Shopify GDPR webhooks metafield blank? Prove topic, HMAC, and the payload field.

Use this page when the GDPR webhook endpoint is reachable and authenticated, but the metafield your compliance job needs is empty or absent for the customer/shop in the payload. If Partner Dashboard never shows successful deliveries for the mandatory topics, fix subscription and endpoint reachability first—not the metafield definition.

Capture topic name, shop domain, delivery ID, HTTP status your endpoint returned, HMAC pass/fail, customer or shop id from the body, namespace.key, and whether Admin still shows a saved value on that owner. Do not invent a second definition before proving the owner the payload names.

Write down which mandatory topic failed: data request, customer redact, or shop redact. Confirm the app lists that topic in Partner Dashboard (or the compliance webhook registration) and that the HTTPS endpoint matches what your handler serves today. A stale staging URL or a topic registered only in local toml is a different failure from a blank metafield.

Use one synthetic, reversible shop or customer fixture when Partner tooling allows a test delivery. Record topic, endpoint, shop, delivery timestamp, and app log correlation id. Keep personal data minimization in mind—log IDs and field presence, not full PII dumps.

Verify X-Shopify-Hmac-Sha256 against the raw request body and the app’s shared secret before any metafield query. A 401 from HMAC failure can look like “compliance never ran,” while a 200 that skipped verification can process a forged body and miss the real owner. Confirm X-Shopify-Shop-Domain matches the install you expect.

Keep this distinct from webhook HMAC metafield blank for ordinary order/product topics. GDPR topics still need the same HMAC discipline, but the payload shape and compliance SLA differ.

Parse the GDPR payload for customer id, orders_to_redact, or shop id as documented for that topic. Query the metafield on that exact owner with the same namespace.key and API version your job uses. A saved Admin value on a different customer, a draft definition, or an app-owned field the compliance token cannot read will look blank even when HMAC passed.

Separate absent key, null, empty string, and empty list. If Admin shows the test value and the job still sees blank, fix token scopes, API version, or owner id mapping—not a new metafield namespace. Do not paste secrets or full customer payloads into tickets.

Replay or trigger one controlled GDPR delivery on one known shop. Record topic, endpoint, HMAC result, shop domain, owner id, namespace.key, Admin value, handler field state, and HTTP status returned to Shopify. Retry only after the first trace is captured.

Classify the miss as topic/subscription, endpoint/HMAC, owner mapping, definition/value, access/scopes, or handler field path. Keep it distinct from generic webhook subscription blanks and from app-proxy auth misses.

Stay DIY when one topic, HMAC, owner, or definition check explains the blank. Keep the proof packet so later compliance edits stay reversible and auditable.

Pay for the $997 one-time install when several Shopify surfaces, apps, and ops alerts need to be wired and documented on one live store. Nico at Latch AI Ops can connect the agreed workflow in a 72-hour window after collaborator access. No earnings claim, conversion guarantee, or theme rebuild is included; owner passwords are not requested.