You can collect and use a creator's name, address, and phone number to ship them the gift they asked for, without a separate consent checkbox. Keep the data only while you need it, tell the creator what you're doing with it, and don't move them onto your marketing list without an opt-in if they're in the UK or EU. Most small brands fall below the CCPA's thresholds, but GDPR reaches you the moment you gift a creator in Europe.
This is a plain-English guide, not legal advice. Pay a privacy lawyer if you get a letter from a regulator, if you have a data breach, or if you're anywhere near the CCPA thresholds below. For everything else, the steps here cost an afternoon.
This post covers the law. For collecting a complete address in the first place, see how to collect creator shipping addresses, and for keeping your roster when you leave a tool or agency, see who owns your creator list.
Is a creator's address personal data?
Yes, under every law that matters here. The California Consumer Privacy Act lists "postal address" by name as an identifier in its definition of personal information (Civ. Code § 1798.140). GDPR covers any information about an identifiable person. A creator's handle, email, phone, home address, clothing size, and what you sent them are all personal data. Having 80,000 followers doesn't make a home address public.
Which privacy laws actually apply to a small brand?
| Law | Applies when | Typical small DTC brand? | What it asks of you |
|---|---|---|---|
| GDPR (EU) | You offer goods to people in the EU, "irrespective of whether a payment" is required (Art. 3(2)) | Yes, if you gift to EU creators | Lawful basis, notice at collection, retention limits, deletion and access rights, processor contracts |
| UK GDPR and PECR | Same idea, for UK creators | Yes, if you gift to UK creators | Same as GDPR; consent for marketing email |
| CCPA / CPRA (California) | Revenue over $26,625,000, or 100,000+ CA consumers' data bought, sold, or shared a year, or 50%+ of revenue from selling or sharing data | Usually no | Privacy notice, access and deletion within 45 days, opt-out of sale or sharing |
| Other US state laws (Virginia, Colorado, and others) | Mostly 100,000+ state residents' data a year; tests vary by state | Usually no | Similar rights to the CCPA |
| CAN-SPAM (US) | Any commercial email, no size threshold, business-to-business included | Yes | Opt-out link, postal address, honest headers and subject lines |
Two notes on that table. The GDPR point catches US brands off guard. A free gift still counts as offering goods, so a brand in Ohio gifting a creator in Berlin is processing that creator's data under GDPR. The Article 27 duty to appoint an EU representative has an exemption for processing that is "occasional" and low-risk, which a handful of gifts a month plausibly is. A steady EU program is less clear-cut.
On the CCPA, the $26,625,000 figure is the California Privacy Protection Agency's inflation adjustment, effective January 1, 2025 (the statute still says $25 million). The 100,000 test counts data you buy, sell, or "share," and "sharing" includes passing data to ad platforms for cross-context behavioral advertising. A high-traffic store running ad pixels can get close to that line through its store visitors, not its creators. If that could be you, that's the one to ask a lawyer about.
Can you use a creator's address without their consent?
Yes. This is the part most brands get backwards. Consent is only one of six lawful bases under GDPR Article 6, and it's the weakest one for shipping because it can be withdrawn at any time. Two better bases fit gifting:
- Contract or pre-contract steps (Art. 6(1)(b)). The creator asked for the gift and gave you their address so you could send it. Processing "at the request of the data subject" is covered.
- Legitimate interest (Art. 6(1)(f)). You have a legitimate interest in sending product to creators, and a creator who handed over their address expects you to ship to it.
What GDPR does require is transparency. Article 13 says that at the point of collection you tell the person who you are, why you're collecting the data and on what legal basis, who else receives it, how long you'll keep it, and what rights they have. That is a notice, not a consent checkbox. The privacy line below covers it.
The limit is purpose. Data collected "for specified, explicit and legitimate purposes" can't be reused for something incompatible (Art. 5(1)(b)). Shipping the gift, following up about the post, and sending a second gift fit the purpose. Adding them to your weekly newsletter doesn't.
Can you put gifted creators on your marketing email list?
US creators: legally yes, without prior consent. CAN-SPAM is an opt-out law. Per the FTC's compliance guide, every commercial email needs a clear opt-out, your valid physical postal address, and honest headers and subject lines, and you must honor opt-outs within 10 business days. Each violating email can cost up to $53,088. Legal isn't the same as smart: a promo blast the day after the PR box lands makes a creator feel like a lead.
UK and EU creators: generally no, not without consent. The UK regulator, the ICO, says you must not send marketing email to individuals unless they have specifically consented. The "soft opt-in" exception covers people who bought, or negotiated to buy, something from you. A gift isn't a purchase, so don't lean on it. EU countries apply similar rules under the ePrivacy Directive.
The answer that works everywhere: an unticked, optional checkbox on the gift form, "Send me launches and brand news by email." Whoever ticks it goes on the list. Nobody else does. One-to-one emails about their gift, their post, and your next gift aren't marketing blasts and don't need the box.
See it running on a real store
Real orders, real creators, real numbers — not a demo.
Read the case studyHow long can you keep creator addresses?
GDPR's rule is "no longer than is necessary" for the purpose (Art. 5(1)(e)). It sets no fixed number, so you set one and write it down. A policy that is simple to defend:
- Active creators: keep their address while you're gifting them. Re-gifting is part of the original purpose.
- Inactive creators: after 24 months with no new gift, delete the address from working lists (spreadsheets, CRM, email tool). Keep the handle and a "gifted, posted" note if you want.
- Order records: keep them as long as your tax records require. The IRS baseline is 3 years from filing, longer in some cases. Your $0 gift orders are those records, and GDPR lets you keep data you're legally required to hold (Art. 17(3)(b)).
- Spreadsheets shared with a VA: the worst place for addresses. Delete the rows once the order ships. The order already holds the address.
What do you do when a creator asks you to delete their data?
It happens rarely, and it takes about 20 minutes. Do it the same day.
- Confirm it's really them. Reply from the thread or account they used with you, not a new unknown address.
- Find every copy. Shopify, spreadsheets, email tool, DMs you exported, and anything an agency or VA holds.
- Erase in Shopify. On their customer profile, use More actions, then Erase personal data. Shopify says the erasure request covers your store and the apps and channels you have installed, and that sale details such as what was sold and when stay visible with the personal details redacted. You're responsible for anyone else you shared the data with.
- Tell your agency or VA in writing to delete their copy, and get a "done" back.
- Reply to the creator. GDPR gives you one month, extendable by two more for complex requests (Art. 12(3)). The CCPA, if it applies to you, gives 45 days, extendable once by 45 (§ 1798.130).
A reply you can paste:
Hi [name], done. We've deleted your address, phone number, and email from our creator records and asked [agency/tool] to do the same. We keep a record of the order itself for tax purposes, with your personal details removed where our systems allow. You won't hear from us again unless you reach out.
Can you share your creator list with an agency or VA?
Yes, as long as they work for you and not for themselves. The law treats that as a processor (GDPR) or service provider (CCPA), and both require a written contract that limits what they can do with the data. GDPR Article 28 requires processing to be "governed by a contract." In practice:
- Put a data clause in the agency contract. They use creator data only for your campaigns, don't reuse it for other clients, keep it secure, and delete or return it when the engagement ends. Most agencies have a standard data processing agreement; ask for it.
- Give access, don't send files. A seat in a tool you control can be revoked. A spreadsheet in someone's inbox is permanent.
- Don't swap lists with other brands. Handing your creator addresses to a friendly brand for their gifting is no longer processing on your behalf. It's disclosure to another controller, and possibly a "sale" under state law. Share handles, not addresses, and let the other brand ask the creator directly.
The realistic risk for a small brand isn't a GDPR fine. The theoretical ceiling is €20 million or 4% of worldwide turnover (Art. 83(5)), but regulators focus on bigger fish. The real risk is a leaked sheet of creators' home addresses, and the creator who finds out how theirs got out. That's a reputation problem in a community where everyone talks.
A privacy line to paste on your gift form
Put this directly above the submit button, and link it to your full privacy policy:
We use your name, address, phone, and email to ship your gift and to contact you about it and future gifts. We share them only with our shipping and fulfillment providers and the tools we use to run gifting. We keep your address while we're gifting you and delete it after 24 months of inactivity, except order records we must keep for tax. To see or delete your data, email [privacy@yourbrand.com]. We will not add you to marketing emails unless you tick the box below.
Then add a short "Creator gifting" paragraph to your store's privacy policy saying the same thing, including the legal basis for EU and UK creators (to fulfil the gift you requested, and our legitimate interest in working with creators). If you run gifting through Seed, the gift form lets you add your own terms text with an agreement checkbox, so the notice sits exactly where the creator enters their address. Each submission becomes a Shopify order rather than a row in a shared sheet.
The checklist
- Privacy line on the gift form, linked to your policy.
- Marketing email opt-in as a separate, unticked box.
- Addresses live in Shopify orders, not in shared spreadsheets.
- Written retention rule: 24 months of inactivity, tax records as required.
- A data clause in every agency or VA agreement.
- A deletion routine you can run in 20 minutes.
For the rest of your creator paperwork, see the influencer agreement and gifting contract guide. For gifts shipped abroad, see international creator gifting, shipping and customs.
FAQ
Do I need consent to store a creator's shipping address?
Not under GDPR, if you use it to ship the gift they asked for. Shipping is covered by "performance of a contract" or steps taken at the creator's request (Article 6(1)(b)), or by legitimate interest (Article 6(1)(f)). What you do need is transparency: tell the creator, at the point of collection, who you are, what you'll use the data for, how long you keep it, and how to ask for deletion.
Does the CCPA apply to my small Shopify brand?
Probably not. The CCPA applies to for-profit businesses that do business in California and meet one of three tests: annual gross revenue above $26,625,000 (the 2025 inflation-adjusted figure), buying, selling, or sharing the personal information of 100,000 or more California consumers or households a year, or earning half or more of revenue from selling or sharing personal information. Most brands gifting to creators meet none of these.
Can I add gifted creators to my email marketing list?
In the US, CAN-SPAM does not require prior consent, but every marketing email needs a working opt-out honored within 10 business days, your physical postal address, and honest subject lines. For UK and EU creators, marketing email to individuals generally needs prior consent, and the "soft opt-in" for existing customers is tied to a purchase, which a gift is not. The clean answer everywhere is an unticked opt-in checkbox on the gift form.
How long can I keep creator addresses?
GDPR says no longer than you need them for the purpose you collected them. A defensible policy for a small brand: keep the address while you're actively gifting that creator, delete it from working lists after about 24 months without a new gift, and keep order records as long as your tax records require (the IRS baseline is 3 years).
What do I do if a creator asks me to delete their data?
Confirm who they are, delete them from your spreadsheets, email tool, and any agency's copy, and use Shopify's "Erase personal data" action on their customer profile, which covers your store and installed apps. Reply within one month for EU and UK creators (GDPR Article 12(3)), or 45 days under the CCPA if it applies to you. Records you're legally required to keep, such as tax records, can stay.
Can I share my creator list with an agency?
Yes, if the agency works on your behalf and under a written contract that limits what they can do with the data. Under GDPR that is a processor agreement (Article 28); under the CCPA it is a service provider contract. Give access through a tool you control rather than emailing a spreadsheet, and revoke it when the engagement ends. Selling or trading the list to another brand is a different act and needs a much stronger basis.