Is it legal to monitor competitor Shopify prices?

Comparing competitor prices is normal and legal - retailers have done it forever, and 'mystery shopping' a competitor's public prices is routine. Reading a Shopify store's public storefront data (its product pages, its products.json feed) is, in essence, the same thing: looking at information the store chose to make public to every shopper.

Where you need to be careful is HOW you collect it, what you do with it, and whether any specific terms or laws apply to your situation.

The key distinction is public versus protected. Reading a page or endpoint that's open to anyone, with no login and no technical barrier, is very different from breaking into a private system. In the US, the Computer Fraud and Abuse Act (CFAA) targets 'unauthorized access' - and in hiQ Labs v. LinkedIn, the Ninth Circuit indicated that accessing publicly available data generally isn't 'unauthorized access' under the CFAA.

Two caveats on that case: the CFAA ruling was later narrowed, and hiQ ultimately lost/settled on LinkedIn's breach-of-contract (terms of service) claim. So 'not a CFAA violation' doesn't automatically mean 'allowed under every theory' - contract and trespass claims can still come into play. That said, Shopify's /products.json is public by design (no credentials, no bypass), which puts reading public storefront data on much firmer footing than anything requiring a login.

Don't confuse two different things. Shopify's API Terms govern the Admin API - the authenticated API a store owner (or an app they install) uses to manage their store. Reading another store's public storefront isn't using that API at all; it's just visiting the public website, the same as any customer.

That said, a store's own Terms of Service for its website may include provisions about automated access. How enforceable those are depends on whether you actually agreed to them - 'clickwrap' terms you click to accept are far more enforceable than 'browsewrap' terms buried in a footer link that a non-logged-in visitor never agreed to. They're generally hard to enforce against reading public data, but it's worth knowing they can exist.

robots.txt is a store's request to automated crawlers about what to access and how. It isn't a law, but respecting it is good practice and good manners. Alongside it: identify yourself with a normal User-Agent, keep request rates low, cache responses, and never overload a store's servers. Excessive, aggressive scraping that degrades a site is where you invite trouble - both legally and ethically.

Facts - like a price, a SKU, or whether something is in stock - generally aren't copyrightable. But a product's photos and marketing copy are. So monitoring and comparing prices is fine; republishing a competitor's images and descriptions as your own is not. Use the data to inform your decisions, not to copy their content.

Privacy laws like GDPR and CCPA are about personal data - information about people. Product catalogs, prices and stock levels aren't personal data, so routine price and catalog monitoring doesn't raise the same concerns. (If you were collecting data about individuals, that would be a different conversation.) One EU-specific note: the 'sui generis database right' can protect a substantial, systematically-assembled database - another reason to use competitor data to inform your own decisions rather than wholesale-copying someone's entire catalog.

Shop Sentry is built around exactly these principles. It only reads publicly available product data from Shopify storefronts, at respectful crawl rates, with no bypassing of protections and no access to login-required content. You get price, stock and catalog monitoring - the legitimate, long-established kind - without doing anything questionable.