This tool generates a starting draft based on the structure Etsy's own in-house legal team outlines in the Seller Handbook — it is not a legal opinion about your specific shop. Data protection law varies by country and changes over time. If you sell to the EU, UK, or California, or handle sensitive information, have the result reviewed by a qualified attorney before publishing it. This is the same recommendation Etsy's own guidance gives.
An Etsy privacy policy tells buyers what personal information your shop collects, why, who you share it with, how long you keep it and what rights they have. Etsy requires one if you are based in the EU or sell to EU buyers, and recommends one for all sellers. Add it under Shop Manager → Settings → Policy settings.
What an Etsy privacy policy must cover
Etsy's Seller Handbook, in an article written by a member of Etsy's legal team, sets out what a shop privacy policy should disclose. The generator above produces a section for each:
| Section | What to say | Why it is needed |
|---|---|---|
| Information you collect | Name, email, delivery address, messages, order details | Buyers have a right to know what is held about them |
| Why you use it | To fulfil orders, answer messages, meet legal duties | GDPR requires a stated legal basis for each use |
| Who you share it with | Etsy, payment processors, delivery carriers, any tools you use | Buyers must know which third parties receive their data |
| How long you keep it | A period tied to a reason, such as tax record rules | Data should not be kept longer than necessary |
| Transfers outside the EU/UK | Whether data goes to services outside Europe | Required disclosure when it does |
| Buyer rights | Access, correction, deletion, objection, complaint | Required under GDPR for EU and UK buyers |
| How to contact you | An email address that you check | So buyers can exercise those rights |
How to add it to your Etsy shop
- Generate the draft above with your shop name and contact email.
- Edit it to match reality. If you use an email tool, a print partner or a file-delivery service, name it. If you do not run a newsletter, remove that section.
- Open Shop Manager → Settings → Policy settings and select the Privacy tab.
- Select Create a policy, paste your text, and select Publish.
- Review it once a year, and whenever you add a new tool that handles buyer details.
Insight: The most common privacy-policy mistake on Etsy is not a missing clause but an untrue one — a policy copied from another shop that mentions services you do not use, or misses the ones you do. Buyers rarely read it; regulators and complaint handlers do. Accuracy beats length.
GDPR basics for Etsy sellers
The EU's General Data Protection Regulation applies to sellers in the EU and, in many cases, to sellers outside the EU who sell to people there. The UK has its own version with the same core ideas. For a typical Etsy shop the practical points are:
- Collect only what you need. Etsy gives you a buyer's name, address and email to fulfil the order; do not ask for more without a reason.
- Use it only for the order. Marketing needs separate, active consent.
- Keep it safe. Do not store order details in shared spreadsheets or personal email folders longer than needed.
- Respond to requests. If a buyer asks what you hold about them, or asks you to delete it, reply promptly. Some records, such as those you must keep for tax, can be kept for the legally required period.
- Report serious breaches. If buyer data leaks — for example a lost laptop with order exports — you may have to notify your data protection authority.
Marketing emails need separate consent
Getting a buyer's email to deliver an order does not let you add them to a newsletter. Etsy's guidance is explicit: you need clear, affirmative consent — the buyer actively agreeing to marketing — before sending promotions, and you must honour opt-outs at any time. The newsletter checkbox in the generator adds a dedicated consent section for this reason.
Good ways to build a list without breaking the rule:
- A sign-up link on your own website or in your Etsy shop announcement, where buyers opt in themselves.
- A free bonus file offered to anyone who signs up — not only to buyers, and not in exchange for a review.
- A one-line mention in your thank-you file, pointing to the sign-up page rather than adding anyone automatically.
Privacy points specific to digital products
| Situation | What to disclose |
|---|---|
| You deliver files through Etsy's instant download | Nothing extra — Etsy handles delivery |
| You send files or links by email | That you use the buyer's email for delivery, and which email service you use |
| You share a Canva, Notion or Google Drive template link | That the link opens a third-party service with its own privacy policy |
| You personalise files with the buyer's name | That you use the name only to create their file, and how long you keep the file |
| You run a newsletter or customer list | The consent section, the email tool you use and how to unsubscribe |
What the generated draft contains
The draft opens with an effective date and your shop name, then follows the order a buyer would look for answers:
- Information we collect — the order and message details Etsy passes to sellers.
- How we use your information — fulfilling orders and customer support, legal duties and, if ticked, marketing with consent.
- Information sharing — Etsy, payment and delivery providers, legal requests, and a statement that you do not sell personal information.
- Data retention — how long you keep order records and why.
- International data transfers — added when you tick EU or UK buyers.
- Your rights — access, correction, restriction, deletion, objection and complaint.
- Marketing messages — only if you ticked the newsletter box.
- Contact — the email address buyers use for any of the above.
Each section is short, plain English. Replace any wording that does not describe your shop.
Selling to the US, Canada and Australia
Outside Europe, privacy laws mostly apply to larger businesses. California's privacy law, for example, applies only to businesses above set size thresholds, which most small Etsy shops do not meet. Canada and Australia have their own rules with different thresholds. None of this makes a privacy policy pointless: Etsy recommends one for every shop, and a clear, honest policy answers buyers' questions before they ask.
The rest of your shop policies
Etsy's policy settings have separate tabs for returns and exchanges, cancellations and Etsy's fixed delivery policies. Digital downloads are usually excluded from returns because the file cannot be returned, but say so plainly in the listing and your shop FAQ to avoid disputes.
Then finish the shop: a name that fits Etsy's rules with the Etsy shop name generator, polite review requests with the review message generator, and listings that set clear expectations with the Etsy description generator. If you are also deciding on a business structure, read do you need an LLC to sell on Etsy.
Etsy Privacy Policy: Frequently Asked Questions
Yes if you are based in the EU or sell to buyers there — Etsy says GDPR requires you to create and follow one. Etsy recommends that every seller have one anyway, and since most shops can receive EU orders, it is simplest to treat it as required.
In Shop Manager, go to Settings, then Policy settings, open the Privacy tab and select Create a policy. Paste or write your policy, or start from Etsy's sample, then select Publish.
Etsy offers a sample privacy policy in the Privacy tab that you can customise. This generator produces a fuller draft with your shop name, contact email and optional GDPR and newsletter sections, structured like the example in Etsy's Seller Handbook.
No. It is a starting draft. Data protection law differs by country and changes, so if you sell to the EU, UK or California, or handle anything sensitive, have it reviewed by a qualified professional — the same advice Etsy's own guidance gives.
Not without their clear, active consent. An email address collected to deliver an order does not give permission for marketing. Ask buyers to opt in separately, and honour unsubscribe requests straight away.
The same core sections as any shop — what you collect, why, who receives it, how long you keep it and buyer rights — plus any services that touch buyer data, such as an email tool, a file-delivery service or a Notion or Canva link you share.