[Puts]

I could see a lot of reason why Shopify would more or less be force to do this. If the transaction appears to be initiated on their site they may both be liable for PCI DSS and GDPR.