On an online store, the cookies that keep the cart, the login, the checkout security and a currency or language the shopper chose can run without consent. Analytics, remarketing pixels and product recommendations that track browsing need the shopper's opt-in first in the EU and the UK. That is Article 5(3) of the ePrivacy Directive applied to a shop, and the rest of this guide maps common store cookies to the two groups and shows where Shopify, WooCommerce and Magento differ.
Why ecommerce websites face closer cookie scrutiny
Online stores collect more personal data than most websites. Between cart sessions, payment processing, remarketing pixels and recommendation engines, a store can set dozens of cookies before checkout even begins.
Regulators have noticed. On 1 September 2025, France's CNIL fined SHEIN EUR 150 million because advertising cookies were placed as soon as visitors arrived on shein.com, before they made any choice. Its banner had a "Reject all" button, but clicking it did not stop new cookies, and the information it gave did not mention advertising. The same day, the CNIL fined Google EUR 325 million, a larger cookie-related decision.
Article 5(3) of the ePrivacy Directive requires consent before storing or accessing information on a user's device, unless it is strictly necessary for the service the user requested. For an online store, the line between "strictly necessary" and "everything else" is where the work begins.
Which ecommerce cookies count as strictly necessary
Strictly necessary cookies are exempt from the consent requirement. For an online store, this category covers cookies the shop cannot work without.
A cookie that holds the items in a visitor's cart, such as Shopify's cart or WooCommerce's wc_cart_hash, qualifies because the visitor explicitly asked to add products. The same applies to authentication cookies that keep a logged-in customer signed in during checkout, and CSRF tokens that protect form submissions.
Payment gateway cookies from providers like Stripe, PayPal and Klarna sit in a grey area. Stripe sets a __stripe_mid cookie for fraud detection. Fraud prevention cookies are generally treated as strictly necessary, but only when they are genuinely needed to complete the transaction the visitor started.
Currency and language cookies, such as Shopify's cart_currency and localization or Polylang's pll_language on WordPress, are strictly necessary when they remember a setting the shopper chose.
Cookies that always need consent
Every cookie that tracks behaviour beyond the immediate transaction needs consent before it fires. This includes analytics, advertising and personalisation cookies.
Analytics and performance cookies
Google Analytics 4 sets _ga and _ga_* cookies that recognise visitors across sessions. They require consent in the EU whether or not you shorten IP addresses. The same applies to session-recording tools such as Hotjar and Microsoft Clarity.
Marketing and remarketing cookies
The Meta Pixel (_fbp, _fbc), the TikTok Pixel, Google Ads conversion tracking and the Pinterest Tag all set cookies that build advertising profiles. They fall into the marketing category and must be blocked until a visitor grants consent.
Personalisation and recommendation cookies
Recommendation engines that track browsing history to suggest products are not strictly necessary. A visitor browsing your shop asked to see products, not to be profiled. Tracking-based personalisation therefore needs consent under Article 5(3).
Cookie categories for a typical online store
The table below maps common ecommerce cookies to their consent category. Use it as a starting point for a cookie audit of your store.
| Cookie | Purpose | Category | Consent required? |
|---|---|---|---|
cart | Shopping cart (Shopify) | Strictly necessary | No |
wc_cart_hash | Shopping cart (WooCommerce) | Strictly necessary | No |
__stripe_mid | Stripe fraud detection | Strictly necessary | No |
pll_language | Language the visitor chose (Polylang) | Strictly necessary (remembers a requested setting) | No |
_ga | Google Analytics | Analytics | Yes |
_fbp | Meta Pixel browser ID | Marketing | Yes |
_ttp | TikTok Pixel | Marketing | Yes |
_pin_unauth | Pinterest Tag | Marketing | Yes |
_clck | Microsoft Clarity user ID | Analytics | Yes |
nosto_id | Product recommendations | Personalisation | Yes |
Platform-specific steps
Each ecommerce platform handles cookies differently, so the way you block non-essential cookies before consent depends on its architecture.
Shopify
Shopify has its own cookie banner under Settings > Customer privacy, and its Customer Privacy API lets apps and pixels check the visitor's consent. Shopify's cookie list names _shopify_essential, cart, cart_currency and localization among its own cookies. Third-party apps can still inject scripts and cookies of their own, so audit your installed apps regularly.
Checkout runs on your shop's own domain, but checkout pages do not load your theme's theme.liquid, so a banner added to the theme does not run there. Plan for consent before the visitor reaches checkout. The Kukie.io installation for Shopify adds the banner to your theme.
WooCommerce
WooCommerce runs on WordPress, so cookie management depends on your theme, plugins and custom code. The WP Consent API gives plugins a standard way to check consent before they set cookies, and WooCommerce's own order attribution feature, which sets the sbjs_* cookies, is compatible with the WP Consent API. Use a consent tool that feeds the WP Consent API, such as the Kukie.io plugin for WooCommerce, so those plugins follow the visitor's choice.
WooCommerce itself sets wc_cart_hash, wc_fragments and woocommerce_items_in_cart for the cart. These are strictly necessary.
Magento (Adobe Commerce)
Magento's cookie restriction mode is a built-in setting that holds non-essential cookies until consent. Enable it under Stores > Configuration > General > Web > Default Cookie Settings. With it on, Magento's Google tag module also waits for consent. Third-party extensions often add their own cookies, so audit every extension after installation.
Abandoned cart tracking and consent
Abandoned cart recovery is one of the highest-revenue email flows in ecommerce, and it involves two separate legal questions.
The email is governed by the soft opt-in in Article 13(2) of the ePrivacy Directive, which in the UK is regulation 22 of PECR. It may cover a cart reminder about similar products where the address was collected in the course of a sale or, in the UK, of negotiations for one, provided the shopper could opt out then and in every email. Outside the UK, some national laws require a completed sale, so an abandoned checkout may not qualify. The abandoned cart emails guide walks through the conditions.
The cookies and pixels that power the tracking are the second question. Session identifiers linked to email addresses, and remarketing pixels that follow the shopper after they leave, need consent whenever they go beyond what the cart session itself requires.
Google Consent Mode v2 for online stores
Google Consent Mode v2 affects every online store running Google Ads, GA4 audiences or Google Shopping campaigns. Since March 2024, Google has required Consent Mode v2 signals for EEA and UK traffic if you use its advertising and measurement features. A Google-certified consent tool is a separate rule: it applies to publishers who show Google ads through AdSense, Ad Manager or AdMob.
For ecommerce, Consent Mode v2 added two signals, ad_user_data and ad_personalization, which control whether user data is sent to Google for advertising. Your consent tool must pass them correctly, or your remarketing audiences and conversion measurement for EEA and UK traffic suffer.
Requirements by regulation for online stores
Cookie rules differ by jurisdiction, so a store shipping internationally has to account for several frameworks.
| Regulation | Consent model | Key requirement for ecommerce |
|---|---|---|
| GDPR / ePrivacy (EU) | Opt-in | Consent before all non-essential cookies |
| UK GDPR / PECR | Opt-in, with some exceptions since February 2026 | Clear accept and reject options, and some first-party statistics cookies may run with an opt-out |
| CCPA / CPRA (California) | Opt-out | "Do Not Sell or Share" link required |
| LGPD (Brazil) | Consent or another legal basis | Consent must be free, informed and unambiguous |
| PIPEDA (Canada) | Implied or express | Express consent for sensitive data tracking |
| POPIA (South Africa) | Opt-in for direct marketing | Consent for direct marketing |
For stores selling across borders, geo-targeting that applies the consent model you set for each region avoids showing a full opt-in banner to a visitor who only needs an opt-out link.
Questions about ecommerce cookies
Do shopping cart cookies need consent under GDPR?
No. Cookies that hold the items a visitor added are strictly necessary for the service they requested, so no consent is needed. List them in your cookie policy all the same.
Are payment gateway cookies like Stripe strictly necessary?
Fraud detection cookies from payment providers such as Stripe are generally treated as strictly necessary when they are genuinely required to process the transaction. Stripe's __stripe_mid and __stripe_sid cookies fall into this category.
Can I send abandoned cart emails without cookie consent?
The email may be covered by the soft opt-in if the address was collected during a sale (or, in the UK, negotiations for one) and the shopper can opt out. The cookies and pixels that track cart abandonment still need consent if they go beyond cart session management.
Does Shopify handle cookie consent automatically?
Shopify offers its own banner and a Customer Privacy API, but third-party apps and scripts outside Shopify's pixel system can still set cookies. Check what your store actually loads, and remember that a theme banner does not run on checkout pages.
What happens to Google Ads if visitors reject cookies?
With Consent Mode v2, Google receives a denied signal. In advanced mode, tags send cookieless pings that Google can use to model conversions, and remarketing audiences are not built from those visitors. In basic mode, Google tags do not load until consent.
Do product recommendation cookies need consent?
Yes. Cookies that track browsing behaviour to personalise product suggestions are not strictly necessary, so they need opt-in consent before they are set.
Find out what your store sets before checkout
If you are not sure which cookies your store sets, start with a scan. Kukie.io lists every cookie by category, holds marketing and analytics scripts until shoppers accept them and keeps a record of each choice, on Shopify, WooCommerce or any other platform.
