Setting up cookie consent on a Shopify store
Shopify's Customer Privacy API passes a visitor's choice to Shopify's own cookies and pixels, but scripts in theme.liquid ignore it. This gu...
Cookie banner for Shopify
One line. No app.
Paste one line into theme.liquid and your store asks shoppers before it tracks them. There is no app to install and no app fee, and your theme's templates stay as they are.
The Free plan is free forever and covers up to 5 sites. No Shopify app to install.
Works with the tools on your Shopify store
- Shopify
- Google Analytics 4
- Google Tag Manager
- Meta Pixel
- TikTok
- Klaviyo
What your shoppers see
A banner that asks before it tracks.
The banner sits on your storefront in your colours. Accept all and Reject all are side by side at the same size, and Manage preferences opens the categories one by one.
- Known trackers wait until the shopper chooses
- The built-in text in 70+ languages with Auto-Translation on
- Each choice kept with its date and a consent ID
Why it matters
A Shopify store is never only Shopify.
Shopify sets its own analytics and cart cookies, and every app you add can bring more. In the EU and the UK, the ones that are not strictly necessary need consent before they are set.1
-
Cookie count
25-60
Cookies on a typical store
Shopify's own analytics and cart cookies, plus whatever your theme and apps load. The number grows with every app you add.
- cart, Essential
- _shopify_analytics, Analytics
- _fbp, Marketing
- __kla_id, Marketing
-
Apps
Every app can bring its own tracking
Reviews, email capture, loyalty, upsells, live chat and ad pixels each add scripts to your storefront. An app you installed for one feature can set marketing cookies on the first page.
-
Enforcement
The GDPR follows the shopper
A store based anywhere that sells to Europe can fall under it, and data protection authorities have issued cookie decisions against online retailers for years.
-
Advertising
Consent signals matter to your ads too
Google asks for Consent Mode v2 signals on traffic from the EEA and the UK before Google Ads and GA4 use it for remarketing and conversion modelling. Without them, you lose audience data on traffic you paid for.
-
Checkout
Your cart and checkout stay as they are
Kukie.io files Shopify's cart, session and checkout cookies under Essential, the category that is always active. Shopify's checkout pages do not load your theme.liquid, so the banner script does not run there.
Cookie reference
The cookies a Shopify store sets.
Shopify's own cookies, from Shopify's cookie list of 9 October 2026, and the app cookies found most often on Shopify stores, grouped the way a consent banner groups them. Your store's exact set depends on its theme and apps.
These are the usual categories. The scanner shows what your own store sets, and the cookie database explains any of 3,300+ known cookies.
Your options
Three ways to handle consent on Shopify.
Shopify's built-in banner, a consent app from the App Store, or a line of embed code. They solve different parts of the problem.
| Capability | Shopify's built-in banner | A Shopify consent app | Kukie.io embed code |
|---|---|---|---|
| Setup | A setting in the admin | App install and review | One line in theme.liquid |
| Extra monthly cost | None | Usually per month, per store | Free plan available |
| Access to store data | Built into Shopify | App permissions requested | None requested |
| Holds third-party scripts until consent | Limited to the Customer Privacy API | Varies by app | Yes, 30+ known trackers plus your own domains |
| Cookie inventory | No | Varies by app | Yes, from a scan of your store |
| Consent model by region | Region settings | Varies by app | Yes, a rule per country or region |
| Google Consent Mode v2 | Through Shopify's own integration | Varies by app | Built in, plus Microsoft UET and Matomo |
| Consent log you can export | No | Varies by app | Yes, with a consent ID for each choice |
Compared on 30 September 2026. Consent apps differ, so their column describes the range rather than one app.
They can work together. Many merchants keep Shopify's Customer Privacy API for Shopify's own tracking and use Kukie.io for the cookie inventory, script blocking, rules by region and the consent log.
How to add it
Three steps, about 5 minutes.
You need your Shopify admin and a browser tab. No developer, and nothing to change in your theme's templates.
-
Step 1: Create a site and copy the embed code
Create a free Kukie.io account (opens in a new tab), add yourmyshopify.comor custom domain as a site and copy the one-line embed code. -
Step 2: Paste it into theme.liquid
In your Shopify admin, go to Online Store > Themes, open the ... menu on your live theme and choose Edit code. OpenLayout / theme.liquid, paste the line directly after<head>and select Save. -
Step 3: Scan and publish
Run the scanner over your storefront, collection, product and cart pages. Cookies get their categories, known trackers wait for consent, and Google Consent Mode v2 starts signalling once you switch it on.
The line you paste
<script src="https://cdn.kukie.io/s/YOUR-SITE-KEY/c.js" async></script>
What you do not have to do
- Install a Shopify app or wait for App Store review
- Pay a second monthly fee on top of your plan
- Give an app access to customer or order data
- Edit Liquid templates or touch checkout
- Start again when you change theme
Built for Shopify
Made for how Shopify stores run.
Several markets, many apps, a theme you did not write and a checkout you cannot change. All of it works from the same line of embed code.
Knows Shopify's own cookies
Cart, session and localisation cookies are filed under Essential, and Shopify's analytics and attribution cookies where they belong.
Shopify Markets and regions
Sell into the EU, the UK and the US from one store, and show each shopper the consent model you set for their region.
Google Consent Mode v2
Once you switch it on, the defaults are set before any Google tag runs and updated the moment the shopper chooses.
App trackers held until consent
Meta Pixel, TikTok, Hotjar, Clarity, Intercom and 30+ known trackers wait, and you can add the domain of anything an app adds.
Matches your theme
4 layouts, your colours, your corner radius and your own text. The banner keeps its styles apart from your theme's, so neither restyles the other.
70+ languages built in
With Auto-Translation on, the built-in banner text follows the shopper's browser language, right-to-left languages included.
Consent records
Every choice is kept with its date and a consent ID, and you can export the records when someone asks for them.
Plus, Online Store 2.0 and headless
Dawn and every Online Store 2.0 theme, Shopify Plus, and headless storefronts on Hydrogen, Remix or Next.js, where the line goes in the root document head.
Policies you can link to
Generate a cookie policy and a privacy policy from your scan results, then link them from your store's footer.
Built for merchants
Made for people who run a store.
The scanner tells you what your store sets, the categories arrive filled in, the banner matches your theme, and the consent records are there when someone asks for them.
- No developer needed If you can edit a theme file, you can install it. If you would rather not, send the one line to whoever built your store.
- Nothing to maintain Added an app? Run the scanner again and the categories update. The line in theme.liquid never changes.
- One dashboard for every store Each store gets its own site, settings and scans under one account, which suits agencies with several client stores.
Every market you ship to
Consent rules for each market.
Shopify Markets makes it easy to start selling in a new country, and that country's privacy law comes with it. Kukie.io reads the shopper's country and applies the consent model you set for it.
| Law | Shoppers in | What it asks for |
|---|---|---|
| GDPR and ePrivacy | The EU and the EEA | Consent before cookies that are not strictly necessary |
| UK GDPR and PECR | The United Kingdom | The same prior consent for cookies, enforced by the ICO |
| CCPA and CPRA | California | A right to opt out of the sale or sharing of personal information, and a link to do it |
| LGPD | Brazil | Consent and transparency for the personal data of shoppers in Brazil |
Questions about Shopify
How do I add a cookie banner to Shopify?
Paste one line of embed code into your theme. In your Shopify admin, go to Online Store > Themes, open the ... menu on your live theme and choose Edit code, then open Layout > theme.liquid. Paste
<script src="https://cdn.kukie.io/s/YOUR-SITE-KEY/c.js" async></script> directly after the opening <head> tag and select Save. The banner appears on every page of your storefront at once. There is no app to install. The Shopify installation guide has every step.Do I need a Shopify app for cookie consent?
No. Kukie.io is one line of embed code in your theme, so there is no Shopify app to install, no App Store review to wait for and no app subscription on top of your Shopify plan. Nothing asks for access to your customer or order data, and removing it means deleting that one line from theme.liquid.
Does Shopify already have a cookie banner?
Shopify has a built-in cookie banner tied to its Customer Privacy API, and it is deliberately narrow. It governs Shopify's own tracking and the apps that use that API, offers limited design and language control, and does not stop third-party scripts that you or an app added to your theme. A consent tool adds the rest: blocking before consent, a full cookie inventory, rules by region and a consent log you can export.
What cookies does a Shopify store set?
Shopify's own storefront cookies are
_shopify_essential for the session, checkout and fraud protection, _shopify_analytics for Shopify's analytics and _shopify_marketing for its marketing data, each kept for a year, plus cart, cart_currency and localization for the cart. Shopify stopped setting _shopify_y and _shopify_s on 1 January 2026. A typical store adds Google Analytics 4, Google Ads, Meta Pixel, TikTok, Klaviyo, Judge.me and other app cookies. Cart and essential cookies are strictly necessary. In the EU and the UK, most of the others need consent.Will a cookie banner break my Shopify checkout?
No. Kukie.io files Shopify's cart, session and checkout cookies under Essential, the category that is always active. Shopify's checkout pages do not load your theme.liquid, so the banner script does not run there at all, and blocking on the storefront cannot reach payment.
Does it work with Shopify Markets and several regions?
Yes. Kukie.io reads the shopper's country and applies the rule you set for that region, so a shopper in the EU or the UK can see an opt-in banner with Reject all while a shopper in California sees an opt-out notice, on the same store and theme. With Auto-Translation on, the built-in banner text follows the shopper's language in 70+ languages, which suits the storefront languages you serve through Shopify Markets.
Does it support Google Consent Mode v2 for Shopify?
Yes. Once you switch it on, Kukie.io sets Google Consent Mode v2 defaults before any Google tag runs and updates them the moment the shopper chooses, so GA4, Google Ads and the Google & YouTube sales channel keep receiving modelled conversions. Microsoft UET Consent Mode and Matomo work the same way. The Google Consent Mode v2 page explains each signal.
Will it slow down my Shopify store?
Only a little. The shared banner script is about 36 KB compressed (measured in November 2026) and loads asynchronously, so it does not hold up rendering or shift your layout, and its styles are kept apart from your theme's. Your settings are built into your store's own copy of the script, so it never waits for a settings request: the one request before the banner appears is a short region lookup.
Does it work with Shopify Plus, Online Store 2.0 themes and Hydrogen?
Yes. Any theme with a theme.liquid layout works, including Dawn and every Online Store 2.0 theme, and Shopify Plus stores install the same way. For a headless storefront built with Hydrogen, Remix or Next.js, put the same line in the root document head instead of theme.liquid.
Which Shopify app trackers are held until consent?
Kukie.io holds 30+ known trackers until the shopper consents, including Meta Pixel, TikTok, LinkedIn Insight, Reddit, Microsoft UET and Clarity, Hotjar, Segment, Mixpanel, Intercom, Crisp and Google's analytics and ad tags. With Google Consent Mode v2 on, Google's tags load in their denied state instead. For anything an app adds that is not on the list, add its domain to a service in Kukie.io and it waits too (script blocking). The cookie scanner shows what your store loads first.
Still stuck? The Shopify installation guide has screenshots of every step, and our support team will look at your store.
Add a consent banner to your Shopify store.
Scan your store to see what it sets today. Then paste one line into theme.liquid.
Related articles
-
-
GDPR Cookie Consent Requirements: What Your Website Must Do to Stay Compliant
GDPR cookie consent requires prior, informed, and unambiguous opt-in before any non-essential cookies are placed on a visitor's device. Enfo...
-
What are cookies, and why does every website use them?
A server sends a Set-Cookie header, the browser stores the value and returns it with every later request, and that is how sites remember log...
Footnotes
Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.
- 1. Article 5(3) of the ePrivacy Directive (2002/58/EC) in the EU, and regulation 6 of the Privacy and Electronic Communications Regulations in the UK. Back to footnote 1 in the text
