Cookie consent on Shopify has two halves. Shopify's own cookies and pixels follow the Customer Privacy API, which a banner fills with the visitor's choice. Scripts you or your apps added to the theme do not, so they need a consent tool that holds them back until the visitor agrees. A Shopify store that sells to visitors in the EU or UK needs both halves working before any analytics or marketing cookie is set.
Why Shopify stores cannot ignore cookie consent
Every Shopify storefront sets cookies the moment a visitor lands on the page. Some are strictly necessary for the cart and checkout to function. Others, such as analytics trackers, marketing pixels and personalisation cookies, fall under Article 5(3) of the ePrivacy Directive and need prior consent before they are placed on a visitor's device.
Regulators have made it clear that e-commerce is not exempt. On 1 September 2025, the CNIL fined SHEIN 150 million euros for placing cookies before visitors made a choice and for continuing to place them after a refusal. On the same day, it fined Google 325 million euros for showing ads between Gmail emails without consent and for invalid consent to advertising cookies when people created a Google account.
For Shopify merchants selling into the EU, UK, Brazil, Canada or US states with privacy laws, the obligation is plain: get valid consent, or offer an opt-out where the local law allows one, before setting non-essential cookies. For checkout pixels and audiences, see the Shopify cookie compliance guide.
The cookies Shopify sets in 2026
Shopify's cookies split into a few broad categories, and the category decides what needs consent. As of October 2026, Shopify's cookie policy (updated 9 October 2026) lists these for merchant storefronts, and the table adds the third-party cookies most stores carry.
| Cookie | Category | Purpose | Consent needed in the EU and UK? |
|---|---|---|---|
_shopify_essential | Necessary | Session, checkout and anti-tampering | No |
cart, cart_currency | Necessary | Cart contents and currency | No |
localization | Necessary | Sets the cart's country | No |
_shopify_analytics | Analytics | Analytics for the storefront and checkout, 1 year | Yes |
_shopify_marketing | Marketing | Marketing data for the storefront and checkout, 1 year | Yes |
_fbp | Marketing | Meta Pixel tracking | Yes |
_gcl_au | Marketing | Google Ads conversion linker | Yes |
_tt_enable_cookie | Marketing | TikTok Pixel | Yes |
Strictly necessary cookies, those powering the cart, checkout and login, do not need consent under the GDPR or the ePrivacy Directive. Everything else does.
Older guides list _shopify_y and _shopify_s as Shopify's analytics cookies. Shopify's developer changelog says it stopped setting both on storefronts from 1 January 2026. The persistent visitor ID that _shopify_y held, which apps used to link visits to a signed-in customer, now comes to apps as the clientId in Web Pixels events, and Shopify's own analytics run on _shopify_analytics. Both still need consent before they are set, and third-party pixels from Meta, Google and TikTok add their own.
How Shopify's Customer Privacy API works
Shopify's Customer Privacy API lets a cookie banner tell the Shopify platform what the visitor chose. A banner records the choice with setTrackingConsent, which takes four signals: analytics, marketing, preferences and sale of data (relevant for CCPA opt-outs).
An integration works like this: the banner collects consent, maps the visitor's choices to those four signals and passes them to the API. Shopify then applies them to Shopify-managed surfaces such as its own cookies and Shopify Pixels.
Two rules matter. Consent is recorded only when the visitor actively interacts with the banner, never on page load. And code should never read or change Shopify cookies directly: Shopify's changelog warns that internal cookie values change often, which the 2026 renaming showed.
Where a visitor's choice reaches on Shopify
Web Pixels and third-party tracking
Shopify's Web Pixels system runs third-party tracking such as the Meta Pixel, Google Ads tags and TikTok Pixel through Shopify's customer events. Pixels added this way respect the consent signals passed through the Customer Privacy API.
If you added tracking scripts by hand in the theme code instead, those scripts sit outside Shopify's consent framework. They run on every page load, whatever the visitor chose, unless a consent tool on the storefront holds them back.
That gives you two routes for each script. Move it into Shopify's pixel system so it follows the API, or keep it in the theme and have your consent banner block it until the visitor agrees. Either route works. A script on neither route is the problem.
What the GDPR asks of a Shopify store selling in Europe
The GDPR applies to any Shopify store that offers goods or services to people in the EU or monitors their behaviour, wherever the business is based. Under Article 7 of the GDPR, consent must be freely given, specific, informed and unambiguous.
For Shopify merchants, this means:
- Showing a cookie banner before any non-essential cookies are set
- Offering a "Reject all" option that is as easy to find as "Accept all"
- Listing the specific cookie categories and their purposes
- Storing proof of consent for each visitor
- Letting visitors withdraw consent at any time
The ePrivacy Directive adds a technology-specific layer: any information stored on or read from a visitor's device (cookies, local storage, device fingerprints) needs prior consent unless it is strictly necessary for the service the visitor requested.
Shopify's own cookie banner, under Settings > Customer privacy > Cookie banner, can show on storefront, cart, checkout and customer account pages in the regions you choose. Shopify's help page says it governs Shopify's own cookies and Shopify Pixels, and that cookies or pixels added through apps or by hand may need a third-party banner or custom logic. That gap is where a separate consent tool comes in, along with a cookie inventory, a consent log and Google Consent Mode v2 for Google tags in the theme.
Setting up a cookie banner on Shopify
A working Shopify setup has three parts: the banner, the Customer Privacy API for Shopify's own tracking, and blocking for every other script.
Step 1: Add a consent banner to your theme
Kukie.io installs as one line of embed code in theme.liquid, directly after the opening <head> tag. The Shopify installation guide covers where to paste it, and Kukie.io for Shopify sums up what it covers. The banner holds more than 30 known trackers, such as Meta Pixel and TikTok, until the visitor consents. It does not write the choice into Shopify's Customer Privacy API, so keep Shopify's own consent settings for Shopify's cookies and pixels.
Step 2: Run a cookie scan
Before configuring the banner, scan your store to find every cookie your Shopify site sets. This includes Shopify's own cookies, theme scripts, installed apps and any tracking code added by hand. Many Shopify apps set tracking cookies that nobody on the team chose.
Step 3: Configure region rules
Different places have different rules. EU and UK visitors need opt-in consent. California visitors under the CCPA need a "Do Not Sell or Share" option. Canada's guidelines for obtaining meaningful consent say consent under PIPEDA should generally be express, and implied only in strictly defined circumstances. Use geo-detection to show the right banner to the right visitor.
Step 4: Give every script a consent route
Audit your theme's <head> section and theme.liquid file for scripts added by hand. Either move tracking and marketing scripts into Shopify's Web Pixels system so they follow the Customer Privacy API, or leave them in the theme and make sure your consent banner blocks them. Shopify's checkout pages do not load theme.liquid, so a theme script never runs there.
Common consent mistakes on Shopify stores
Several patterns appear again and again on Shopify stores that fail a consent check.
Pre-ticked consent boxes. Some Shopify themes or apps default to consent being "on". Under the GDPR, pre-ticked boxes do not give valid consent. The visitor must take an affirmative action.
No reject option. A banner that only shows "Accept" with no equal "Reject all" button goes against dark pattern guidance from the CNIL and the EDPB. Both options must be equally prominent.
Ignoring Shopify app cookies. Every installed Shopify app can set its own cookies. Review apps, loyalty programmes, upsell tools and live chat widgets all add non-essential cookies that need consent. A regular cookie audit catches them.
Manual pixel injection. Pasting a Meta Pixel or Google Ads tag straight into the theme, with nothing to block it, sets _fbp and _gcl_au cookies on every page load without consent.
Missing consent records. Regulators can ask for proof that a specific visitor gave consent. Without a consent log, you have no evidence to show in an investigation.
Cookie consent and conversion tracking on Shopify
A common concern among Shopify merchants is that cookie consent reduces tracking data and hurts marketing performance. Some data loss is unavoidable when visitors decline analytics and marketing cookies.
Google Consent Mode v2 narrows the gap. Shopify's help centre says event data sent to Google from EEA customers is not used for personalised advertising unless Consent Mode v2 is active and valid consent is obtained. In advanced mode, Google tags that load with consent denied send cookieless pings that Google can use for conversion modelling.
Clear banner copy also helps. Telling shoppers plainly what each category does, with an equal "Reject all", gives them a real choice instead of a nudge.
Questions about Shopify cookie consent
Is Shopify's built-in cookie banner enough on its own?
It covers Shopify's own cookies and Shopify Pixels in the regions you configure. Shopify's help page says cookies or pixels added through apps or by hand may need a third-party banner or custom logic, so stores with theme scripts usually add a consent tool.
Which Shopify cookies are strictly necessary and do not need consent?
Shopify's cookie policy lists _shopify_essential, cart, cart_currency and localization as necessary on storefronts. Its analytics cookie _shopify_analytics, its marketing cookie _shopify_marketing and marketing pixels such as _fbp need consent in the EU and UK.
Does Shopify still set _shopify_y and _shopify_s?
No. Shopify stopped setting both on storefronts from 1 January 2026. Apps that used _shopify_y to identify a returning visitor are pointed to the clientId in Web Pixels events instead.
Do Shopify apps set cookies that need consent?
Yes. Many Shopify apps, including review widgets, upsell tools, live chat and loyalty programmes, set their own non-essential cookies. Run a cookie scan after installing any new app to find and categorise them.
Do I need cookie consent if my Shopify store only sells in the United States?
Several US states, including California, Virginia, Colorado and Connecticut, have privacy laws that require disclosure and an opt-out for tracking used for targeted advertising. Even without a federal cookie law, US-only stores should be open about tracking and honour opt-out requests.
Find the scripts on your store that skip the API
Most Shopify consent gaps sit in the theme: a pixel pasted in years ago, or an app that injects its own tag. The Cookie scanner loads your storefront and lists every cookie it finds with the script that set it, so you can see which ones need blocking.
