Ecwid cookie consent for embedded stores and Instant Site

An Ecwid store needs cookie consent for two sources at once: the page that hosts the store and the embedded Ecwid widget. Ecwid's own cookie banner covers only the cookies Ecwid sets, so on a WordPress, Wix or custom site you add one consent banner to the host page and pass the visitor's choice to Ecwid with Ecwid.setTrackingConsent(). On a plain Instant Site with no extra scripts, Ecwid's banner can be enough.

Why Ecwid stores need a dedicated cookie banner

Ecwid works differently from standalone e-commerce platforms. Rather than hosting your entire site, Ecwid embeds a storefront widget into an existing webpage, whether that page runs on WordPress, Wix, a custom HTML site, or Ecwid's own Instant Site. This architecture means cookies come from two sources: your host website and the embedded Ecwid store.

Both sources set tracking cookies. Both fall under the same privacy regulations.

Under Article 5(3) of the ePrivacy Directive, storing or accessing information on a visitor's device requires prior consent unless the cookie is strictly necessary for a service the user explicitly requested. The GDPR then governs how that consent must be obtained: freely given, specific, informed and unambiguous. These rules apply regardless of whether the cookie originates from your host site's analytics script or from Ecwid's embedded checkout.

Ecwid does offer a built-in cookie consent banner, which you switch on in the Ecwid admin. Its answers map to five values in Ecwid's cookie consent documentation: UNDEFINED, ACCEPTED, DECLINED, ANALYTICS_ONLY and PERSONALIZATION_ONLY. But this built-in banner only covers cookies set by the Ecwid storefront itself. If your host website uses Google Analytics, Meta Pixel, Hotjar, or any other third-party script, those cookies fall outside Ecwid's built-in controls.

Cookies an Ecwid store sets

Ecwid sorts its own cookies into essential, analytics and personalisation groups, and connected integrations add marketing cookies. Understanding these categories helps you configure your banner correctly and write an accurate cookie policy.

Ecwid's developer documentation describes these consent groups but does not list cookie names, so scan your live store to get the exact names for your cookie policy.

Essential cookies, those powering the shopping cart, checkout flow and CSRF protection, do not require consent. They exist solely to deliver the service your visitor requested.

Analytics, personalisation, and marketing cookies all require opt-in consent before being set. If you have connected Facebook Pixel, Google Analytics, or other tracking tools through Ecwid's built-in integrations, those scripts will drop additional cookies such as _ga, _fbp and _gcl_au that require consent.

The embedded store problem: two cookie sources, one banner

The core challenge with Ecwid is that your visitors experience a single website but cookies arrive from two distinct systems. Your host site might set _ga and _ga_<ID> through a Google Analytics snippet. Ecwid's widget sets its own session and analytics cookies. A Meta Pixel installed on your host site drops _fbp independently of anything Ecwid does.

Ecwid's built-in cookie banner cannot block scripts that live on your host page. It only manages cookies that Ecwid's own JavaScript creates. This gap means relying solely on Ecwid's built-in banner leaves your host-site cookies unmanaged, which is a legal risk under both the GDPR and the CCPA.

The solution is a site-wide cookie consent tool that sits on your host page and governs all cookies, including those from the embedded Ecwid store. Ecwid supports this through its JavaScript API, which lets an external consent management platform pass the visitor's consent choice directly to the Ecwid widget.

How to add a cookie banner to your Ecwid store

The exact installation method depends on your host platform. The general process follows three steps.

Step 1: install the consent script on your host site

Add the cookie consent script to your host website's <head> section. If your host site runs on WordPress, this goes into your theme's header or through a plugin. On a static HTML site, paste it directly into the HTML. For Ecwid's Instant Site, use the custom code injection area under Settings.

With Kukie.io, the script you paste once is <script src="https://cdn.kukie.io/s/YOUR_SITE_KEY/c.js" async></script>. The Ecwid installation guide in the Help Centre walks through each placement option.

Step 2: pass the choice to Ecwid

Ecwid's storefront JavaScript API accepts the choice from an external banner through Ecwid.setTrackingConsent(), which takes one of the five values above. Ecwid's documentation says the JS API must be enabled in your script file first, and that if you also set the value through the HTML config (ec.config.tracking), the HTML config wins, so use one method. Kukie.io announces each choice with a cc:consent-updated event on document, whose detail.categories lists the accepted category slugs, so a few lines connect the two:

document.addEventListener("cc:consent-updated", (event) => {
  const accepted = event.detail.categories;
  let value = "DECLINED";
  if (accepted.includes("analytics") && accepted.includes("marketing")) {
    value = "ACCEPTED";
  } else if (accepted.includes("analytics")) {
    value = "ANALYTICS_ONLY";
  } else if (accepted.includes("functional")) {
    value = "PERSONALIZATION_ONLY";
  }
  if (window.Ecwid && Ecwid.setTrackingConsent) {
    Ecwid.setTrackingConsent(value);
  }
});

Adjust the category slugs to the ones your banner uses. Ecwid then respects the same choice your host site does: no double banners, no conflicting states.

Step 3: scan and categorise all cookies

Run a cookie scan across your entire domain. This detects cookies from your host site, from Ecwid, and from any third-party integrations. Each cookie gets assigned to a category (essential, analytics, personalisation or marketing) so your banner can present visitors with a clear, granular choice.

Ecwid Instant Site compared with an embedded store

If you use Ecwid's Instant Site (the free standalone storefront Ecwid provides), the built-in cookie banner may be sufficient, provided you have not added external tracking scripts through the custom code area. Instant Site is a controlled environment where Ecwid manages most of the page.

The moment you embed Ecwid into another platform, such as WordPress, Squarespace, Wix or a custom-coded site, the built-in banner becomes inadequate. Your host page introduces its own cookies and scripts that Ecwid cannot see or control. A site-wide consent tool becomes a practical necessity, not an optional extra.

For those running Ecwid on WordPress specifically, the WordPress cookie consent guide covers the host-side setup in detail.

Regulatory requirements across jurisdictions

Cookie consent rules vary by region, and your Ecwid store likely serves customers across borders. Enforcement intensified through 2025 and 2026, with supervisory authorities fining cookie breaches directly.

The CNIL, the French data protection authority, issued 83 sanctions in 2025 worth about EUR 486.8 million, 21 of them over trackers, according to its 2025 enforcement review. Its largest cookie fine of the year, against SHEIN in September 2025, was EUR 150 million for advertising cookies loaded before visitors made any choice. The ICO in the United Kingdom has published guidance stating that a "Reject All" option must be as easy to select as "Accept All", with no hidden toggles or extra clicks.

A properly configured cookie banner with geo-detection can display the correct consent model based on each visitor's location, applying opt-in rules for EU visitors and opt-out rules for Californians.

Common mistakes with Ecwid cookie consent

Several pitfalls catch Ecwid store owners off guard.

Relying on the built-in banner alone. As covered above, Ecwid's built-in banner does not manage host-site cookies. If your host page runs Google Analytics or any advertising pixel, those scripts fire without consent.

Double banners. Running both Ecwid's built-in banner and a site-wide consent tool creates confusion for visitors. Turn off the Ecwid banner when using an external CMP and pass the choice through Ecwid.setTrackingConsent() instead.

Forgetting to scan after adding integrations. Every time you connect a new Ecwid app or install a tracking pixel, new cookies may appear. Scheduled cookie scans catch these additions automatically.

Pre-ticked consent boxes. Both the EDPB and national supervisory authorities have confirmed that pre-selected checkboxes do not constitute valid consent. Your banner must load with all non-essential categories unchecked.

Ignoring opt-out requirements for US visitors. Under the CCPA, California residents must be able to opt out of the sale or sharing of personal information. Cookie-based advertising typically qualifies as "sharing" under the CPRA amendments.

Ecwid cookie consent questions

One banner for your host site and your Ecwid store

If you are not sure which cookies your Ecwid store and host site set, start with a scan. Kukie.io lists the cookies across your domain, sorts them into categories, holds non-essential scripts until visitors choose and fires the event that passes the choice on to Ecwid. The Free plan covers up to 5 websites.

Start free