Guide · 8 min read · free tool
Etsy Privacy Policies: What GDPR Actually Requires of You
Sep 26, 2026 · Zelpura Editorial · All guides
Etsy requires every shop to have a privacy policy, and since the GDPR came into force it is no longer a formality. If you sell to buyers in the EU or UK — and Etsy puts your shop in front of them whether you aimed there or not — you must state what data you collect, why, how long you keep it, who you share it with, and what rights the buyer has. Most sellers copy a template and change nothing, which is better than nothing and still not right.
This generator writes a policy from your actual details. Enter your shop name, contact email and country, then select what data you collect — basic order data, analytics, marketing, or all of it — and whether you use cookies. It produces a complete policy with numbered sections, in plain language, ready to paste into Etsy's policy settings.
Worked example. Shop "ClayAndCo", email "hello@clayandco.com", country "United Kingdom", basic data collection, cookies yes. The generator returns a seven-section policy covering what Etsy shares with you (name, email, delivery and billing address, order history), why you hold it (process and deliver the order, communicate about it, comply with legal and tax obligations), how long you keep it, who you share it with, cookies, the buyer's six GDPR rights, and how the policy changes.
Be honest about the data list. If you run a newsletter, select the marketing option — a policy that omits the data you actually collect is worse than no policy, because it is inaccurate. The same applies to analytics: if you look at Etsy Stats, say so. The generator writes what you select, so select truthfully.
The rights section is the part buyers and regulators care about. Access, correction, erasure, restriction, portability and withdrawal of consent — all six, with your email address and a 30-day response commitment. That commitment matters: GDPR gives you one month, and stating it in your policy shows you know it.
Retention is the section most templates get wrong. "We keep data as long as necessary" is vague and unenforceable. Order and tax records have a legal minimum — typically six or seven years — and marketing data should be kept only until someone unsubscribes. The generator states both specifically.
Where to put it. Etsy Shop Manager → Settings → Policy settings → Privacy policy. Paste the text, save, and confirm it appears on a live listing. Also link it from your shop's about section and from your return and shipping policies, so a buyer can find it from anywhere in your shop.
One caveat, stated plainly: this is a well-structured starting point, not legal advice. If you sell into the EU or UK at any volume, or you collect anything beyond order data, have a lawyer read it once. That is a one-off cost that removes an ongoing risk.
Frequently asked questions
Does Etsy require a privacy policy?
Yes. Every Etsy shop must have one, and it must state what data you collect, why, how long you keep it, who you share it with, and what rights buyers have. Add it in Shop Manager → Settings → Policy settings.
Is an Etsy privacy policy generator output legally valid?
It is a complete, GDPR-aligned starting template, not legal advice. It is far better than a blank field or a copied template with the wrong shop name. If you sell into the EU or UK at volume, have a lawyer review it once.
What data does an Etsy seller actually collect?
Whatever Etsy shares with you: the buyer's name, email, delivery and billing address, and order history. You never see full card details — payments run through Etsy Payments. Add analytics and marketing data only if you actually use them.
How long should I keep customer data?
Order and tax records for the legal minimum in your country, typically six or seven years. Marketing data only until the person unsubscribes. State both periods explicitly in your policy.
Related: Etsy Return Policy · Etsy Shipping Policy · Etsy About Section · Etsy Shop Announcement · All 93 tools