Cookie Consent for
Shopify in the EU
Done Properly.

What Shopify's built-in consent actually does

Let's start where most Shopify compliance content won't: Shopify has built a lot of this in, and for a straightforward store it can be enough. Under Settings → Customer privacy you get three real things:

• A cookie banner you can switch on, style lightly, and scope to specific regions.
• The Customer Privacy API — the mechanism that actually records the shopper's choice and exposes it to apps and pixels.
• Consent Mode v2 and Meta integration, so connected tools are supposed to respect a decline.

For a store running GA4 and the Meta Pixel through Shopify's native channels, turning this on, scoping it to the right regions, and confirming your pixels route through Shopify's consent system covers the core requirement. No third-party app strictly required.

That conditional is the whole page. Read it again: if you have active markets in those regions. Shopify is not detecting your EU visitors and protecting you. It is reading your Markets configuration — a commercial setting your team chose for shipping and currency reasons — and inferring your legal obligations from it.

Trap 1: the EEA-market assumption

Here is the scenario that catches agencies. A client sells primarily in the US. You configure Markets accordingly — US market active, maybe Canada. The store goes live, runs Meta and Google ads, and those ads reach people in Ireland, Germany, the Netherlands. Or a French customer finds the store organically. Or an EU-based journalist links to a product.

No EEA market is configured, so no banner appears — and every tracker fires on page load. Not because anyone disabled anything, but because the automated setting did precisely what it was designed to do.

This also hits older stores. Automated privacy settings were introduced for new stores; a store built three years ago may never have had them, and nobody has looked since. And it hits any store where someone toggled automated settings off to customise the banner and then scoped the regions incorrectly — or not at all.

The fix takes two minutes

In your Shopify admin, go to Settings → Customer privacy → Cookie banner. In Regions and content, either leave Use automated settings on and confirm you have an active EEA/UK market, or turn it off and explicitly select your regions. If you sell to Europe at all — or advertise to Europe at all — the EEA and UK belong in that list regardless of what Markets says.

Trap 2: pixels in theme.liquid bypass consent entirely

This is the one that produces genuinely non-compliant stores with a perfectly good-looking banner on them — and it is almost always an agency's doing, inherited from a previous developer.

Shopify's consent system works by exposing the visitor's choice to pixels and apps that ask for it. Shopify's pixel manager checks consent state before loading a pixel: if a pixel requires marketing or analytics permission and the visitor hasn't granted it, the pixel doesn't load. Pixels read consent via the init.customerPrivacy API and listen for changes with the visitorConsentCollected event.

A script pasted into theme.liquid does none of that. It is raw JavaScript in the page. It fires when the page loads. It has never heard of the Customer Privacy API, and the API has never heard of it. Your banner can sit there politely asking permission while the Meta Pixel has already transmitted.

The audit is quick and you should run it on every EU store you touch:

1. Open Online Store → Themes → Edit code → theme.liquid. Search for fbq, gtag, googletagmanager, connect.facebook.net, hotjar, clarity, tiktok.
2. Check Settings → Checkout → Additional scripts (and checkout.liquid on Plus).
3. Check any custom app or snippet a previous developer added.
4. Anything you find: move it to Settings → Customer events as a custom pixel with the correct Permission setting — then delete the original.

Trap 3: custom pixels with the wrong Permission setting

Moving a pixel into Customer events is necessary but not sufficient. Every custom pixel has a Permission setting that determines whether customer consent is required, under applicable law, for that pixel to collect data for marketing, analytics or preferences purposes. There is also a separate Data sale setting for jurisdictions with opt-out rights.

Shopify's sandbox only blocks pixels that are correctly configured with the right permission settings. Get the setting wrong — mark a marketing pixel as not requiring permission — and Shopify will dutifully fire it before consent, exactly as instructed. The banner still shows. The store still looks fine. The pixel still transmits.

Checkout is a different environment

One more thing agencies discover the hard way: Shopify's checkout is effectively a separate site. It doesn't use theme.liquid, and you practically cannot inject custom code into it — Shopify Plus could historically use checkout.liquid, but that route is being deprecated. Custom pixels running on checkout execute inside an iframe, in a separate environment from your storefront's top window. Any consent architecture that assumes one shared JavaScript context across storefront and checkout is built on a false premise.

How the Customer Privacy API actually works

Shopify's Customer Privacy API is the plumbing underneath all of this, and understanding it separates agencies who configure Shopify from agencies who guess at it. It recognises four consent signals:

A correct integration is simple to describe: your banner collects consent, maps the visitor's choices to those four categories, and passes the signals to the API. Shopify then conditionally loads or blocks its own tracking scripts based on them. When Shopify's native banner is enabled, it displays in the configured regions and passes consent to the API automatically.

What Shopify's default banner doesn't do

Assume you've configured the regions correctly and your pixels all route through Customer events with proper permissions. You are now in a genuinely defensible position on the biggest issue — prior blocking. But the default banner still leaves gaps that EU regulators have been explicit about:

E-commerce is not flying under the radar

The assumption that regulators only pursue Big Tech died in September 2025, when France's CNIL fined Shein €150 million for placing cookies before users gave permission and for an inadequate reject option on its banner. On the same day, Google was fined €325 million. Shein is an e-commerce store. The violation was the banner and what fired behind it.

Shopify stores are, if anything, easier targets than most. They are trivially identifiable — the platform fingerprint is obvious in the page source. They run a predictable stack: GA4, Meta Pixel, Klaviyo, Hotjar, TikTok. And the merchant usually assumes the platform handled compliance. That combination is exactly what an automated regulator scan or a claimant's tooling is built to find.

Scan any Shopify store in 10 seconds

Every trap on this page produces the same observable symptom: something transmits before the visitor chooses. That is checkable from outside the store, with no admin access, in about ten seconds — which makes it the fastest audit in an agency's toolkit.

Our free scanner opens the storefront with a clean session, records every tracker that fires before consent, and shows you exactly what a regulator's scan would capture. Run it on a client's store before the pitch. It is a more persuasive argument than any deck.

The EU Shopify checklist, in order

Shopify EU cookie compliance checklist 2026

Shopify EU cookie consent — frequently asked questions