Shopify Consent Mode v2: how to set it up the right way

What Consent Mode v2 changes for a Shopify store

Google Consent Mode v2 is the way your Google tags learn what the visitor accepted. It uses four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. Since March 2024, Google requires the two newer signals for visitors in the European Economic Area if you want to keep remarketing, audiences and full conversion measurement in Google Ads. Our Google Consent Mode v2 implementation guide covers the mechanism in detail; this article focuses on what is specific to Shopify.

Shopify's help center says it plainly: event data sent to Google from customers in the EEA is not used for personalized advertising unless Consent Mode v2 is active and valid consent has been obtained. For a store that relies on Google Ads, a missing or broken setup means smaller remarketing lists and weaker conversion data, not just a legal risk under the GDPR.

On Shopify, the difficulty is not the code. It is that Google tags can reach your store through three different doors: the Google & YouTube sales channel, a custom pixel in Settings → Customer events, or a script in your theme (gtag.js or Google Tag Manager). Each door follows a different consent source.

The two ways consent reaches Google on Shopify

Route 1: Shopify's privacy settings and the Google & YouTube app

Shopify stores the visitor's choice in its Customer Privacy API, with four categories: analytics, marketing, preferences and sale_of_data. That choice can come from Shopify's native cookie banner (Settings → Customer privacy) or from a third-party consent app that calls setTrackingConsent() when the visitor clicks.

The Google & YouTube app reads that consent state and forwards it to Google. The app pixels in Customer events (Google, Meta, TikTok) also follow the Customer Privacy API. This route is the one Shopify supports out of the box, and it is the only one that covers the checkout and the order status page, where your theme code does not run.

One exception: if you add Google through a custom pixel in Customer events, Shopify states that you must insert the Consent Mode v2 code yourself in that pixel.

Route 2: a CMP in theme.liquid with the gtag stub

The second route puts the consent banner and the Consent Mode stub in theme.liquid, right after <head> and above {{ content_for_header }}. The stub declares the four signals as denied at HTML parse time, before any Google tag loads. When the visitor accepts or refuses, the banner sends gtag('consent', 'update', …) and loads, or keeps blocked, the tags you declared in it.

This route gives you one banner and one consent log for the whole storefront, with the same behaviour as on your other sites. Its limit is the checkout: Shopify does not run theme code there, so conversion tracking on the thank you page goes through Customer events, which follow the Customer Privacy API.

Which route to choose

Pick one source of truth per tag, never two.

• Your Google tags come from the Google & YouTube app (Merchant Center, Performance Max, purchase conversions): stay on route 1. Use Shopify's banner or a consent app that writes to the Customer Privacy API, and do not add a second gtag.js in the theme.
• Your Google tags live in the theme or in GTM (GA4 with custom events, several Ads accounts, other tools in GTM): route 2 is simpler. Turn off data sharing in the Google & YouTube channel so it does not send events on its own, and let the CMP drive Consent Mode.
• You run both today: this is a frequent setup, and the most fragile one. The theme banner says "refused" while the channel pixel follows a Shopify consent state that nobody set. Choose one route and remove the duplicate.

If you are unsure what your store loads today, check it first: run the free cookie scanner on your homepage and a product page to see in 30 seconds which cookies are set before any choice.

The choice between Basic and Advanced Consent Mode applies in both routes. In Basic mode, Google tags wait for consent; in Advanced mode, they load in cookieless mode and send anonymous pings after a refusal. Our comparison of Consent Mode Basic vs Advanced explains what each one does to your data.

How to set up Consent Mode v2 on Shopify step by step

With route 1 (Customer Privacy API)

1. In Settings → Customer privacy, select the regions where a cookie banner must appear (at least the EEA, the UK and Switzerland if you sell there).
2. Either activate Shopify's banner or install a consent app that states it is connected to the Customer Privacy API. Shopify asks merchants who use a third-party banner to integrate it with these settings.
3. In the Google & YouTube app, connect your Google Ads and Merchant Center accounts and keep data sharing on.
4. Remove any gtag.js or GTM snippet that duplicates the same Google tags in theme.liquid.
5. If you use a custom pixel for Google, add the Consent Mode v2 code inside it.

With route 2 (CMP in the theme)

1. Duplicate your theme as a backup, then open Online Store → Themes → … → Edit code → Layout → theme.liquid.
2. Paste the CMP snippet right after <head>: the Consent Mode stub first, then the banner loader. Everything above it escapes prior blocking.
3. If you use GTM, keep its container below the CMP snippet, never above.
4. In the Google & YouTube channel, turn off data sharing (or remove the measurement IDs) so the channel pixel stops sending events outside your banner.
5. Declare GA4 and Google Ads as services in your CMP so they load only after consent.
6. Remove Shopify's native banner (Settings → Customer privacy → Cookie banner → Remove) so visitors never see two banners.

A concrete example: with FlowConsent, the snippet you copy from the dashboard already contains the stub with the four denied defaults, wait_for_update, url_passthrough and ads_data_redaction, followed by the banner loader. You paste one block and the order is right by construction.

Checkout, Customer events and custom pixels

Three Shopify details catch most merchants out.

• Checkout does not run theme code. Your theme banner does not appear on checkout or on the order status page, and the old "additional scripts" field is retired. Visitors make their choice on the storefront.
• Customer events run in a sandbox. App pixels and custom pixels execute outside your theme, so a theme banner cannot block them. They follow the Customer Privacy API.
• Theme updates can drop your edits. Updating a theme from the Theme Store may not carry over code changes. After each update, check that the snippet is still at the top of theme.liquid.

How to check that Consent Mode v2 works on your store

1. Open the store in a private window and, before clicking anything, look at the network requests to google-analytics.com or googleadservices.com. With Advanced mode you may see pings carrying gcs=G100 (all denied); with Basic mode you should see nothing.
2. Click Refuse: no _ga or _gcl_au cookie should appear.
3. Click Accept: the next hits should carry gcs=G111.
4. In Google Tag Assistant, the Consent tab should show a default state before any tag, then an update.

Our guide on how to check that Google Consent Mode v2 is working details each test, and the Shopify GDPR cookies guide covers the rest of the store's compliance.

Common mistakes on Shopify

• A gtag.js in the theme and the Google & YouTube channel active: double tracking and two consent sources.
• GTM pasted above the consent snippet: the config command reaches Google before the defaults.
• A third-party banner that does not write to the Customer Privacy API while app pixels stay active: those pixels follow a consent state your visitors never set.
• Shopify's banner and a CMP banner shown together: two conflicting choices.
• Testing only the "Accept" path. The refusal path is the one that has to hold legally.

How FlowConsent handles Consent Mode v2 on Shopify

FlowConsent follows route 2. You paste one snippet at the top of theme.liquid: it sets the four Consent Mode v2 signals to denied before any Google tag, then sends the update as soon as the visitor chooses. GA4, Google Ads or Meta Pixel are declared as services and load only after consent, and every choice is stored in an exportable consent proof. The installation takes about ten minutes, the banner is hosted in Europe, and the plan is free up to 25,000 sessions per month (Pro at €14.99 per month up to 100,000). The Shopify installation guide explains how to turn off the Google & YouTube data sharing and remove Shopify's native banner so FlowConsent stays the single source of consent on your storefront.