Shopify Cookie Banner: Setup, Consent & Compliance

Shopify has a built-in cookie banner and a Customer Privacy API that, set up correctly, blocks its own analytics until a shopper consents. But the moment you add a Meta Pixel, GA4, or Hotjar through theme code instead of Shopify's pixel system, those scripts fire regardless of the banner. This guide covers both halves: enabling and configuring the native banner, and closing the tracking gap it leaves — the one that carries real GDPR and CIPA risk.

Do you need a cookie banner on Shopify?

For most stores, yes. Shopify sets its own analytics cookies (_shopify_y, _shopify_s) by default, and the moment you add Google Analytics 4, a Meta Pixel, a Klaviyo tag, a reviews app, or any marketing tool, your store places non-essential cookies on shoppers. The EU's GDPR and ePrivacy rules require opt-in before those load; California's CCPA and 18 other US state laws require a clear opt-out. A cookie banner is how you offer that choice — and increasingly, how you avoid both regulatory fines and the US wiretapping-lawsuit wave covered below.

Shopify has genuinely improved here: its native consent system, built around the Customer Privacy API, is more capable than most hosted platforms'. The nuance — and the reason setup and compliance are two separate conversations — is that the banner only governs the trackers wired into that API. Everything else fires freely.

The Customer Privacy API — how Shopify consent actually works

This is the piece most "Shopify cookie banner" tutorials skip, and it's the whole game. Shopify's consent isn't a simple show-a-banner toggle — it's an API that stores each shopper's consent state across four categories: analytics, marketing, preferences, and sale of data (the last for CCPA). Apps and tags check that API to decide whether to fire.

A correct setup works like this: your banner collects consent, maps the shopper's choices to those four categories, and passes the signals to the Customer Privacy API. Trackers registered through Shopify's Web Pixels system then read those signals and hold until consent. When it's wired correctly, GA4, the Meta Pixel, and TikTok tags all respect the shopper's choice.

Migrating manual theme-code tags into Shopify's pixel system (or a consent tool that intercepts them) is the single quickest compliance win on most stores. Until you do, a shopper can decline and still be tracked.

How to set up the Shopify cookie banner

Here's the current path to enable and configure the native banner. It takes a few minutes.

1. From your Shopify admin, go to Settings → Customer privacy.
2. Under Cookie banner, set the region visibility — at minimum the EU/EEA and UK (opt-in), plus California and other US state-law regions (opt-out). Shopify shows the appropriate banner per region.
3. Choose the banner position (bottom, or bottom-left/right) and, if available on your theme, the preferences control so returning shoppers can change their choice.
4. Enable the banner and save. Confirm the "Manage cookie preferences" link appears so shoppers can revisit consent.
5. In Settings → Customer privacy → Data sales, configure the "Do not sell or share" behaviour for US state-law regions.
6. Confirm on a fresh incognito visit: only essential cookies should load until the shopper chooses. Check DevTools → Network to verify — this is the step most setups skip.

What the native Shopify cookie banner doesn't block

Here's the part sizing-and-setup tutorials skip, and it's the part that matters most: Shopify's banner governs trackers wired into the Customer Privacy API — but not scripts and apps that fire outside it. On a real store, that's a large surface area.

• Theme-code tags — a GA4, Meta Pixel, or GTM snippet pasted into theme.liquid fires on load, outside the API. The most common single gap.
• Apps that don't respect the API — reviews (Judge.me, Loox, Yotpo), email (Klaviyo, Omnisend), pop-ups (Privy), chat (Gorgias, Tidio), loyalty (Smile.io), and analytics (Lucky Orange, Hotjar) can set cookies via app embeds or ScriptTag independently of consent.
• Session-replay tools — Hotjar and Microsoft Clarity record shopper behaviour and carry specific US legal risk (see below).
• Embedded content — a YouTube embed, a Google Map, or a third-party iframe can set cookies on render, not on interaction.

This isn't a knock on Shopify — its API is more capable than most. But "a banner is showing" and "trackers are blocked" are two different things. Closing the gap needs every tracker wired into the API, or a consent layer that intercepts the ones that aren't. We built the deeper, Shopify-specific version of this — including the exact Web Pixels setup and a native-vs-ConsentPixel breakdown — into our cookie consent for Shopify guide.

Your 3 options for a compliant Shopify cookie banner

Once you know the gap exists, there are three realistic routes — honestly compared, strongest coverage first.

1. An independent consent tool (e.g. ConsentPixel)

Best for: any store running GA4, GTM, a Meta Pixel, non-API apps, or session-replay — especially with US visitors. A dedicated consent layer that blocks trackers before consent regardless of how they were added, passes all four Google Consent Mode v2 parameters, writes to the Customer Privacy API, detects GPC, and keeps a timestamped consent log. Among independent tools, ConsentPixel — Privacy · Verified is built prevention-first: it blocks the scripts rather than showing a notice over them.

2. A Shopify consent app (Pandectes, Enzuzo, and others)

Best for: stores wanting a native app-store install with a banner and policy bundle. These install from the App Store and integrate with the Customer Privacy API. They're capable and widely used. The difference is emphasis: verify the tier you pick actually blocks theme-code and non-API app scripts before consent — some manage API-wired tags well but leave manual injections firing.

3. Shopify's native cookie banner alone

Best for: stores using only Shopify-native features and Web-Pixels-wired tags, with no theme-code trackers. For that setup it's a reasonable baseline. But on its own it can't reach theme-code scripts or non-API apps, and its consent logging is basic — so it's rarely sufficient once you've added a real marketing stack.

Native vs Shopify apps vs ConsentPixel: an honest comparison

Here's the category-level view — where each route lands on what privacy law cares about. (For the tool-by-tool breakdown, see the Shopify platform page.)

The pattern: API-wired tags are table stakes. Coverage diverges on the thing that creates risk — blocking the scripts that live outside the API before consent.

The US angle most Shopify guides skip: CIPA

Nearly every "Shopify cookie banner" tutorial focuses on GDPR. It matters — but if any of your shoppers are in the United States, the more urgent 2026 risk is often the California Invasion of Privacy Act (CIPA). Plaintiffs' firms have built a sustained wave of "wiretapping" lawsuits arguing that session-replay tools, tracking pixels, and chat widgets capturing a shopper's activity before consent amount to unlawful interception. Under California Penal Code §637.2, a plaintiff can seek statutory damages of $5,000 per violation — often read per affected visitor — with no proof of harm required.

Why this hits Shopify stores specifically: the highest-risk category — session-replay like Hotjar and Clarity, plus conversion pixels on checkout — is exactly what gets added via theme code or non-API apps, outside the Customer Privacy API. A store running Hotjar on checkout and serving California shoppers can carry real exposure even with the native banner enabled. The fix is to hard-block those scripts until consent, not merely display a notice. You can follow the trend on our CIPA Lawsuit Tracker.

Frequently asked questions