GDPR Cookie Compliance for Shopify Stores: Complete 2026 Guide

Why Shopify stores need cookie compliance

GDPR applies to any business that processes personal data of EU residents — regardless of where your store is headquartered. If a shopper in Germany buys from your Shopify store, you're in scope. Cookies that track that shopper (analytics, advertising, retargeting) require their prior consent.

The ePrivacy Directive (the "cookie law") reinforces this: non-essential cookies cannot be set until the user actively opts in. Pre-ticked boxes don't count. Continued browsing doesn't count. Consent must be freely given, specific, informed, and unambiguous.

The risk isn't theoretical. Cookie banners that don't block trackers until consent, or that have dark-pattern "Reject" buttons that are deliberately harder to click, are being actively targeted by regulators and privacy NGOs. Shopify's built-in consent framework does not make you compliant by itself — you still need to implement it correctly.

What cookies does Shopify set by default?

Before you can get consent, you need to know what you're getting consent for. Shopify stores typically set cookies from three distinct sources:

How to audit your Shopify store's cookies

A cookie audit tells you every cookie your store sets, which third parties set them, and whether you're disclosing them correctly in your cookie policy. Do this before you configure your consent banner — you can't get consent for cookies you don't know about.

Option 1: Manual audit with Chrome DevTools

Option 2: Automated scanning

The faster approach is automated scanning. CookieGuard crawls your Shopify store, discovers every cookie set across all pages, classifies them by category, and generates a compliance report. It catches cookies that manual audits miss — including those set only after user interaction — and re-scans automatically when your store changes.

Setting up a cookie consent banner on Shopify

Shopify's Customer Privacy API (introduced in 2022 and updated in 2024) provides the foundation for consent management. It gives you a JavaScript API to check consent state and block Shopify's own tracking pixels until consent is granted. But using it correctly requires configuration — it does not automatically make your store compliant.

What Shopify's built-in tools cover

The Privacy and Compliance section in Shopify Admin lets you enable the built-in cookie consent banner. This banner:

• Shows a consent dialog to visitors from regions where consent is required (EEA, UK, California)
• Blocks Shopify's own analytics cookies (_shopify_y, _shopify_s, etc.) until consent is granted
• Stores the consent choice and passes it to Shopify's Customer Privacy API
• Works with Shopify's native pixels (Meta, Google Ads, TikTok) through the Shopify Pixel framework

Enabling Shopify's built-in consent banner

<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){ dataLayer.push(arguments); }
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>

// In Shopify Admin → Settings → Customer Events → Add pixel
// Select "Google Analytics (GA4)" and enter your Measurement ID
// Shopify automatically blocks this until analytics consent is granted

// If you need custom GA4 config, use the Pixel API:
analytics.subscribe('page_viewed', (event) => {
  gtag('event', 'page_view', {
    page_location: event.context.document.location.href
  });
});

Configuring Google Consent Mode v2 for Shopify

If you use Google Analytics 4 or Google Ads, you also need to implement Consent Mode v2. Shopify's native GA4 pixel handles the basic consent signals when you use the Customer Events framework. But if you use Google Tag Manager loaded via a custom pixel, you need to configure GTM's Consent Initialisation trigger to call gtag('consent', 'default', ...) before any other tag fires.

CookieGuard for Shopify: automated compliance scanning

Manually auditing and maintaining cookie compliance on a Shopify store is a recurring task, not a one-time setup. Every new app install, every theme update, every pixel configuration change is a potential compliance gap. CookieGuard automates this.

What CookieGuard does for Shopify stores

• Automated cookie discovery — crawls your store across all page types (homepage, product, collection, cart, checkout) and finds every cookie set by Shopify, apps, and custom scripts
• Violation detection — identifies cookies being set before consent, missing consent categories, or trackers loading without a legal basis
• App attribution — maps each cookie back to the Shopify app or script that sets it, so you know exactly what to fix
• Continuous monitoring — re-scans your store automatically and alerts you when new cookies appear (e.g., after an app install)
• Compliance reports — generates audit-ready reports showing which cookies require consent, which are exempt, and your current compliance status

CookieGuard vs manual compliance

Shopify GDPR Cookie Compliance Checklist

Use this checklist to verify your store's compliance status. Every item marked Critical is a potential fine.

Common Shopify cookie compliance mistakes

These are the issues we see most often when scanning Shopify stores:

1. Using the Shopify consent banner but still loading scripts via GTM

A common pattern: the Shopify consent banner is enabled, but Google Tag Manager is loaded via a custom <script> tag in theme.liquid. GTM then fires all its tags — including GA4 and Meta Pixel — immediately on page load, before any consent is collected. Shopify's banner has no visibility over GTM-loaded scripts.

Fix: Load GTM as a Shopify Custom Pixel. Configure a Consent Initialisation tag in GTM that sets all consent to denied by default. Use Shopify's visitorConsentCollected event to trigger consent updates in GTM.

2. Klaviyo and SMS apps firing before consent

Email and SMS marketing platforms (Klaviyo, Attentive, Postscript) often set persistent cookies for visitor identification and pop-up suppression. Many Shopify merchants install these via theme code rather than Shopify Pixels, meaning they bypass the consent framework entirely.

Fix: Check if your email/SMS provider supports the Shopify Customer Events framework. If not, ensure their script is loaded conditionally — only after marketing consent is granted — using the Customer Privacy API's currentVisitorConsent() method.

3. Consent banner not appearing on checkout pages

Shopify's checkout is hosted on a separate subdomain (checkout.shopify.com or a custom checkout domain). Your theme's consent banner typically does not appear on checkout pages. If checkout pages set additional marketing cookies, those may not have a valid consent basis.

Fix: Review what cookies are set on your checkout pages specifically. Shopify's native checkout pixels (set through Customer Events) are automatically consent-gated. Third-party checkout extensions with their own cookies may need separate handling.

4. Cookie policy not updated after installing new apps

Your cookie policy is a legal document that must accurately reflect the cookies your store sets. A standard Shopify privacy policy template does not automatically update when you install new apps. Most Shopify stores have outdated cookie policies that don't disclose half the cookies being set.

Fix: Re-audit your cookies every time you install a new app. Update your cookie policy to reflect the current state. Automated scanning (see above) eliminates the risk of missing new cookies.