Shopify and Squarespace both include a cookie banner, and neither covers everything on a real site. Squarespace's banner offers "Decline all" and "Manage cookies" and restricts Squarespace's own analytics cookies, but Squarespace says it does not block all third-party content. Shopify's banner governs Shopify's own cookies and Shopify Pixels, while scripts in the theme fall outside it. On both, a separate consent tool fills the gaps for code you added yourself.
The short comparison
Both platforms need extra tooling once a site runs third-party scripts, but the starting points differ more than older comparisons suggest. The table reflects each platform's own documentation as of October 2026.
| Feature | Shopify | Squarespace |
|---|---|---|
| Built-in cookie banner | Yes, under Settings > Customer privacy > Cookie banner | Yes, in the Cookies & Data Privacy panel |
| Reject and category choices | Handled by Shopify's banner for Shopify cookies and Pixels | "Decline all" and "Manage cookies" buttons |
| What the built-in banner covers | Shopify's own cookies and Shopify Pixels | Squarespace's cookies and some third-party services |
| Google Consent Mode v2 | Covered in Shopify's privacy settings for Google tags | Squarespace points to Google's Consent Mode for its official Google Analytics integration |
| Scripts you add yourself | Theme scripts need a consent tool | Code-injected scripts need a consent tool |
| Consent records | From a consent tool | From a consent tool |
| Adding a consent tool | One script in theme.liquid | One script in Code Injection |
Neither platform's banner reaches every script on a typical site, but they leave different gaps and offer different ways to close them.
Squarespace: what the built-in banner does
Squarespace's banner is switched on in the Cookies & Data Privacy panel. Its banner help article, updated on 14 January 2026, describes a "Decline all" button that rejects all non-essential cookies and a "Manage cookies" button that lets visitors customise their preferences. Under the GDPR's consent requirements, refusing must be as simple for visitors as accepting, so turning on "Decline all" matters.
The limit is content you add. Squarespace's cookie list says the banner disables or restricts cookies from some third-party services but not all of them, and that it will not block some embedded content, which could then place analytics cookies. For sites with specific requirements, Squarespace itself recommends a specialist third-party consent tool.
Squarespace sets its own cookies automatically. Its analytics cookies are ss_cid, ss_cvr and ss_cpvisit (two years) and ss_cvisit and ss_cvt (30 minutes). Necessary cookies include crumb for form protection and SiteUserInfo for signed-in site members. The analytics cookies need consent for EU and UK visitors. The Squarespace cookie consent guide walks through the setup.
Code Injection: adding a consent tool
Squarespace's Code Injection lets you insert scripts into the <head> of every page. Most third-party consent tools use it: you paste the tool's script into the header field, then switch off the native banner so visitors do not see two. With Kukie.io, that is one line, <script src="https://cdn.kukie.io/s/YOUR-SITE-KEY/c.js" async></script>.
Shopify: a native banner plus an API
Shopify has its own cookie banner under Settings > Customer privacy > Cookie banner. Shopify's help page says it can show on storefront, cart, checkout and customer account pages in the regions you choose, and that it governs Shopify's own cookies and Shopify Pixels. Cookies and pixels added by hand or through apps may need a third-party banner or custom logic.
Behind the banner sits the Customer Privacy API. A banner records the visitor's choice there as four signals, analytics, marketing, preferences and sale of data, and Shopify applies them to its own tracking. Apps in the Shopify App Store can use the same API, which gives merchants a standard integration point that Squarespace does not have.
Shopify's own cookies in 2026
As of October 2026, Shopify's cookie policy lists _shopify_essential, cart, cart_currency and localization as necessary storefront cookies, with _shopify_analytics and _shopify_marketing (one year each) for analytics and marketing. Shopify stopped setting the older _shopify_y and _shopify_s on 1 January 2026, and cart_sig, cart_ts, _secure_session_id and _tracking_consent no longer appear on its list. The full breakdown is in the guide to Shopify cookies.
Script blocking: where consent gets technical
The core rule under Article 5(3) of the ePrivacy Directive is plain: do not store or read information on a visitor's device without prior consent unless it is strictly necessary. In practice, that means blocking third-party scripts such as Google Analytics, the Meta Pixel and advertising tags until the visitor actively consents.
Script blocking on Shopify
Shopify Pixels and apps built on the Customer Privacy API wait for the matching consent signal. A theme can load the API with Shopify.loadFeatures and check consent before it starts a script. Scripts pasted into theme.liquid by hand do none of this: they run on every page load unless a consent tool on the storefront holds them back. Shopify's checkout pages do not load your theme, so tracking at checkout runs through Shopify Pixels.
Script blocking on Squarespace
Squarespace has no consent API for your own scripts. Its banner restricts Squarespace's cookies and some third-party services, but scripts you add through Code Injection or code blocks are custom code, which Squarespace treats as outside its support.
For those, you need a consent tool that holds scripts back until consent, for example by changing type="text/javascript" to type="text/plain" and running them once the visitor agrees. The consent tool's script must sit first in the Code Injection header so it loads before the scripts it controls.
Google Consent Mode v2 on each platform
Google Consent Mode v2 has been required for Google Ads measurement and personalisation in the EEA and UK since March 2024. It adds two signals, ad_user_data and ad_personalization, to the original analytics_storage and ad_storage. Without them, Google limits conversion tracking and audience building for European traffic.
On Shopify, the help centre says event data sent to Google from EEA customers is not used for personalised advertising unless Consent Mode v2 is active and valid consent is obtained. A custom web pixel needs its own Consent Mode snippet.
On Squarespace, the cookie help says that for Google Analytics added through the official integration you save the measurement ID and enable the cookie banner, and it notes that providers such as Google offer Consent Mode. Google tags added through Code Injection are custom code: a consent tool or your own script has to send the default and update signals.
Customisation and banner design
Banner design affects whether consent is valid. The CNIL and the EDPB say the reject option must be as easy to use as the accept option, and steering visitors with hidden buttons or contrasting colours invites enforcement. On 1 September 2025 the CNIL fined SHEIN 150 million euros for placing advertising cookies before visitors made a choice and for continuing after a refusal.
Squarespace's banner offers a set of layouts and lets you choose which buttons appear. Shopify's banner text and regions are set in its privacy settings, and the banner can be translated with Shopify's Translate & Adapt app. Consent apps and separate consent tools on either platform add visual editors, multi-layer banners and preference panels, and quality varies from tool to tool.
Which platform needs less consent setup
Neither platform handles e-commerce cookie compliance on its own once a site runs third-party scripts. The difference lies in how much work it takes to add the missing pieces and how well the platform supports them.
| Factor | Shopify | Squarespace |
|---|---|---|
| Built-in banner with a reject option | Yes, for Shopify's own tracking | Yes, with "Decline all" |
| Standard API for consent apps | Customer Privacy API | None |
| Consent Mode for Google tags | In Shopify's privacy settings and pixels | For the official Google Analytics integration |
| Scripts you add yourself | Need a consent tool | Need a consent tool |
| Consent records | From a consent tool | From a consent tool |
| Adding a consent tool | theme.liquid or an app | Code Injection header |
Shopify offers more structure: a consent API that apps and pixels share. Squarespace is simpler for a site with no added scripts, where its own banner with "Decline all" may be all you need. For Shopify stores, Kukie.io for Shopify describes the one-line install in theme.liquid.
If you are comparing other platforms, similar breakdowns cover Shopify vs WooCommerce, Shopify vs Wix and Shopify vs BigCommerce.
Shopify and Squarespace consent questions
Does Squarespace have a built-in cookie consent banner?
Yes. Squarespace's banner can show Accept all, Decline all and Manage cookies, and it restricts Squarespace's own cookies and some third-party services. Squarespace says it does not block some embedded content, so sites with embeds or added scripts usually need a consent tool.
Does Shopify block cookies before consent?
Shopify's native banner holds Shopify's own cookies and Shopify Pixels until the visitor consents in the regions you configure. Scripts pasted into the theme are not covered and need a consent tool that blocks them.
Can I use Google Consent Mode v2 on Squarespace?
For Google Analytics added through Squarespace's official integration, Squarespace says to save the measurement ID and enable the cookie banner. For Google tags added through Code Injection, a consent tool or your own code must send the Consent Mode signals.
Which cookies does Squarespace set automatically?
Squarespace's analytics cookies include ss_cid, ss_cvr, ss_cpvisit, ss_cvisit and ss_cvt, and its necessary cookies include crumb. The analytics cookies need consent for EU and UK visitors.
Do I need a third-party consent tool on both Shopify and Squarespace?
Only if your site runs scripts the built-in banner does not cover, or you need consent records and rules by region. A Squarespace site with no added scripts may manage with the native banner. Most stores with pixels and apps add a consent tool on either platform.
See what your Shopify or Squarespace site sets before consent
Built-in banners cover the platform's own cookies, not the pixels and embeds you added. The Cookie scanner loads your site like a visitor and lists every cookie it finds by name and category, so you can see which ones still run before a choice.
