BigCommerce cookie consent with Script Manager and a full banner

BigCommerce cookie consent starts in two places. Under Settings › Security & Privacy, the Cookie consent tracking setting (off by default) shows BigCommerce's own banner and holds back its analytics features and Script Manager scripts until shoppers agree. For per-category choices, consent records and region rules, add a consent banner through Script Manager instead: one script in the head of all pages, categorised as Essential, ahead of every analytics and marketing tag.

Why BigCommerce stores need a cookie banner

Every BigCommerce store sets cookies the moment a visitor lands on a page. Session identifiers keep shopping carts alive. Analytics scripts like Google Analytics 4 drop _ga and _ga_* cookies. Marketing pixels from Meta set _fbp, and retargeting tools add their own tracking identifiers.

Under Article 5(3) of the ePrivacy Directive, storing or accessing information on a user's device requires prior consent, unless the cookie is strictly necessary for a service the user explicitly requested. That means your checkout session cookie is fine without consent, but your Google Analytics cookie is not.

The CNIL, France's data protection authority, issued 83 sanctions in 2025 worth about EUR 486.8 million, 21 of them over trackers, according to its 2025 enforcement review. In the UK, the ICO can fine cookie breaches up to GBP 17.5 million or 4% of global turnover since February 2026. Running a BigCommerce store without a proper consent mechanism is a measurable legal risk.

Cookies a BigCommerce store sets

BigCommerce generates several categories of cookies out of the box. Some are essential for store functionality. Others require explicit consent before they can be placed on a visitor's device.

BigCommerce does not list its storefront cookies in its Security and Privacy help article, and the store cookie names above are the ones commonly seen on Stencil storefronts, so confirm them with a scan of your own store. Google's list of GA4 cookies names only _ga and _ga_<container-id>: the _gid cookie belonged to Universal Analytics.

Third-party apps from the BigCommerce marketplace often inject their own cookies and scripts. A live chat widget, a product recommendation engine, or a loyalty programme extension can each add tracking that falls outside the strictly necessary category. Scanning your store regularly is the only reliable way to know exactly what cookies are active.

BigCommerce's built-in cookie consent compared with a dedicated CMP

BigCommerce includes a built-in cookie consent tracking feature. According to BigCommerce's Security and Privacy Settings article, you turn it on under Settings › Security & Privacy, in the section on your customers' privacy. It is off by default. When it is on, the storefront shows a banner, and BigCommerce respects the shopper's choice when loading its analytics features and any scripts added in Script Manager. Stores with several storefronts can set it per storefront in Channel Manager.

The built-in option has limits. Its choices follow BigCommerce's script categories (Essential, Functional, Analytics and Targeting or Advertising), so it controls what BigCommerce and Script Manager load, not scripts that apps or theme files inject on their own. Its help article describes no consent records you could show later, which matters because GDPR Article 7 puts the burden of proof on you. It also describes one banner for every visitor, translated into the store language, with no rules per region.

A dedicated consent management platform gives you category-based consent controls, consent logging, region rules and automatic script blocking. For stores selling to customers in multiple countries, showing each visitor the consent model their law expects is the practical difference.

Installing a cookie banner through Script Manager

BigCommerce Script Manager is the recommended method for adding third-party scripts to your store. It avoids editing theme files directly and survives theme updates.

Step-by-step installation

1. Log in to your BigCommerce admin panel

2. Go to Storefront and select Script Manager

3. Click Create a Script

4. Set a descriptive name, such as "Cookie consent banner"

5. Under Location on Page, select Head

6. Under Select pages where script will be added, choose All Pages

7. Set Script category to Essential (the banner itself must load without consent)

8. Select Script as the script type

9. Paste your CMP script into the Script contents field. With Kukie.io, that is <script src="https://cdn.kukie.io/s/YOUR_SITE_KEY/c.js" async></script>

10. Click Save

The banner script must be categorised as Essential in Script Manager. If you categorise it as Analytics or another non-essential type, BigCommerce will block it until after consent, which defeats the purpose. If both banners are active, visitors see two prompts, so turn off Cookie consent tracking once your own banner runs.

For a detailed walkthrough with screenshots, see the BigCommerce installation guide in the Kukie.io Help Centre.

Handling checkout pages

BigCommerce checkout runs on a separate, more restricted page context. Script Manager scripts set to All Pages do load on checkout, but some third-party scripts behave differently there. Test your cookie banner on the checkout page specifically to confirm it renders correctly and that consent choices carry over from the storefront.

Blocking analytics and marketing scripts before consent

Displaying a banner is only half the requirement. The other half is ensuring that non-essential cookies are not set until the visitor actively consents. Under GDPR, loading a tracking script that drops cookies before consent is a violation, regardless of whether a banner is visible.

There are two main approaches for BigCommerce stores.

Script Manager categories

BigCommerce Script Manager lets you assign each script to a category: Essential, Functional, Analytics or Targeting and Advertising. When the built-in cookie consent tracking is turned on, BigCommerce blocks non-essential scripts until the visitor accepts. This works for scripts added through Script Manager but does not cover scripts injected by BigCommerce apps or hardcoded in theme files.

CMP-based script blocking

A consent management platform can conditionally load scripts based on the visitor's specific consent choices. This approach gives you finer control. Analytics scripts fire only when analytics consent is granted. Marketing scripts fire only when marketing consent is granted. This method also integrates with Google Consent Mode v2, which, in advanced mode, sends cookieless pings to Google when consent has not been given, preserving some conversion modelling data without violating privacy rules.

GDPR, CCPA and regional requirements for online stores

The legal obligations vary depending on where your customers are located, not where your store is hosted.

If you sell to customers in the European Economic Area or the United Kingdom, GDPR and the ePrivacy Directive apply. Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes are invalid. A "Reject All" option must be as prominent as "Accept All", CNIL has fined multiple organisations specifically for hiding the reject option behind extra clicks.

Stores with customers in California must comply with the CCPA and CPRA. The requirement is opt-out rather than opt-in: you must provide a "Do Not Sell or Share My Personal Information" link and honour Global Privacy Control signals from the browser.

Brazilian customers bring LGPD obligations. Canadian customers trigger PIPEDA requirements. South African customers mean POPIA applies. A BigCommerce store with international traffic needs a consent solution that adapts its behaviour based on the visitor's location.

Kukie.io supports region rules: you choose the consent model for each region, and the banner applies it by where the visitor connects from.

Common consent mistakes on BigCommerce

Running a cookie audit on BigCommerce stores regularly reveals the same issues.

The first is marketplace apps that inject tracking scripts outside Script Manager's control. These scripts fire on every page load regardless of consent status. Check each installed app's documentation to understand what cookies it sets, and remove any app you cannot bring under consent management.

The second mistake is relying solely on BigCommerce's built-in consent toggle without customising the banner text. Generic wording like "This site uses cookies" does not meet GDPR's informed consent requirement. The banner must identify cookie categories, explain their purposes, and name the data recipients.

Third: ignoring the checkout flow. A checkout session cookie or a payment-related cookie from processors like Stripe or PayPal are strictly necessary and do not require consent. But analytics and remarketing scripts that fire during checkout still need consent. Verify that your consent state persists across the storefront-to-checkout transition.

Testing your cookie banner

After installation, verify your setup using Chrome DevTools. Open the Application tab, select Cookies from the sidebar, and load your store in a fresh private window without accepting the banner. Only strictly necessary cookies should appear.

Accept all cookies and reload. Analytics and marketing cookies should now be visible. Reject all cookies and reload again: only essential cookies should remain. Test this flow on product pages, category pages, and the checkout page.

You can also use a free cookie scanner to get a complete list of cookies your store sets and identify any that fire without consent.

BigCommerce consent questions

Give BigCommerce shoppers a choice on every page

If you are not sure which cookies your BigCommerce store sets, start with a scan. Kukie.io lists the cookies it finds, sorts them into categories, holds non-essential scripts until shoppers choose and records every choice. The Free plan covers up to 5 websites.

Start free