. Etsy can't write that for you because only you know how your shop actually runs.
03The Etsy privacy policy template
Copy this, fill in the brackets, and delete anything that doesn't apply to your shop:
- Who we are: [Shop name] is run by [your name / business name], based in [country]. For questions about your data, contact us at [email or the Etsy Messages link].
- What we collect: to fulfil your order we receive your name, delivery address, and order details through Etsy, plus any personalisation information you send us. We do not see your full payment card details — Etsy processes payment.
- Why we collect it: to make and ship your order, to communicate with you about it, and to meet our legal and tax obligations.
- How long we keep it: we keep order records for [as long as tax law requires / X years], then delete them. We don't keep your data for marketing unless you've asked to hear from us.
- Third parties who see your data: Etsy (the marketplace and checkout), our payment processor (via Etsy), and our shipping carrier [name] to deliver your order. We never sell your personal information.
- Your rights: you can ask us to access, correct, or delete your data, or to restrict how we use it — see the sections below for the details that apply to you.
- Contact: to exercise any right, message us through Etsy or email [email]; we respond within [30] days.
04EU and UK additions (GDPR / UK-GDPR)
If you sell to buyers in the EU or UK, add a rights section that names the six rights GDPR and UK-GDPR give the buyer (source: gdpr.eu; ico.org.uk):
- Access — request a copy of the personal data you hold about them.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — request deletion of their data (the “right to be forgotten”).
- Restriction — limit how their data is processed.
- Data portability — receive their data in a portable format.
- Objection — object to processing, including for direct marketing.
State that you'll respond within one month, and give a real contact route. If a buyer in the EU or UK asks you to delete their data, that duty is yours, not Etsy's.
The rights are not optional and they are not Etsy's to grant on your behalf. If an EU or UK buyer asks you to delete their data, that duty is yours.
05Selling to the US and the rest of the world
Outside the EU and UK there is no single international privacy rulebook, so the honest baseline is a clear, plain policy plus a line telling buyers you follow the data-protection law where you sell. Buyers everywhere expect the same basics: know what you collect, why, and that you don't sell it.
One myth worth killing while you're at it: US sellers often think California's CCPA binds them. It only applies to businesses over large thresholds — over $25M in revenue, 100,000+ California consumers, or 50%+ of revenue from selling personal data (source: oag.ca.gov) — which almost no small Etsy shop meets. So don't write that your shop “is CCPA compliant”; a plain policy saying what you collect and that you never sell personal data is enough, and honest.
06How to add your privacy policy to your Etsy shop
In Etsy, your privacy terms live in your shop's policies:
- Go to Shop Manager, then Settings, then Policies (or Info & Appearance, depending on your view).
- Find the privacy or “Seller details / data” section and paste your policy there.
- If your shop layout has no dedicated field, add the policy text to your About section or a clearly labelled shop announcement pointer instead — the point is that a buyer can find it before they order.
- Review it whenever what you collect changes, or once a year, whichever comes first.
07Generate a tailored version
Rather than adapt the template by hand, you can generate a privacy policy for your shop that switches on the GDPR/UK rights based on where you sell — free, no account, and grounded in the same sources cited here. While you're at it, write the return policy Etsy actually requires too, and both policies are done in one sitting.