On May 29, 2025, the Federal Court (the Court) issued two decisions in Canada (National Revenue) v Shopify Inc., 2025 FC 968 and Canada (National Revenue) v. Shopify Inc., 2025 FC 969 (together, the Shopify Decisions).1
The Minister of National Revenue (the Minister or the CRA) filed applications with the Court in 2023 requesting information from Shopify Inc. (Shopify) about unnamed persons transactions, which Shopify opposed, leading to the Court's decisions in May 2025.
In both cases, the Court rejected the applications that would have imposed a requirement on Shopify to provide documents or information about its customers.
Key Takeaways
Both cases reaffirm the broad powers of the CRA to investigate, verify and test taxpayers' compliance. While intrusive and inconvenient, a "Unnamed Persons Requirements" (UPR) is a permitted form of a "fishing expedition" that is intended to allow Canadian tax authorities to test compliance with federal tax laws of Canada.
- Judicial Oversight Is a Crucial Safeguard
- The Court emphasized its gatekeeping role in reviewing UPR applications. It underscored that judicial authorization is not a formality but a substantive check on the CRA's investigatory powers, especially when privacy and third-party burdens are at stake.
- Requests Must Be Tailored and Justified
- The Court criticized the CRA's requests for being overly broad and insufficiently justified. It stressed that the CRA must demonstrate necessity and proportionality, particularly when requesting large volumes of data from third parties like Shopify.
- Terminology Matters: Precision in Language Is Essential
- In Shopify #2, the Court found the CRA's use of terms like "Shopify Owner" and "merchant" to be ambiguous, which undermined the ascertainability of the target group. This highlights the importance of clear and consistent terminology in UPR applications.
- Feasibility and Administrative Burden on Third Parties
- The Court considered the practical implications of compliance for Shopify, including the technical and resource burdens of extracting and producing the requested data. This reinforces that feasibility is a relevant factor in judicial discretion.
- CRA Must "Connect the Dots"
- The Court reiterated that the CRA must link the requested information to a specific compliance objective under the Income Tax Act (ITA) or Excise Tax Act (ETA). Vague or speculative justifications are insufficient to meet the statutory threshold.
The Court emphasized that the discretion to authorize UPRs on Canadian persons is not a rubber stamp; it must be exercised judiciously, considering the balance between enforcement and individual rights.
Backgrounder: CRA's Power to Collect Taxpayers' Information
Section 231.2 of the ITA and section 289 of the ETA grant the Minister broad authority to compel taxpayers and third parties to provide documents or information. If the request is directed at a specific, named person or business, the Minister can issue it directly, even pursuant to an international agreement. However, if the request is targeted at a third party regarding one or more unnamed persons, the Minister must first obtain authorization from the Court, pursuant to subsection 231.2(3) of the ITA or subsection 289(3) of the ETA. To get the Court's approval, the Minister must show that the unnamed person or group is ascertainable and the request is made to verify compliance with tax obligations. This process is referred to as the "Unnamed Persons Requirements."
Shopify is a Canadian corporation and a leading provider of online e-commerce solutions.2 Its system enables users to sell products and services online.3 Depending on users' specific business needs, Shopify collects and stores certain information about its users in order to facilitate their transactions.4
In the Shopify Decisions, Shopify—acting as a third party subject to the Minister's request—argued that the UPR should not be authorized because the Minister failed to meet the statutory conditions. Conversely, the Minister asked the Court to authorize the UPR. In Shopify #1, the Minister relied on an international agreement between Australia and Canada to provide the domestic legal basis to satisfy the statutory condition under paragraph 231.2(3)(b) of the ITA. In Shopify #2, the Minister contended that the terms of the draft UPR were ascertainable under paragraph 231.2(3)(a) of the ITA.
Three-Part Test for UPR
In the Shopify Decisions, the Court established a structured approach to evaluating UPR authorizations, and the following three conditions must be satisfied:
1. Identifying an "ascertainable" group of persons: The Court defines "ascertainable" as "identities of those within the target group can be readily made exact or determined with sufficient precision."5 This definition means that the third party (e.g., Shopify) must clearly understand who is targeted and what information it must provide under a UPR.6 The Minister is provided significant latitude in the scope of its request, but this is subject to the Court's inherent jurisdiction to investigate, detect, and, if necessary, redress abuses or supervise and limit Ministerial actions in administering and enforcing tax legislation.
2. Demonstrate the UPR's purpose of compliance verification: The UPR request must show some intent to verify whether unnamed persons comply with their tax duties and obligations under the ITA or ETA.7 Furthermore, if an international agreement or a tax treaty affects the compliance verification process, additional analysis is required to determine whether those external provisions have been incorporated into the ITA or ETA.8
3. Exercise of residual judicial discretion: The statutory words of "may" and "judge considers appropriate" empower the Court to remedy ministerial encroachment.9 However, the Court must apply a fact-driven, evidence-based approach guided by proportionality to avoid creating additional statutory preconditions. In the Shopify Decisions, the Court factored privacy and feasibility into its discretionary analysis, aiming to strike a balance between the Minister's investigatory powers and the protection of taxpayers from undue government intrusion. The Court weighed the privacy interests of unnamed individuals and the administrative burden on Shopify, reinforcing the need for proportionality in UPR requests.10
Shopify #1: International Agreements Do Not Confer Authority
In April 2022, the Australian Taxation Office (ATO) sought access to Shopify's records to verify compliance with Australian Goods and Services Tax obligations for Shopify users. In April 2023, upon the ATO's request and under the Multilateral Convention on Mutual Assistance in Tax Matters (Convention), the Minister issued a draft UPR to Shopify. The UPR sought information regarding "merchants using Shopify Inc. who have customers with Australian billing addresses for the period from April 1, 2021, to March 31, 2022."11
The Court rejected the Minister's UPR application on the basis that the CRA did not have the requisite authority under subsection 231.2(3) to request information from a Canadian person pertaining to unnamed third parties for the purposes of sharing that information with another country under the Convention. The Court found the Convention did not override or expand domestic statutory authority. The CRA must still meet the ITA's requirements, and the Convention cannot be used to bypass the need for a valid domestic legal basis
Shopify #2: Clarity is Essential in UPR
On or about the same time that the UPR in Shopify #1 was issued, the Minister, on its own initiative, issued another UPR to Shopify requesting that Shopify provided information "for the period of six years preceding ... regarding Shopify merchants who gave a Canadian address when registering for a Shopify account" and "the name of each person(s) (whether individual or business entity) associated with the Shopify account ("Shopify Owner")."
The Court rejected the Minister's UPR because it was too vague and unascertainable. Due to the failure to identify an "ascertainable" group, the Court could not determine whether the Minister intended to verify compliance from "merchants" or the broader "Shopify Owner" group under paragraph 231.2(3)(b) of the ITA, and that the six-year scope was overly broad without justification.12
Concluding Remarks
The Federal Court's rulings in the Shopify Decisions, underscore the importance of judicial oversight in ensuring that the CRA adheres strictly to statutory requirements when seeking information through UPRs. In both cases, the Court rejected the CRA's applications — first, for relying improperly on an international agreement without satisfying domestic legal thresholds, and second, for submitting a vague and overly broad request that failed to identify an ascertainable group. These decisions reaffirm that while the CRA has broad investigatory powers, those powers are not limitless and must be exercised with precision, proportionality, and respect for privacy and procedural fairness.
Footnotes
1. Canada (National Revenue) v Shopify Inc., 2025 FC 968 (Shopify #1); Canada (National Revenue) v. Shopify Inc., 2025 FC 969 (Shopify #2).
2. Shopify #1, at para 13.
3. Shopify #1, at para 14.
4. Shopify #1, at para 17.
5. Shopify #2, at para 65.
6. Shopify #2, at para 62.
7. Shopify #1, at para 89; Shopify #2, at paras 181 and 199.
8. Shopify #2, at para 30.
9. Shopify #1, at para 93.
10. Shopify #1, at para 112.
11. Shopify #1, at para 26.
12. Shopify #2, at para 200.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
