Cookie consent compliance on Shopify goes past the banner. Shopify's own banner and its Customer Privacy API decide when Shopify's cookies and pixels run, but custom pixels at checkout, app scripts, Shopify Audiences and Google's consent signals each need their own check. This guide walks through those layers, in the order a store usually meets them.
Shopify's built-in privacy settings are only the starting point
Shopify turns on automated privacy settings for new stores and, with them, shows its cookie banner to visitors in the UK and EEA if you have active markets there. For many merchants, this creates a false sense of security.
The built-in banner covers a narrow slice of a real store. Shopify's help page says it governs Shopify's own cookies and Shopify Pixels, and that third-party cookies or pixels added by hand or through apps may need a third-party banner or custom logic. Once your store moves beyond a default theme with no added scripts, each app installation, custom pixel and remarketing integration adds tracking that falls outside that automatic handling.
Knowing what Shopify does and does not manage is the first step towards real e-commerce cookie compliance.
Shopify's own cookies in October 2026
As of October 2026, Shopify's cookie policy (updated 9 October 2026) lists _shopify_essential, cart, cart_currency and localization as necessary storefront cookies. Shopify's analytics run on _shopify_analytics and its marketing data on _shopify_marketing, each kept for one year and used on both the storefront and checkout. Those two need consent in the EU and UK.
The older names are gone. Shopify stopped setting the visitor ID _shopify_y and the 30-minute session cookie _shopify_s on 1 January 2026, according to its developer changelog. The short-lived referral and page-view cookies _shopify_sa_t and _shopify_sa_p no longer appear on Shopify's cookie list either. If your cookie policy still names them, it predates the change. The full table is in the guide to Shopify cookies.
How the Customer Privacy API controls consent
Shopify's Customer Privacy API is the central mechanism for managing visitor consent. Three of its methods do most of the work: setTrackingConsent records a visitor's choices, currentVisitorConsent returns the choices already made, and shouldShowBanner says whether a banner needs to appear in the visitor's region.
Shopify's API documentation lists four consent signals: analytics, marketing, preferences and sale_of_data. A consent tool must call setTrackingConsent only in response to an actual visitor interaction, accepting or declining on a banner. Granting consent on a visitor's behalf goes against the API's intended use and the GDPR consent requirements.
One common mistake: calling setTrackingConsent on page load with every value set to true. Shopify accepts the call without an error, but it is not valid consent under Article 5(3) of the ePrivacy Directive or under the GDPR's conditions for consent in Article 7.
Web pixels, sandboxing and consent signals
Shopify's pixel system runs tracking code in a sandbox. Shopify's pixel documentation describes two kinds: strict, used by web pixel app extensions and running in web workers, and lax, used by custom pixels and running in an iframe. Both limit what the pixel can reach on the page.
Pixels honour the consent signals set through the Customer Privacy API. In regions where consent is required, a pixel app extension's callbacks run only after consent is given, and the events registered before that are then replayed. In opt-out regions, callbacks run until the visitor opts out.
The catch is that pixels cannot call the Customer Privacy API themselves. Shopify's documentation says so directly. They can read the consent state and follow updates, but collecting consent and calling the API is the job of the banner on the storefront.
Custom pixels and checkout pages
Checkout Extensibility does not let app scripts run directly on the checkout page, and checkout does not load your theme, so a banner script in theme.liquid never runs there. Custom pixels fill this gap, tracking purchase events and passing consent to third parties during checkout. If your store uses Google Consent Mode v2, the custom pixel is usually where the consent('update', ...) call reaches Google's tags during checkout.
Without consent signals at checkout, conversion tracking breaks for visitors who opted out. Shopify's help centre says event data sent to Google from EEA customers is not used for personalised advertising unless Consent Mode v2 is active and valid consent is obtained.
Shopify Audiences and data sharing consent
Shopify Audiences builds lists of shoppers likely to buy from your store and exports them to your advertising accounts. According to Shopify's help centre, it is available only to eligible Shopify Plus stores that use Shopify Payments and are based in the United States or Canada, and it needs Shopify Network Intelligence turned on in your privacy settings.
From a privacy standpoint, this raises questions. Stores that turn it on should check how Shopify describes its role in its own terms and make sure their privacy policy discloses the sharing.
Shopify's help page says the raw data sent to ad platforms is used to match their records and then deleted. Under the GDPR, matching on customer data is still processing of personal data: if information can be linked back to a person, even indirectly, Recital 26 keeps it personal data. For EU and UK shoppers, a lawful basis for that matching is needed before it starts.
Protected customer data scopes for pixels
Shopify's protected customer data rules require apps to be approved separately for four fields: name, address, email and phone. An app without those approvals does not get them.
This matters for the Meta Pixel and other advertising pixel apps that rely on hashed customer details for advanced matching. If a pixel app has not been approved for the fields it uses, match rates and conversion attribution suffer.
For merchants, the action is to check that each pixel app in your Shopify admin has the approvals it needs. For developers building their own pixel integrations, the requests go through the Shopify Partner Dashboard.
Consent configuration by region
Shopify lets merchants set consent requirements per region in the admin. The table summarises the consent model each major law expects and what Shopify's own settings cover.
| Region | Law | Consent model | Shopify's own settings | What else to check |
|---|---|---|---|---|
| EU and EEA | GDPR and ePrivacy Directive | Opt-in | Cookie banner, on by default with automated settings | Theme and app scripts, proof of consent |
| UK | UK GDPR and PECR | Opt-in | Cookie banner, on by default with automated settings | Same as the EU |
| California | CCPA as amended by the CPRA | Opt-out | Opt-out of selling or sharing | A "Do Not Sell or Share" link that also stops theme scripts |
| Brazil | LGPD | Consent or another legal basis | Banner off by default, can be turned on | Banner and blocking |
| Canada | PIPEDA | Express by default, implied in narrow cases | Banner off by default, can be turned on | Clear disclosure, opt-out |
| South Africa | POPIA | Opt-in for direct marketing | Banner off by default, can be turned on | Banner and blocking |
With automated settings, Shopify's banner is set up for UK and EEA visitors. Its help page says you can choose to use it in any region, and stores that rely on theme or app scripts still need blocking for those scripts wherever consent applies.
Five steps to close the gaps
1. Audit every pixel and app
Run a cookie scan on your Shopify store to find every cookie and tracking script on your pages. Pay particular attention to cookies set by apps you installed: many add their own analytics or marketing trackers without saying so in their app listing.
2. Configure consent categories consistently
Map each cookie and pixel to the right consent category: strictly necessary, analytics, marketing or preferences. Shopify's pixel permission settings must match your consent tool's categories. A mismatch, where your banner blocks a category but the pixel's Shopify permission is set to "not required", leaves a gap.
3. Send Consent Mode signals to Google
Google's EU user consent policy requires stores running Google Ads, GA4 or other Google services in the EEA to send consent signals. Without Consent Mode v2 signals, conversion modelling cannot fill the gaps left by visitors who opted out, and remarketing audiences stop growing.
4. Review your privacy and cookie policies
Name Shopify as a provider in your privacy policy and link to Shopify's own privacy policy. Your cookie policy should list Shopify's current cookies alongside the third-party cookies your apps and pixels add, and drop the names Shopify retired.
5. Test consent flows end to end
Check that rejecting cookies in your banner actually stops pixels from firing. Use Chrome DevTools to watch the Network tab during checkout: if pixels still send data after a visitor declines, your setup has a gap. Shopify's sandbox only holds pixels that are configured with the right permission settings.
Short answers on Shopify pixels and consent
Is Shopify's built-in cookie banner enough for an EU store?
Shopify's banner covers Shopify's own cookies and Shopify Pixels in the regions you configure. Its help page says cookies and pixels added through apps or by hand may need a third-party banner or custom logic, so stores with theme scripts usually need more.
How do Shopify web pixels handle cookie consent?
In regions where consent is required, a pixel app's callbacks run only after the visitor consents, and earlier events are then replayed. Pixels follow the consent state but cannot call the Customer Privacy API themselves.
Do I need consent for Shopify Audiences?
Shopify Audiences is limited to eligible Shopify Plus stores in the United States and Canada. Under the GDPR, customer data used to match ad platform records is personal data, so stores serving EU shoppers should disclose the sharing and have a lawful basis before it starts.
What happens to checkout tracking when visitors reject cookies?
Pixels that need marketing or analytics consent do not run for visitors who declined it, so those conversion events are not sent. Consent Mode v2 lets Google model some of the missing conversions from consented traffic.
Can I use Google Tag Manager with Shopify's pixel system?
Yes, as a custom pixel. The container runs inside Shopify's lax sandbox, an iframe, so it cannot interact with the parent page directly. Consent has to reach Tag Manager from the Customer Privacy API.
Which Shopify cookies are strictly necessary?
Shopify's cookie policy lists _shopify_essential, cart, cart_currency and localization as necessary storefront cookies. The analytics cookie _shopify_analytics and the marketing cookie _shopify_marketing need consent. _shopify_y and _shopify_s were analytics cookies, never exempt, and Shopify stopped setting them on 1 January 2026.
Audit the scripts your Shopify theme and apps load
Most of the gaps in this guide come from scripts Shopify does not manage: pixels pasted into the theme and tags injected by apps. The Script audit checks one page for third-party scripts and shows whether each one sets cookies before a choice is made. For how Kukie.io works with a Shopify theme, see Kukie.io for Shopify.
