Shopify Store Owners Email List, Buy It or Build It

Build it rather than buy it, and use a detection tool for the first step. A file whose seller cannot give you the pull date and the source of each record leaves you blind to which stores still trade.

A detection tool such as BuiltWith gives you current Shopify domains, filtered by country, plan and installed apps. You then turn those domains into named owners, verify every address, and follow the email law of each owner's country.

The second half is where lists die. Unverified addresses bounce and hurt your sending domain. Owners you had no right to email report you, and that hurts more.

Which route actually gets you Shopify owner contacts?

There are four routes. They differ less on price than on what lands in your spreadsheet.

A detection seat is a paid login to a tool like BuiltWith that crawls the web for live sites. It starts from a live index, so you know the store exists today. A broker file starts from someone else's spreadsheet, and you inherit every mistake in it.

BuiltWith says it indexes the web itself and takes no data from third parties. It sells monthly plans with a 1-month minimum, priced in the table above (BuiltWith plans, at the time of writing). Basic tracks only 2 technologies.

The plans include "fully exportable lists of individuals publicly listed with businesses within GDPR restrictions". That is a contact layer, and the store owner may or may not be on it.

Wappalyzer, a second detection tool, publishes its plan prices on its pricing page, shown in the table at the time of writing. That page describes lead lists built by technology or keyword and puts contact details in single-site lookups, so budget for a contact tool after it too. I have not priced contact tools here, so get a current quote before you compare totals.

A cheap list from a freelancer gets the same verdict from me before I open it: low open rates and high bounces.

When my team runs outbound for a client, data and tool subscriptions are bought by the client directly, separate from our monthly fee, and scoped to their market and volume. So the route you pick here is a cost line you own, whether you build the list yourself or hire a cold email agency to run the campaign.

Here is how I would decide:

1. If a seller cannot give you the snapshot date and the source of each record, do not buy the file.
2. If you already pay for a contact data tool, add a detection seat for one month, export what you need, and build.
3. If a route ends at domains, add the contact tool and the verifier to its cost before you compare it with a broker quote.

The wider argument about bought lists, beyond Shopify, is in whether buying a B2B email list ever pays off.

How many Shopify stores are there, and why is every list a different size?

BuiltWith counts 6,772,983 live Shopify sites and 7,327,636 expired ones, out of 14,100,619 it has ever detected (BuiltWith Shopify usage, at the time of writing). About 52% of all sites it has detected are expired.

Shopify itself will not settle the number for you. Its investor page says only that it serves millions of merchants in 175+ countries, with no exact count (Shopify Investor Relations).

That is why every list you see has a different size. A detection tool counts sites that look live in a fresh crawl. A broker counts rows collected at some point it rarely states, and a contact database only counts stores where it found an email. Each gives a different total for the same platform, and none of those totals is the number of owners you can lawfully email.

The top of the market is fuzzier still. Shopify says the Plus plan adds B2B capabilities for businesses that negotiate separate product assortments or prices with individual companies. BuiltWith lists 116,499 live Shopify Plus sites. It also says Plus has been undetectable by public web methods since 2024.

Its separate group of 55,437 "Plus Inferred" sites is an estimate, based on each site's age and on which premium and standard technologies it does or does not use. So a Plus filter is part measurement and part guess, and you should treat it that way.

Which Shopify signals tell you a store is worth contacting?

Platform alone is a weak filter. Six million live stores include hobby shops and wholesalers alike. Signals narrow the field to stores that could buy what you sell.

The row I start with is the last one. Before I touch a detection filter, I look at who already pays the client, then search for stores that resemble them. Past clients count too, so check both lists before you go looking for lookalikes. If your last 10 merchant customers all sell apparel in the US on Plus, that is your first filter.

It also hands you the proof. Put those past merchant clients and the results you got them inside the message. An owner whose store looks like theirs reads that faster than any pitch.

Fit and timing are two different questions. Platform signals tell you which stores fit. Events such as a new hire, a replatform or a funding round tell you when a store might be ready to change. That second layer is its own method, covered in how timing triggers sit on top of fit.

How do you build a verified Shopify merchant list step by step?

Run these seven steps in order. Each one shrinks the list.

1. Filter live domains. Pull live Shopify domains for one country and one signal from the table above. A single country keeps the legal rules in the next sections simple.
2. Strip the dead and the doubles. Remove expired domains and duplicates. Remove stores already in your CRM, and anyone who has opted out of your email before.
3. Check who signed before. Open your past merchant deals and note who actually approved each one. I look at past projects to find the real decision-maker before I search for anyone new.
4. Search the true title. Your own past deals show whether the person who signs is the founder, the owner or a head of ecommerce. I search with the titles the niche really uses, never a bare "manager".
5. Cut the noise titles. I take assistant, associate and generic manager titles out of the search on purpose. An "ecommerce assistant" at a five-person store rarely signs anything.
6. Find a named address. Use a contact data tool to find the work email of that specific person at that specific domain.
7. Verify everything. Before a Shopify owner list goes live, I put every address through a verifier so the campaign bounces stay below half a percent. On cost, DeBounce's pricing page lists 100 free credits at sign-up and checks from $0.00045 each, at the time of writing. Addresses the verifier flags as invalid stay off the list. The reasoning behind that ceiling is in what a safe bounce rate looks like.

On a small store, an info@ or support@ address usually reaches whoever is answering customer tickets that week. That person can forward you, but they cannot say yes.

Where you source step 6 matters as much as step 7. A contact data tool with a named database links a person to a company and a title you can filter, so you can name the source if a contact asks. A scrape gives you strings of text with no history behind them, and you cannot answer a contact who asks where you got their address.

Keep that source noted on every row: under GDPR Article 14, EU contacts must be told where their address came from.

How should a first email to a store owner read?

The message should sell a short call. Leave the full product pitch for the call itself. Here is a made-up example from a returns app to the owner of a US apparel store:

Subject: January returns at Northfield Goods

Hi Dana, Northfield Goods sells apparel on Shopify and ships across the US, so January is probably your heaviest month for returns. We build a returns flow that plugs into Shopify and puts exchanges and refunds on one screen for the owner. Would a 15-minute call in the week of January 12 be worth it to see whether it fits your setup?

Sam Ortiz, Returnline, 400 Market Street, Suite 12, Denver, CO

This is a commercial message. Reply "no thanks" and I will stop writing to you.

The body names the store, its platform and one problem, and asks one question. The footer carries the sender identity and opt-out that the rules below require. Plan the follow-ups before the first send. Give them real time in between. Across our campaigns, the third follow-up usually does best.

Which email laws apply to Shopify store owners in the US, UK and EU?

In the US the rules come from CAN-SPAM, which has no carve-out for business-to-business email (FTC CAN-SPAM compliance guide). The guide lists what every commercial message must contain. Prior consent is not on that list. A store owner's work address is treated like any other.

Each commercial email must carry:

• your physical postal address (a street address, a USPS-registered PO box or a registered private mailbox)
• a clear statement that the message is advertising
• an opt-out that still works at least 30 days after the send
• opt-out requests honored within 10 business days, with no fee charged

Two more rules hit list buyers directly. Once someone opts out, you cannot sell or transfer their address, even as part of a mailing list. And harvesting addresses, or generating them with a dictionary attack, can bring criminal penalties, including prison. If a freelancer's "scrape" was built that way, it is your problem too.

A single non-compliant email can be fined up to $53,088, at the time of writing. Outsourcing does not move that risk. According to the FTC, legal responsibility cannot be handed off by contract, and liability can fall on the advertised company and on the sender alike. If you buy a list or hire someone to send, your name stays on the line.

In the UK, the first question is what kind of business the store is.

The email rule sits in Regulation 22 of PECR, the UK's Privacy and Electronic Communications Regulations. It covers unsolicited marketing email to individual subscribers. You need their prior consent, or the soft opt-in. Soft opt-in applies only where you got their details during a sale or sale negotiations, and it covers just similar products of your own.

You must offer a simple, free way to refuse, both when you collect the details and in every message after (PECR Regulation 22).

The ICO, the UK regulator, explains who counts as what in its business-to-business marketing guidance, which it marks as under review because of the Data (Use and Access) Act. As it stands:

• Limited companies and LLPs are corporate subscribers. You need no PECR consent to email them, but your identity has to be visible and each message needs a valid address where they can opt out.
• Sole traders are individual subscribers. PECR treats them like any private person, so the consent or soft opt-in rule applies.
• When you cannot tell which type a contact is, the ICO says to treat them as an individual.

That last rule matters for Shopify. A one-person store may well be a sole trader. Check the store's legal page or footer for a company name ending in Ltd, Limited or LLP. If you find none, the doubt rule applies.

UK GDPR sits on top of PECR. UK GDPR treats initials.lastname@company.com as personal data, but info@company.com falls outside it.

If you buy a list, using it must still comply with UK GDPR. You need a lawful basis, and you must give privacy information no later than one month after you obtained the data. Finding an address in public does not mean the person agreed to marketing. Nothing limits their right to object to direct marketing.

In the EU, GDPR Article 14 covers personal data not collected from the individual directly, which describes every bought or built list (GDPR, EUR-Lex). You must tell them who you are, why you hold their data, your legal basis, the categories of data, and which source it came from.

If you use the data to reach out, the notice is due by your first message at the latest.

Article 21(4) adds that the right to object must be stated explicitly in that first communication, clearly and separately from everything else.

The four cases side by side:

This is not legal advice.

What should you ask a Shopify list seller before paying?

When a campaign underperforms, most founders rewrite the email. I open the spreadsheet first. No copy can rescue a bad list or a sender nobody trusts. Same message, two companies. The first earned a 2% reply rate; the second earned 7.5%. The words were identical, so the difference sat outside the copy. With a bought file, the first place to look is the rows.

If you still want to test a broker file, make the seller do the work a builder does. Ask these five questions in writing:

1. What is the snapshot date of this file?
2. Which named source supplied each record?
3. How was each address verified, and when?
4. What share of the addresses are generic inboxes like info@ or support@?
5. Are UK sole traders flagged, so I can treat them as individuals?

Then test before you buy. Ask for a sample, run it through your own verifier, and look up 20 random rows by hand. If the sample already fails your bounce ceiling, do not expect the full file to do better.

If the only answer to "how was this verified" is the seller's word, treat the file as unverified. Keap's help documentation says purchased or scraped contact data typically has high percentages of invalid, unverified or stale addresses. That causes severe bounce and complaint problems.

ZeroBounce, an email verification vendor, gives 2% as the standard bounce rate benchmark. Go above it and your sender reputation suffers. I hold my own lists far tighter, under 0.5%, because 2% is where the damage starts, and I want room below it.

A good file also has to be big enough. My rule is that a first outbound list holds at least 20,000 contacts, so if one country and one signal give you far fewer, widen the signal before you add a second country. Quality alone falls short; you need quantity too. Volume negates luck.

A few hundred perfect-fit stores is too small. Many owners will be busy, not ready or not interested. Odds are a coin flip, and there is too little data to learn from.

The same checks apply to a list you built yourself. The full routine is in how to audit a lead list before the first send.

This week, export the domains of your 10 best merchant customers, look up their plan and apps, and use that combination as your first filter. The list will be smaller than any broker file, but every domain in it will be live today, and every address you add later will belong to a person you checked.

Planning outreach to online store owners? Book a call and tell me which store types you want. I will say how I would build and verify the list.