Federal Court rejects CRA’s vague and inconsistent information request against Shopify Inc.

In the recent decision of Canada (National Revenue) v. Shopify Inc., 2025 FC 969 (“Shopify”), the Federal Court refused to authorize the Canada Revenue Agency (the “CRA”) to issue a so-called “unnamed person requirement” (“UPR”) to Shopify Inc. (the “Shopify UPR”). A UPR is a type of requirement letter seeking information about an “ascertainable group of unnamed persons” separate from the recipient of the letter.

By the Shopify UPR, the CRA sought to obtain a list of certain Shopify merchants and various categories of information associated with those merchants’ accounts. Shopify opposed that request, and the Court ultimately found against the CRA. In refusing to authorize the Shopify UPR, the Court concluded that the CRA had not satisfied the statutory preconditions for its authorization and, even if it had, the Court would exercise its residual discretion to limit the Shopify UPR’s scope.

Legislative background

The Minister of National Revenue (the “Minister”), as represented by the CRA, has extensive powers under the Income Tax Act (Canada) (the “Act”) and Excise Tax Act to request documents and information relating to a taxpayer from third parties. The Minister often exercises those powers to, for example, request the financial information of a taxpayer directly from banks and brokerage firms. Such information is often sought to assist the Minister in verifying whether a taxpayer is complying with their obligations under the Act.

One limit to the Minister’s information-gathering powers is set out in subsection 231.2(2) of the Act.  Thereunder, if the Minister wishes to obtain documents and information from a third party relating to an unnamed person or group of persons (i.e., a UPR), the Federal Court’s authorization must first be obtained. Under subsection 231.2(3) of the Act, a UPR may be authorized only if the judge is satisfied that:

• (a) the person or group in respect of the information sought is ascertainable; and
• (b) the UPR is made to verify compliance by the person or person in the group with any duty or obligation under the Act.

Even if both preconditions are satisfied, the reviewing judge retains residual discretion to reject or limit the UPR’s scope.

Factual background

Shopify is an e-commerce platform that provides services to merchants operating stores across digital and physical sales venues, including the facilitation of payments for online sales. These merchants may use Shopify’s software to sell their products and services through brick-and-mortar stores, e-commerce marketplaces, social media platforms, or websites hosted by Shopify. When a merchant uses Shopify’s payment facilitation services, Shopify collects and maintains certain information relating to those merchants including date of birth, IP address, business name and banking information.

The CRA was apparently concerned that certain merchants using Shopify’s services were participating in the so-called “underground economy”. Thus, they were allegedly non-compliant with their Canadian tax obligations. The CRA therefore sought judicial authorization to issue a UPR against Shopify requesting a list of all Shopify merchant accounts that gave a Canadian address when registering, and had sold and/or leased products and/or services on Shopify’s platform (collectively, the “Targeted Merchants”). In addition, the Shopify UPR requested 17 categories of information associated with each of those accounts (e.g., SINs, telephone numbers, and email addresses).

The Shopify decision addresses many issues pertaining to UPRs generally. Tax litigators will undoubtedly find the decision a worthwhile read. This blog post focuses on the Court’s analysis underlying its rejection of the specific UPR issued to Shopify.

Precondition 1: The target person or group must be ascertainable

A precondition to authorize a UPR is that the unnamed person or group in respect of the information sought must be “ascertainable”.

Shopify was clearly placed in a difficult position here. Its affidavit evidence stated that Shopify is contractually obligated to protect its clients’ personal information unless required by law to disclose it. On the other hand, it could face a compliance order and ultimately contempt proceedings if it fails to comply with a UPR. Therefore, an ascertainable target group in the UPR is essential so that Shopify can comply with the UPR while upholding its contractual obligations toward its clients.

Summarizing the caselaw, the Court found that a group will be ascertainable if “the identities of those within the target group can be readily made exact or determined with sufficient precision”. The Court and the third party should be able to understand who might be a part of the target group, even if their exact identities remain unknown at the outset of the UPR.

In finding that the group targeted by the Shopify UPR was not ascertainable, the Court found that the described group was ambiguous due to the confusing and inconsistent language used in the Shopify UPR. The ambiguity lay in the various categories of information sought in the Shopify UPR in respect of “Shopify Owners”, which is a group defined as entities with Canadian address that are “associated” with a Targeted Merchant account. The group “Shopify Owner” is a much broader group than Targeted Merchant as it includes the employees, contractors and former owners of the Targeted Merchant accounts. Since it was not clear whether the target group was the “Targeted Merchants” or the “Shopify Owners”, it was not possible to determine who falls into the target group with sufficient precision.

Precondition 2: The request is made to verify compliance by the person or persons in the group with the Act

The second precondition to authorize a UPR requires the judge to be satisfied that the information requested is to verify a member of the target group’s compliance with the Act. This requirement is not a strict test, and the Minister may simply track the statutory language in its evidence. Further, the Minister is not required to show that an audit of the group is underway and it is sufficient that the information sought would generally assist the Minister in determining whether the group has complied with the Act.

The ambiguity of the target group in the Shopify UPR proved to be problematic. As mentioned above, the Shopify UPR sought information about the Targeted Merchants and the Shopify Owners, with the latter being a broader group than the former. However, the Minister only provided evidence of an intention to verify compliance by the Targeted Merchants, not the Shopify Owners. This presented two problems: first, evidence demonstrating that the request for Shopify Owner’s information was to verify their tax compliance was lacking; and second, the Shopify UPR was overly broad if its purpose was merely to verify compliance by the Targeted Merchants (not all Shopify Owners).

Ultimately, due to its overbreadth and ambiguity, the judge was not satisfied that the Shopify UPR was issued to verify compliance by the Targeted Merchants.

The Court’s residual discretion to limit or reject the Shopify UPR

Even if a UPR satisfies the two statutory preconditions outlined above, the Court retains discretion to limit or reject the UPR. This, per the Federal Court, enables it to redress abuses of process.

Shopify brought significant evidence demonstrating the extreme burden of complying with the Shopify UPR. In particular, they gave affidavit evidence that it would take one person eight full-time working years to comply with the Shopify UPR.  While the Court commented that a large corporation like Shopify has a public duty to comply with its tax obligations, and that compliance should be a normal cost of business, the Court nevertheless agreed with Shopify that the Shopify UPR was disproportional.

Accordingly, the Court held that even if the Shopify UPR had satisfied the two statutory preconditions, it would still have exercised its residual discretion to limit the Shopify UPR to reduce the number of information categories sought. Furthermore, the Court suggested that the Minister may proceed with the information gathering process in steps, starting with a limited UPR, and then seeking authorization from the Court for a further UPR if necessary.

Key takeaways

The Minister stated that Shopify would serve as a test case for future UPRs. Thus, it appears the CRA intends to use a greater number of UPRs to seek extensive information from large corporations in the future. While the threshold for authorizing a UPR is not particularly high, Shopify demonstrates that the Court will still act as gatekeeper and may reject ambiguous, unworkable, or disproportionate UPRs. Taxpayers and other persons who receive UPRs that are particularly vague and onerous may consider adopting the same resistance as Shopify did.

Interestingly, while not directly in response to the Shopify decision, the CRA recently stated at the recent 2025 IFA Roundtable it is drafting a communiqué outlining and standardizing its information gathering powers with the principles of fairness, transparency and efficiency in mind. The content of that communiqué will be particularly interesting in light of the Federal Court’s detailed and extensive analysis in Shopify.