What Public Data Can You Legally See About a Shopify Store?

You want to know what a rival is charging, launching and advertising, and whether you are allowed to look. Going by how U.S. courts have read the Computer Fraud and Abuse Act so far, reading what a Shopify store shows to every visitor is not hacking. The risk starts when you automate collection at scale, because Shopify's own terms and contract law reach further than the hacking statute does.

This is background with its sources, not legal advice. It covers U.S. law and the platforms' own terms. If you are outside the U.S., this post does not cover your local law, so check it before you build anything.

Is it illegal to look at a competitor's Shopify store?

Looking at a competitor's Shopify store is not illegal; reading their product pages and prices is what any shopper does. The U.S. Supreme Court (Van Buren, 2021) and the Ninth Circuit (hiQ v. LinkedIn, 2022) have both read the CFAA narrowly, so viewing pages that need no login is not "unauthorised access". Automated, systematic collection is a different question.

The mechanics of what you can see are in how to spy on a competitor's Shopify store, using only what's public. This post answers the next question: whether you are allowed to.

What does U.S. hacking law actually ban?

The Computer Fraud and Abuse Act (CFAA) bans accessing a computer "without authorization" or in a way that "exceeds authorized access". Two court decisions now limit both phrases. Together they say that pages open to the public are not off-limits under the CFAA, even if the site owner would rather you did not read them.

The first is Van Buren v. United States, decided by the Supreme Court on 3 June 2021. The Court's syllabus says a person "exceeds authorized access" when they get into a computer with permission "but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off-limits to him" (Supreme Court opinion). The test is whether you reached a closed area, not why you looked.

The second is hiQ Labs v. LinkedIn. On 18 April 2022 the Ninth Circuit affirmed an order stopping LinkedIn from blocking a data analytics company's "access to publicly available member profiles". The court's summary says the CFAA "'without authorization' concept is inapplicable where, as here, prior authorization is not generally required but a particular person—or bot—is refused access" (Ninth Circuit opinion).

Neither Van Buren nor hiQ turns on why someone looked, only on whether the area was closed to them. A Shopify storefront needs no login to browse. On that reasoning, reading it is not hacking under the CFAA.

So why isn't "it's public" the end of the story?

Because the CFAA is only one law. The Ninth Circuit's hiQ opinion also says hiQ "raised serious questions" about a possible tortious interference claim, which is a separate legal theory from hacking. Contract and tort claims are judged case by case, and winning on the CFAA does not settle them.

In plain terms: a site can't usually call reading public pages a crime, but it may still argue you broke its terms or harmed its business. That risk grows with how much you collect, how often, and what you do with it.

Do Shopify's own API Terms forbid scraping a rival's store?

Shopify's API Terms do forbid automated collection. Its API License and Terms of Use, last updated 7 October 2026, bar, in Section 2.3(14), using the Shopify API "to conduct any systematic or automated data collection activities (including scraping, data mining, data extraction and data harvesting)" (Shopify API Terms).

The same clause bars using it "to build any commerce or product index". The terms open with "By accessing or using the Shopify API, you agree to this Shopify API License and Terms of Use".

Two more clauses go further:

• Section 2.3(8) says you may "not modify, translate, reverse engineer, disassemble, reconstruct, decompile, copy, scrape, mine" Merchant Stores and the Services.
• Section 2.3(24) rules out using it to "reproduce substantial portions of a source's product pages, catalogs or content feeds".

The grey area in Shopify's API Terms is that opening line. Shopify's developer docs call the storefront Ajax API "an unauthenticated API" (Shopify Ajax API docs). The same page says it "can't be used to read any customer or order data, or update any store data", so what it shows is product-side data. Nobody signs in to use it. The terms also say a developer "must obtain an API Client by registering for a Partner Account". Yet their first line binds anyone "accessing or using" the API, and they don't say whether opening an Ajax URL in a browser counts as that.

Neither Van Buren nor hiQ says whether casually opening a store's Ajax URL counts as using the Shopify API. So treat it as open. A person who looks now and then is in a very different position from a script that sweeps thousands of stores and builds a product index, which is exactly what Section 2.3(14) names.

Does ignoring robots.txt break the law?

Not by itself, as far as Shopify's own docs go: they treat robots.txt as a file for crawlers, not a legal barrier. They say "Shopify generates a default robots.txt file that works for most stores", and that a store's own robots.txt.liquid template "replaces Shopify's generated robots.txt output" (Shopify robots.txt docs).

That does not make it safe to ignore. A store owner who blocks a path in robots.txt has said what they want, and a script that walks past it is easy to describe as deliberate. If you ever run a crawler, obey the file. If you only browse by hand, it doesn't apply to you.

Are the ad libraries legal to use?

Meta's and TikTok's ad libraries are legal to use; they exist so people can look. Meta describes its Ad Library as "a comprehensive, searchable database for ads transparency" (Meta Ad Library tools). Bulk, programmatic access is a separate route, with its own approval steps on both Meta and TikTok.

• Meta: the page says "Authorized users can also analyze active and public branded content running on Facebook and Instagram via the API." Searching by hand is the ordinary use; the API is for approved users. The ordinary search route is covered in how to find a competitor's Facebook ads.
• TikTok: its Commercial Content API needs an application. TikTok's getting-started page says "Once your application is approved, a research client will be generated for your project" (TikTok getting started, last updated 27 August 2026). Its product page adds that "in this phase we are ONLY including data from EU countries" (TikTok Commercial Content API).

The pattern is the same as Shopify's. Looking is what the ad libraries are for. Collecting in bulk goes through each platform's approved API, on its terms.

Where is the line between looking and scraping?

The line is automation and scale. A person opening pages, reading prices and writing notes is a shopper. A program that collects data systematically, stores it, and rebuilds a rival's catalogue is what Shopify's terms name and what contract claims are about.

Pace marks the difference more than the pages do. A shopper's reads spread out over a day the way any browsing does. A script's reads land seconds apart, all at once — the pattern Shopify's terms call "systematic or automated."

Say you sell scented candles and a rival launches a winter range. You open their store, read each product page, note the prices and check whether they're running ads in Meta's Ad Library. Now say you write a script that pulls every product from that store and dozens of others every hour, saves it all, and republishes the catalogues on your own comparison page. The first is reading. The second runs into Section 2.3(14) ("product index") and Section 2.3(24) ("substantial portions of a source's product pages") at once, and it is the kind of activity a tortious interference claim gets built on.

Most founders never need the second. If you're watching a handful of rivals to price and plan, the manual route covers it, and a competitor watchlist keeps it organised.

What should a founder do in practice?

Read like a shopper, use each platform's own research tools, and stop to read the terms before you automate anything. If you plan to collect data at scale or build a product on it, pay a lawyer first. A short checklist:

1. Browse by hand. Product pages, collections and prices that any visitor sees are the safe ground.
2. Use the ad libraries as built. Search Meta's Ad Library directly. Apply through Meta's or TikTok's programmes if you need bulk data.
3. Never log in to see more. Anything behind a sign-in is the kind of "off-limits" area Van Buren describes. Shopify's Ajax API can't read customer or order data anyway; don't look for a way around that.
4. Read the terms before you write a script. Shopify's API Terms Section 2.3(14) names automated collection and product indexes directly.
5. Obey robots.txt if you crawl. It is the store owner's stated wish, and ignoring it looks deliberate.
6. Don't republish what you collect. Reproducing "substantial portions" of a rival's product pages is named in the terms.
7. Get counsel for anything at scale. Contract and tort claims are decided case by case, and this post is not legal advice.

For what you can actually read from those pages once you're on the right side of the line, can you see a competitor's Shopify inventory goes deeper on stock.

How does ecvision stay on the public side?

ecvision works only from what competitors make public, and never asks for access it doesn't have. That means no customer data, no order data and nothing behind a sign-in. Its homepage puts the second half in one line: "We never ask for your Shopify login."

If you want the full picture of what the product watches, what ecvision is and how it works covers it, and the plans are on the pricing page.