Satyam Mishra

Posted on Oct 19 Edited on Oct 27 Originally published at satyam-mishra-dev.tech

GDPR Cookie Consent on Shopify: What EU Stores Need

#shopify #gdpr #ecommerce #webdev

Originally published at satyam-mishra-dev.tech.

If your Shopify store sells to people in Ireland or anywhere in the EU, you need their consent before analytics and advertising cookies run. Many stores have a banner that looks right but loads the Meta pixel and Google tags before anyone clicks anything. This is how to set it up so it actually works.

This guide explains the technical setup. It is not legal advice: for your privacy policy and data processing, speak to a solicitor or data protection adviser.

The rules in plain terms

Cookies that are strictly needed for the store to work, like the cart and checkout, do not need consent.
Analytics, advertising and most marketing cookies do need consent, given before they load.
Rejecting must be as easy as accepting. A big “Accept all” next to a hidden “Settings” link is not a fair choice.
No pre-ticked boxes, and no “by continuing to browse you agree”.
In Ireland, the Data Protection Commission’s cookie guidance also says consent should not be assumed to last forever; asking again after around six months is a sensible default.

1. Turn on Shopify’s own cookie banner

Shopify has a built-in cookie banner under Settings → Customer privacy. It connects to Shopify’s Customer Privacy API, which is what Shopify’s own analytics, the Google and YouTube app, the Facebook and Instagram app and many other apps listen to. Set it to show to visitors in the EU and UK, and include a clear reject button.

If you use a third-party consent app instead, check it passes the shopper’s choice to the Customer Privacy API. If it doesn’t, your apps cannot see the choice and keep tracking anyway.

2. Find tracking that ignores consent

The banner only controls the tags that ask it for permission. Code pasted straight into the theme usually doesn’t ask. Look for:

Google Analytics or Google Ads tags hard-coded in theme.liquid.
A Meta pixel added by hand on top of the Facebook and Instagram app, which also double-counts purchases.
Old scripts in Settings → Checkout or in the order status page, left over from previous apps.
Chat widgets, heatmaps and review apps that set their own cookies.

Move tracking into Shopify’s customer events (pixels) or the official apps, which respect consent, and delete the hard-coded copies.

3. Set up Google Consent Mode v2

Since March 2024, Google requires Consent Mode v2 for advertisers who want remarketing and conversion measurement for users in the European Economic Area. Without it, your Google Ads audiences shrink and conversions go missing. The Google and YouTube app on Shopify supports Consent Mode and reads the shopper’s choice from Shopify’s privacy settings, so with the built-in banner this is mostly a case of connecting the official app instead of pasting tags.

4. Test what actually loads

Open the store in a private window from an EU location, or with a VPN set to Ireland.
Before clicking the banner, open the browser’s developer tools and check the Network tab. No requests should go to Meta, Google Ads, TikTok or analytics tools.
Click reject and browse a few pages. Still nothing should fire.
Open a new private window, click accept, and check the tags now load and record a page view.

5. Email marketing consent is separate

Cookie consent does not give you permission to send marketing emails.
Use an unticked box at checkout or signup for marketing emails, and record who ticked it. Shopify stores this on the customer record.
Existing customers can sometimes be emailed about similar products without a fresh opt-in, provided they had a clear chance to opt out, but check this with your adviser.
When moving from another platform, only import customers who opted in as subscribed.

Shopify’s banner or a cookie consent app?

Shopify’s own banner is enough when every tracking tool on the store runs through Shopify: the official Google, Meta and TikTok apps and pixels added under customer events. They all read the shopper’s choice from the Customer Privacy API. A consent app earns its place when the store also loads scripts Shopify does not control, or when you need features the built-in banner does not offer.

Before installing one, check four things:

It writes the choice to Shopify’s Customer Privacy API. Otherwise Shopify’s own apps and checkout cannot see what the shopper decided.
It sends Google Consent Mode v2 signals, including the newer ad_user_data and ad_personalization, or Google Ads and GA4 lose EU data.
It blocks scripts until consent, not just hides the banner. On some apps this is only on paid plans.
Reject is as easy as accept. A “Reject all” button next to “Accept all”, not hidden behind “Settings”.

Option	What stands out	Watch for
Shopify cookie banner	Free, built in, connected to the Customer Privacy API by default.	Only controls tracking that goes through Shopify. Scripts pasted into the theme are not blocked.
Pandectes GDPR Compliance	Uses Shopify’s privacy API, highly rated on the App Store, free plan for the banner.	Consent Mode, automatic blocking and IAB TCF sit on higher paid plans.
Cookiebot	Consent Mode v2 and blocking before consent on its free plan.	Its Shopify app is new, with few reviews so far.
CookieFirst	Google-certified consent platform with euro pricing, installed with its own script.	Check how it is installed on your theme and that it passes consent to Shopify’s API.

Plans and prices change often, so check each app’s current listing before you choose. The four checks above matter more than the brand.

Common mistakes

A banner with “Accept” and “Close”, where closing still loads every tag.
A banner that only shows on the home page, while shoppers from Google land straight on product pages.
A privacy policy that doesn’t list the apps and tools the store actually uses.

Shopify GDPR cookie questions

Does Shopify have a built-in cookie banner?

Yes, under Settings → Customer privacy. It can be shown only to visitors from regions that need it, such as the EU and the UK.

Is a cookie banner legally required for an Irish store?

Yes, if the store sets any non-essential cookies, which includes analytics and ad pixels. The Irish Data Protection Commission’s cookie guidance requires consent before those cookies are set, and does not accept pre-ticked boxes or “by continuing to browse you agree”.

Do I need a paid consent app?

Not always. If all tracking runs through Shopify’s official apps and customer events, the free built-in banner covers it. Paid plans are mainly for blocking outside scripts automatically and for advanced Consent Mode.

What happens if Consent Mode is missing?

Google Ads and GA4 cannot use EU visitors’ data for measurement and remarketing in the way they expect, so reported conversions drop and audiences shrink.

Sources

I'm Satyam Mishra, a software developer in Pune working with stores and startups in Ireland, Europe and the US. More guides at satyam-mishra-dev.tech/guides.

DEV Community