6 updates across 3 platforms, 2 needing action. Here’s everything in one place.
If an agency or freelancer built a custom app for your store, it now needs an IP allowlist: a list of the only networks allowed to use it to reach your store's data. New installs need one from 20 November 2026, and existing apps from 1 January 2027.
AI agents can look up a store's policies and FAQs (delivery, returns and so on) through a Shopify tool. That tool is being replaced by a new one called ask_business, which gives back a written answer. The old one stops being supported after 15 January 2027.
When a customer asks you to delete their data, Shopify now processes it 5 days after the request instead of 10. This started on 10 November 2026. The only exception is when a gift card is due to be sent to someone: then it waits until the gift card has been delivered.
Meta has switched on a new pixel setting called "Measure conversions on customer devices". It moves some conversion tracking from Meta's servers onto the shopper's own device. It's on by default and starts measuring on 12 November 2026, just before Black Friday. It doesn't apply to UK and EU traffic, so it mainly affects brands selling abroad.
WooCommerce 11.3 is out this week. The sale badge can now show the discount as an amount or a percentage, such as "Save 25%". The Orders report can filter by payment method. You can also choose a refund and returns policy page, which Google can read. Product galleries swipe more smoothly on mobile.
WooCommerce is changing how it handles security. Serious fixes now come out in their own quick updates instead of waiting for the next big release. From WooCommerce 11.2, extension makers can mark a security update as required. Connected stores with an active subscription then install it within about a day, even if automatic updates are turned off.