Hi everyone — I’m a Shopify app developer and I’d like to raise an issue that feels like an unintentional “friendly DDoS” caused by the current webhook behavior around GDPR redaction events.
In normal conditions (including peak periods like Black Friday), my app handles Shopify traffic reliably. However, when a merchant performs a large bulk action on customers (e.g., deleting tens of thousands of customer records), Shopify appears to immediately fan out customer/redact requests to every connected app for each customer. This can create an avalanche of webhook deliveries in a very short time window.
A real example: on January 23, one merchant deleted 80,000+ customers over a couple of hours. Right after that, my app became overwhelmed and effectively got stuck trying to process the backlog. Nearly all of those customer/redact payloads were effectively identical, and importantly the orders_to_redact field was null or [] (no orders to redact).
This seems like an ecosystem-level scalability problem: bulk operations by one merchant can generate an extreme webhook burst to apps, even when there is no actionable data beyond the customer record itself.
Suggestion / request for Shopify to review policy and delivery behavior:
-
Do not send
customer/redactwhenorders_to_redactisnullor[], since there are no orders requiring redaction. -
Alternatively (or additionally), introduce batching, backpressure, or stronger throttling/queuing guarantees for these GDPR-related webhooks when bulk operations occur, so apps aren’t forced into overload conditions.
Has anyone else seen this behavior? And is there a recommended best practice on the app side beyond building a large queue + aggressive rate limiting to survive extreme bursts like this?
Thanks in advance — I’d really like to hear Shopify’s guidance here, because this can take down otherwise healthy apps during rare bulk delete events.