Landmark Canadian Tax Law Decision that Limits CRA’s Authority Under Section 231.2 of Income Tax Act: Canada (National Revenue) v Shopify Inc., 2025 FC 968

Introduction: Section 231.2 of the Income Tax Act

The Canada Revenue Agency (CRA) has expansive powers to enforce compliance with the Income Tax Act, notably through Section 231.2, which allows the agency to demand documents or information from individuals or entities during a tax audit. Section 231.2(1) of the Income Tax Act, after its most recent update on December 15, 2022, specifically grants the CRA the authority to require any person to provide information or documents for the purposes of the Income Tax Act.

This power is broad and has been interpreted by courts to include compelling third parties, such as banks, employers, or digital platforms, to provide data about taxpayers. If you are interested in learning more about section 231.2, you can refer to our previous article on this topic: Tax Lawyer Analysis: CRA’s Broad Powers to Compel Third Party Information Under Section 231.2 Is Not Without Limits.

However, section 231.2(2) imposes an important limitation: if the request targets information about unnamed persons (i.e., not individually identified in the request), the CRA must first seek judicial authorization under Section 231.2(3). The purpose of this provision is to protect individuals from the CRA’s “fishing expeditions” and ensure that CRA requests have a clearly defined scope and justification.

In other words, the purpose of this provision is to restrict the CRA’s power to demand documents and information related to parties that the CRA cannot yet identify during a request. To obtain judicial authorization under 231.2(3), the CRA must satisfy the court that:

1. The unnamed persons are ascertainable.
2. The information is sought for the purpose of verifying compliance with the Income Tax Act.
3. The request is not overly broad or speculative.

A 2025 Federal Court case, Canada (National Revenue) v. Shopify Inc., sheds critical light on the boundaries of these powers, particularly regarding unnamed third parties. This decision is emblematic of the ongoing tension between government authority and individual privacy, and it underscores the judiciary’s role in ensuring the CRA’s enforcement tools are applied fairly and lawfully.

Canada (National Revenue) v Shopify Inc., 2025 FC 968: A Landmark Decision that Affirms the Importance of Checks and Balances in Canadian Tax Law

Shopify Inc. is a leading e-commerce platform that allows merchants to facilitate sales of products using the Shopify platform. In April 2023, the Canada Revenue Agency sought a court order compelling Shopify Inc. to provide information about merchants using its platform. The CRA’s request was unusually broad, asking Shopify Inc. to provide information covering all Canadian-resident merchants over a specific period of time, including names, addresses, sales figures, and banking details.

The CRA’s goal was allegedly to identify businesses that may not have properly reported their income earned via the Shopify platform, and the CRA argued that this request was necessary to assess compliance with tax obligations among Shopify merchants.

Shopify Inc. opposed the CRA’s request, arguing that the request was overly broad, lacked specificity, and did not satisfy the requirements under Section 231.2(3). Specifically, Shopify Inc. contended that the group of unnamed persons was not “ascertainable” as required and that the CRA failed to justify the scope of its demand. Shopify Inc. called the CRA’s request a “fishing expedition,” defining it as a general survey seeking to determine whether individuals are complying with unspecified laws.

The Federal Court sided with Shopify Inc., concluding that the CRA’s request and judicial authorization application failed to meet the statutory requirements under the Income Tax Act. The Court found that even if the CRA satisfies the legal criteria for issuing an Unnamed Persons Requirement (UPR) request, which is to request documents and information related to unnamed parties, it still retains the discretion to deny or limit the request to prevent abuse. Shopify’s argument that the Minister failed to consider less invasive means was rejected, as such a requirement no longer exists in law.

The court, turning to the feasibility and proportionality of the proposed UPR, noted that Shopify Inc. provided unchallenged evidence that compliance would require an extreme amount of labour—eight full-time working years for one employee. The Federal Court then concluded the proposed UPR request was disproportional and would have supported a more limited scope, in line with other similar UPR requests that have been previously approved by the court.

For example, a UPR request asking a business to provide any merchants’ names, business or operating names and numbers, contact information, banking information, and monthly transaction amounts has received judicial authorization in the past. In addition, the CRA cannot request a business to provide information that the business does not collect or possess. Furthermore, some requested data also wasn’t even available to Shopify based on the evidence submitted during the proceeding.

In light of the above-noted issues, the court indicated that narrowing the scope of the request would have been appropriate and consistent with precedent, without undermining legislative intent. The court thereby had no choice but to deny the CRA’s judicial authorization application for the UPR request in this case.

In addition, the Federal Court awarded Shopify Inc. $45,000 in costs even though the court acknowledged that it is Shopify Inc.’s decision to take the legal strategy of imposing a “stringent defence” to include a detailed evidentiary record on all issues.

Impact of the Shopify Inc. Case on Digital Platforms and Broader Privacy Debate

The Shopify case has significant implications for Canadian digital platforms or any businesses that serve as custodians of user data. E-commerce platforms, financial institutions, and tech companies can expect to be popular targets of CRA information requests for documents and information related to their user.

In light of the Shopify decision, businesses must be aware that they are not merely passive conduits for user data and have standing to challenge CRA overreach and breach of users’ privacy. If the CRA request is unjustified, the court has the power to review, to approve, or to deny such a request.

Moreover, at the heart of the Shopify Inc. case is a broader tension in Canadian tax and privacy law. On one hand, the CRA finds it necessary to be equipped to detect tax avoidance and evasion in an increasingly digital, mobile, and international economy. On the other, Canadian taxpayers have a right to expect that their personal and financial data will not be accessed indiscriminately by the government.

The Federal Court’s approach reflects a growing recognition that privacy must be safeguarded, even in the context of tax compliance. This aligns with the Supreme Court of Canada’s evolving jurisprudence on informational privacy, which acknowledges that modern data collection presents novel risks to personal autonomy.

However, importantly, the court did not foreclose the CRA’s ability to investigate merchants using the Shopify platform; rather, it emphasized that such investigations must be conducted within the legal boundaries set by the Income Tax Act.

Pro Tax Tips – What Can a Business Do When CRA’s Demand For Documents and Information is Unjustified?

When a business believes that a demand for documents or information issued by the Canada Revenue Agency under section 231.2 of the Income Tax Act is unjustified, it should first negotiate with the CRA with the assistance of experienced Canadian tax lawyers.

A Canadian taxpayer, whether an individual or a business, can refuse to fulfill a CRA’s request for documents and information during a tax audit. If the CRA refuses to change its demand, the CRA may find against the taxpayer or may be required to obtain judicial authorization from the Federal Court. A taxpayer can always dispute a CRA’s decision by filing an appeal to the Tax Court of Canada or a judicial review application to the Federal Court, depending on the nature of the CRA’s decision.

If the CRA applies for judicial authorization of a request for documents and information related to unnamed parties, a taxpayer may argue that the request is overly broad, disproportionate, or abusive. The Court has the discretion to either deny authorization or impose conditions to limit the scope. The Court may also consider whether the information is already unavailable or not in the business’s possession, as well as the feasibility of compliance.

Additionally, a business can raise privacy concerns—especially if there’s credible evidence that the CRA cannot adequately protect sensitive data. Importantly, the business must provide concrete, reliable evidence—such as affidavits or technical documentation—to demonstrate the burden or risks posed by the CRA’s request, ensuring that any objection is grounded in fact rather than speculation.

If you believe that you need assistance to dispute a CRA’s request for documents and information or to respond to a CRA’s tax audit, you should engage with one of our expert Canadian tax lawyers. Our expert Canadian tax lawyers can provide legal tax advice, identify any areas of concern, and assist you in resolving the CRA’s tax audit.

FAQ

How Does Section 231.2 of the Income Tax Act Affect Canadian Taxpayers?

Section 231.2 of the Income Tax Act empowers the Canada Revenue Agency (CRA) to compel Canadian individuals, businesses, and third parties to produce information or documents for tax compliance purposes. This means the CRA can request data not only directly from them but also from companies like banks or e-commerce platforms to verify tax obligations. Although the power is extensive, it is not unlimited. Canadian Courts can limit overly broad or intrusive requests, especially when they pose undue burdens or privacy risks.

Can CRA Request Any Documents and Information During a Tax Audit?

Although section 231.2 of the Income Tax Act grants the CRA broad powers to demand documents and information from Canadian taxpayers, the CRA’s power to request documents and information is nevertheless restricted. Specifically, the CRA must obtain judicial authorization to obtain documents and information related to unnamed parties, evidenced by the Federal Court decision of Canada (National Revenue) v Shopify Inc., 2025 FC 968. To obtain judicial authorization, the CRA must demonstrate that 1) the unnamed persons are ascertainable; 2) the information is sought for the purpose of verifying compliance with the Act; and 3) the request is not overly broad or speculative.

 

Disclaimer: This article just provides broad information. It is only up to date as of the posting date. It has not been updated and may be out of date. It does not give legal advice and should not be relied on. Every tax scenario is unique to its circumstances and will differ from the instances described in the article. If you have specific legal questions, you should seek the advice of a Canadian tax lawyer.