Shopify and BigCommerce both ship a built-in cookie consent setting, but they gate different things. Shopify's banner governs Shopify's own cookies and Shopify Pixels, and can appear at checkout, while scripts in your theme fall outside it. BigCommerce's cookie consent tracking holds every script you add through Script Manager by one of four categories, and says nothing about scripts written into a theme. On both, app and theme scripts are where consent gaps appear.
The short comparison
Both platforms set cookies by default, and their consent tools are built around different ideas. The table sums up the differences as of October 2026, before the detail.
| Feature | Shopify | BigCommerce |
|---|---|---|
| Built-in cookie banner | Yes, under Settings > Customer privacy > Cookie banner | Yes, "Cookie consent tracking" in Security Settings |
| What the built-in setting gates | Shopify's own cookies and Shopify Pixels | Scripts in Script Manager and the Scripts API |
| Platform analytics cookies | _shopify_analytics, _shopify_marketing | Mostly from the integrations you enable, such as GA4 |
| Consent categories | Customer Privacy API: analytics, marketing, preferences, sale of data | Essential, Functional, Analytics, Targeting (advertising) |
| Checkout | On the shop's own domain, theme scripts do not run there, the native banner can | Script Manager scripts can be placed on checkout pages with a category |
| Headless | Hydrogen, consent wired up by hand | Catalyst ships a consent banner mapped to Script Manager categories |
| Not covered by the built-in setting | Scripts in the theme or added by apps outside Shopify Pixels | Scripts hardcoded in theme files |
Default cookies: what each platform sets
Shopify stores set several first-party cookies the moment a visitor lands. According to Shopify's cookie policy (updated 9 October 2026), the necessary ones include _shopify_essential, cart and localization, while _shopify_analytics and _shopify_marketing, each kept for one year, carry analytics and marketing data. The older _shopify_y and _shopify_s are gone: Shopify's developer changelog says it stopped setting them from 1 January 2026. The full list is in the guide to Shopify-specific cookies.
Under Article 5(3) of the ePrivacy Directive, any cookie that is not strictly necessary for the service the visitor asked for needs prior consent. Shopify's analytics and marketing cookies are not needed for the cart or checkout to work, so they need consent before being set for visitors in the EU, the UK and places with similar rules.
On BigCommerce, the tracking cookies a store carries mostly come from the integrations you turn on. Connecting GA4 adds _ga and _ga_<container-id>, a Meta Pixel adds _fbp, and so on. Session and cart cookies are strictly necessary on both platforms.
Consent infrastructure: APIs and script blocking
Shopify's Customer Privacy API
Shopify's Customer Privacy API takes four consent signals: analytics, marketing, preferences and sale of data. A banner collects the visitor's choices, maps them to these signals and passes them to the API. Shopify then applies them to its own cookies and to pixels in the Shopify Pixels system.
Two rules matter. Consent is recorded only when the visitor actively uses the banner, never on page load. And code should never read or change Shopify cookies directly: the 2026 renaming showed how quickly those names change.
BigCommerce's Script Manager and consent categories
BigCommerce files scripts under four consent categories. Its storefront API reference lists Essential, Functional, Analytics and Targeting, the last described as scripts used for advertising and marketing. Script Manager assigns every script you add to one of them.
With "Cookie consent tracking" turned on in Security Settings, under "Your customers' privacy", essential scripts load on every page and the other categories stay blocked until the shopper accepts them. BigCommerce's documentation describes this for scripts added through Script Manager and the Scripts API. It says nothing about scripts hardcoded in theme files, so check those yourself.
Checkout: where each platform draws the line
Older guides describe Shopify checkout as running on checkout.shopify.com. That is out of date: Shopify checkouts run on the shop's own domain. The real constraint is different. Checkout does not load your theme, so a banner or tracking script in theme.liquid never runs there, and Checkout Extensibility does not let app scripts run directly on the checkout page.
Shopify's own banner is the exception. Shopify's help page says it can appear on storefront, cart, checkout and customer account pages. Third-party tracking at checkout runs through custom pixels and Shopify Pixels, which follow the consent stored in the Customer Privacy API.
Strictly necessary cookies for the cart, checkout and login need no consent under the GDPR or the ePrivacy Directive, so checkout itself is not the problem. The risk is analytics or marketing code that fires during checkout without the storefront's choice reaching it.
On BigCommerce, scripts can be scoped to checkout and order confirmation pages, according to BigCommerce's Scripts API documentation, and they carry a consent category like any other script. A store that keeps its tags in Script Manager has one place to check for every page of the purchase flow, which suits stores selling across the EU under the e-commerce cookie rules there.
Script injection and third-party pixels
Both platforms get most of their cookies from third-party integrations. Meta Pixel (_fbp), Google Analytics (_ga, _ga_<container-id>), TikTok Pixel and similar scripts each set their own cookies, and each needs a consent route.
On Shopify, pixels added through the Shopify Pixels system follow the Customer Privacy API. Pixels added by older methods, such as code in the theme or apps that predate the Pixels framework, may not. Audit how each pixel loads before you trust that consent is honoured.
BigCommerce's Script Manager gives each script a clear category, and non-essential categories wait for consent. Scripts written straight into Stencil theme templates are a different matter. Both platforms, then, need you to check how every tracking script loads rather than assume the built-in tools cover it.
Google Consent Mode v2 adds another layer. Stores on either platform that run Google tags need to send the four consent signals, ad_storage, analytics_storage, ad_user_data and ad_personalization, to Google. Shopify's help centre says event data sent to Google from EEA customers is not used for personalised advertising unless Consent Mode v2 is active and valid consent is obtained.
Headless and custom storefronts
Shopify's headless framework, Hydrogen, needs consent wired up by hand. You implement the Customer Privacy API yourself, collect consent through your own banner or a consent tool, and pass the signals on.
BigCommerce's own headless storefront, Catalyst, now includes a consent banner. BigCommerce's Catalyst documentation says it shows a banner and a preferences dialog, maps the Script Manager categories to its own, and keeps Functional, Analytics and Marketing scripts blocked until the shopper accepts them, once cookie consent tracking is on. Other headless front ends on BigCommerce need their own consent layer.
For any custom front end on either platform, the consent tool has to live in that front end: the built-in tools are tied to each platform's own storefront.
Which platform needs less consent setup
Neither platform wins outright. BigCommerce's cookie consent tracking blocks every Script Manager script by category, so a store that keeps all its tags there gets broad coverage from one setting. Shopify's banner reaches further into checkout and Shopify Pixels, but leaves every script in the theme to you.
The deciding question is where your tracking lives. A Shopify store with pixels pasted into theme.liquid needs a consent tool that blocks them. A BigCommerce store with tags hardcoded in its Stencil theme is in the same position. More detail on each platform is in Kukie.io for Shopify and the guide to cookie consent on BigCommerce.
| Factor | Shopify | BigCommerce |
|---|---|---|
| Built-in consent banner | Yes, for Shopify cookies and Pixels | Yes, for Script Manager scripts |
| Consent categories | 4 signals in the Customer Privacy API | 4 categories in Script Manager |
| Checkout | Native banner can show, theme scripts never run there | Script Manager scripts on checkout follow their category |
| Scripts outside the built-in setting | Theme and app scripts outside Shopify Pixels | Scripts hardcoded in theme files |
| Consent records | From a consent tool | From a consent tool |
For stores selling into several jurisdictions, both platforms benefit from a consent tool that handles rules by region, granular categories and blocking for theme-level scripts.
If you are comparing Shopify with other platforms, similar trade-offs apply to Shopify vs WooCommerce, Shopify vs Squarespace, Shopify vs Wix and Shopify vs Magento.
Shopify and BigCommerce consent questions
Does Shopify provide a built-in cookie consent banner?
Yes. Shopify's cookie banner is under Settings > Customer privacy > Cookie banner and can show on storefront, cart, checkout and customer account pages. It governs Shopify's own cookies and Shopify Pixels, so scripts added by hand or by apps may need a third-party banner.
Can I show a cookie banner on Shopify's checkout page?
Shopify's native banner can appear at checkout. A banner installed in your theme cannot, because checkout does not load theme.liquid, so consent reaches checkout through the Customer Privacy API and Shopify Pixels.
Does BigCommerce block cookies before consent automatically?
With cookie consent tracking turned on, BigCommerce keeps Functional, Analytics and Targeting scripts from Script Manager blocked until the shopper accepts them. Its documentation does not cover scripts hardcoded in theme files, so those need separate handling.
Do I need a third-party consent tool on Shopify or BigCommerce?
A simple store with every tag inside the platform's own system may manage with the built-in setting. Stores with theme scripts, app tags or visitors in several jurisdictions usually need a consent tool for blocking, rules by region and consent records.
Compare what your store loads before consent
Whichever platform you run, the useful question is which cookies appear before a shopper chooses. The Cookie scanner loads your storefront and lists every cookie it finds by name and category, so you can see what the built-in setting misses.
