The main difference between Shopify and WooCommerce for cookie consent is control. Shopify is hosted: its own banner and Customer Privacy API govern Shopify's cookies and pixels, and everything you add runs in the browser. WooCommerce runs on your own WordPress install, so you control every script, cookie and server setting, and every consent decision is yours to configure. Both need consent for analytics and marketing cookies before they are set for EU and UK visitors.
The short comparison
The table sums up the differences as of October 2026, before the detail.
| Feature | Shopify | WooCommerce |
|---|---|---|
| Server access | None (hosted) | Full (self-hosted) |
| Platform cookies | _shopify_essential, cart cookies, _shopify_analytics, _shopify_marketing | woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*, plus sbjs_* when order attribution is on |
| Built-in consent | Native cookie banner for Shopify cookies and Pixels | None in WooCommerce itself |
| Script blocking | Customer Privacy API and Shopify Pixels, a consent tool for theme scripts | Consent plugin, code in your theme, or a JavaScript consent tool |
| Checkout | On the shop's own domain, runs Shopify's checkout, not your theme | A WordPress page in your own theme |
| Google Consent Mode v2 | Shopify's privacy settings, consent apps or a custom pixel | Plugins, Google Tag Manager or code |
| Data protection roles | Shopify is your processor for store data, and a controller for some services | You are the controller, your host and connected services are processors |
WooCommerce offers deeper technical control. Shopify offers a managed starting point. The right choice depends on your team's technical capacity and how much control you need over cookie behaviour.
Cookies each platform sets by default
Every online store sets cookies before you install a single analytics tool. The difference is how many and what kind.
Shopify sets several first-party cookies automatically. Shopify's cookie policy (updated 9 October 2026) lists _shopify_essential, cart, cart_currency and localization as necessary, and _shopify_analytics and _shopify_marketing, each kept for one year, for analytics and marketing. Shopify stopped setting the older _shopify_y and _shopify_s on 1 January 2026.
The key point: _shopify_analytics and _shopify_marketing are not strictly necessary. Under Article 5(3) of the ePrivacy Directive, they need consent before being set. Shopify's own banner and its Customer Privacy API hold them until the visitor agrees, in the regions where you turn the banner on.
WooCommerce is leaner. woocommerce_cart_hash and woocommerce_items_in_cart power the shopping cart, and wp_woocommerce_session_* keeps the server-side session. WordPress adds wordpress_logged_in_* for signed-in users. These are strictly necessary under the GDPR and ePrivacy rules.
WooCommerce is not tracker-free, though. Its order attribution feature sets sbjs_* cookies, such as sbjs_session and sbjs_first, that record where a visit came from. WooCommerce says the feature works with the WP Consent API, so a consent tool connected to that API can hold it back, and it can be switched off under WooCommerce > Settings > Advanced > Features. Other tracking cookies arrive with the plugins you add, such as Google Analytics or the Meta Pixel.
Script blocking and consent enforcement
Shopify: the Customer Privacy API
Shopify's Customer Privacy API records the visitor's choice as four signals: analytics, marketing, preferences and sale of data. Shopify's own cookies and pixels in the Shopify Pixels system follow those signals.
The limitation is scripts you added by hand. Tracking code pasted into theme.liquid or snippet files sits outside that framework and runs on every page load, whatever the visitor chose, unless a consent tool on the storefront holds it back. Moving such scripts into Shopify Pixels, or blocking them with a consent tool, closes a common gap on Shopify stores.
You cannot change the server configuration, set your own HTTP headers or use .htaccess rules. Every consent mechanism you add runs in the browser.
WooCommerce: full server-side control
WooCommerce on WordPress gives you every tool a standard web server offers. You can conditionally load scripts through WordPress hooks such as wp_enqueue_scripts. You can set cookie attributes (Secure, HttpOnly, SameSite) on the server, and control caching rules.
A consent plugin can also leave a script out of the page entirely when the stored choice says no. That avoids any chance of a tracker running before JavaScript starts. The catch is page caching: a cached page is the same HTML for every visitor, so many sites still make the final decision in the browser, where the visitor's region and stored choice are known.
The trade-off is responsibility. Nothing is configured for you: you set everything up yourself or through a consent tool.
Checkout: what each platform lets you reach
Older comparisons describe Shopify checkout as a separate domain, checkout.shopify.com. That is out of date: Shopify checkouts run on the shop's own domain. The real limit is different. Checkout does not load your theme, so a banner or tracking script in theme.liquid never runs there.
Consent still reaches checkout. Shopify's help page says its native banner can appear on checkout pages, and pixels at checkout follow the choice stored in the Customer Privacy API.
WooCommerce checkout is a WordPress page in your own theme, on the same site as the rest of your store. Whatever consent tool you run on the storefront runs on checkout too, including on pages that hand over to a payment provider.
For merchants selling across the EU, this matters. On 1 September 2025 the CNIL fined SHEIN 150 million euros, in part for placing advertising cookies before visitors made a choice.
Installing a consent tool on each platform
Shopify: an app or one line in the theme
Consent tools on Shopify come either as App Store apps, which can use the Customer Privacy API, or as a script you add to the theme. Kukie.io is the second kind: one line of embed code in theme.liquid, with no app to install. It holds more than 30 known trackers until the visitor consents, but it does not write the choice into Shopify's Customer Privacy API, so keep Shopify's own consent settings for Shopify's cookies and pixels. Kukie.io for Shopify covers the install.
Either way, the tool runs in the browser. It cannot reach your server, change .htaccess or alter HTTP response headers.
WooCommerce: a plugin or a script
WooCommerce stores can install a consent tool as a WordPress plugin, which gets access to WordPress hooks and settings, or add a JavaScript consent tool to the theme.
Kukie.io offers a WordPress plugin alongside the plain embed code. The plugin adds the banner and, when the WP Consent API plugin is installed, passes the visitor's choice to it, which is how WooCommerce's order attribution and other API-aware plugins learn what was accepted. See Kukie.io for WooCommerce for the details.
Google Consent Mode v2 works on both platforms. WooCommerce stores can send it through Google Tag Manager, a plugin or code. Shopify stores use Shopify's privacy settings for Google tags, a consent app or a custom pixel to send the gtag('consent', 'update', ...) call. Kukie.io sends the default and update signals once its Consent Mode integration is switched on.
Data protection roles and responsibility
Shopify's Data Processing Addendum makes Shopify a processor for your customers' personal data, the merchant being the controller. For some optional services, which it calls Enhanced Services, Shopify acts as a controller itself. Your visitors' data passes through Shopify's infrastructure whatever your banner settings.
WooCommerce is open-source software on a server you choose. You are the controller, and your hosting provider, payment provider and any connected service act as processors. You decide where data is stored and who can reach it, which helps organisations with strict data residency requirements.
On both platforms you keep a cookie policy, answer data subject requests and keep records of consent. The EDPB guidelines on consent make clear that the controller must be able to show valid consent was obtained, whichever platform hosts the store.
Which platform suits your consent setup
Choose Shopify if your team lacks developer time and you want a managed platform that handles security patches and infrastructure. You get less control over cookies and scripts, and theme scripts need a consent tool of their own.
Choose WooCommerce if you want server-side control over scripts, checkout in your own theme and a free choice of where data is processed. Be ready to manage hosting, updates and security yourself.
Both platforms can collect valid consent with the right consent tool and setup, in line with the e-commerce cookie rules that apply to online stores. The difference is how much technical work that takes. Comparisons of Shopify with other hosted platforms show smaller differences: see Shopify vs BigCommerce, Shopify vs Squarespace and Shopify vs Wix.
Shopify and WooCommerce consent questions
Does Shopify set tracking cookies without consent by default?
Not where Shopify's banner is turned on: its analytics and marketing cookies, _shopify_analytics and _shopify_marketing, wait for consent in those regions. Scripts and pixels you paste into the theme are a different matter and run unless a consent tool blocks them.
Are WooCommerce cart cookies exempt from consent?
Yes. Cookies like woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_* are strictly necessary for the cart to work, so Article 5(3) of the ePrivacy Directive exempts them. The sbjs_* order attribution cookies are not cart cookies and need consent.
Can I block scripts server-side on Shopify?
No. Shopify is hosted, with no server access. Blocking happens in the browser, through the Customer Privacy API, Shopify Pixels or a consent tool. WooCommerce on WordPress allows server-side blocking through WordPress hooks.
Does Shopify checkout break cookie consent?
No. Checkout runs on the shop's own domain, Shopify's banner can appear there, and checkout pixels follow the choice stored in the Customer Privacy API. A banner in your theme does not run at checkout, because checkout does not load the theme.
Do I need a separate cookie policy for Shopify checkout?
No, but your cookie policy must cover every cookie set across the store, checkout included. Shopify publishes its own cookie list, which helps you document the cookies its checkout sets.
Check which cookies your store sets before a choice
On either platform, the useful starting point is what your store sets before a visitor decides. The Cookie scanner loads your storefront and lists every cookie it finds by name and category, including sbjs_* on WooCommerce and the Shopify cookies.
