I believe it takes about an hour for 6 confirmations. (Edited from David Schwartz's comment)
However, when I purchased some stuff from merchants who used BitPay, the payment/orders were confirmed in like 20 seconds or so? Since BitPay is confirming the order before 6 confirmations, how does it protect itself from double spending attacks?