Shopify and GDPR cookies: the compliance guide

TL;DR

Shopify sets essential cookies (cart, session, checkout, localisation) that are exempt from consent, but also its own analytics and marketing cookies, and every marketing pixel (Meta, Google, TikTok) or third-party app you add brings more. All of those require prior consent under the GDPR. Shopify offers a native cookie banner built on its Customer Privacy API, but it only governs what goes through that API: scripts hard-coded in the theme or injected by apps that ignore it keep running. For full compliance, you need a CMP that loads before everything else in theme.liquid, blocks non-essential scripts, keeps Shopify's pixels in line and stores proof of consent.

Why Shopify alone is not enough for cookie compliance

Shopify is a hosted e-commerce platform used by millions of merchants. It handles infrastructure, hosting and checkout, but cookie compliance remains the merchant's responsibility. European regulators apply the same rules to online stores as to any other website: every non-essential cookie needs prior consent, and the store must be able to prove it.

Cookies on a Shopify store come from four sources:

• Native Shopify cookies: session, cart, checkout, plus Shopify's own analytics and marketing cookies.
• Third-party apps: reviews, upsell, email marketing, chat, product recommendations.
• Conversion pixels: Meta, Google Ads, TikTok and others.
• Analytics scripts: Google Analytics, Klaviyo, Hotjar.

Its flexibility through apps and built-in marketing pixels is exactly what makes compliance risks easy to underestimate.

Which cookies does Shopify set?

Shopify publishes the list of cookies it sets on storefronts. It changes over time, so check the current version of its cookie policy before writing yours.

Essential cookies (exempt from consent)

• cart: contents of the shopping cart.
• localization: country and currency used for the cart.
• _shopify_essential: session and checkout information needed for the store to work.
• _tracking_consent: stores the visitor's privacy choices.
• _shopify_test: checks that cookies can be set.

You may also come across older names such as secure_customer_sig (customer login), cart_sig or cart_ts in existing stores and documentation. Whatever their name, strictly necessary cookies must still be listed in your cookie policy.

Shopify analytics and marketing cookies (consent required)

Shopify classifies some of its own cookies as analytics or marketing, so they are not exempt:

• Analytics: _shopify_s (browsing session), _shopify_y (visitor tracking), _shopify_analytics, _landing_page, _orig_referrer.
• Marketing: _shopify_marketing.

Third-party cookies (consent required)

These cause the most trouble: _ga and _gid (Google Analytics), _fbp and _fbc (Meta Pixel), and cookies from apps such as Klaviyo, Judge.me or ReCharge. They always require prior consent.

Pixels and apps: where the real risk lies

Shopify's pixel system lets you connect Meta Pixel, Google Analytics / GA4, TikTok Pixel and other marketing tools natively. Each one sets its own advertising or analytics cookies. Pixels installed by sales channels (Google & YouTube, Facebook & Instagram) and custom pixels live in Settings → Customer events. They run in a Shopify sandbox, outside your theme, so a script in theme.liquid cannot hold them back.

Apps from the Shopify App Store are the other big source. Chat tools (Tidio, Gorgias), recommendation engines and retargeting tools often inject tracking scripts directly into the storefront, outside the pixel system.

How to audit cookies on a Shopify store

Step 1: scan every page type

Use the FlowConsent scanner or Chrome DevTools. A Shopify store has several templates to cover: homepage, collection pages, product pages, cart and, as far as possible, checkout. Record each cookie: name, domain, duration, issuer.

Step 2: inspect pixels and apps

In the Shopify admin, open Settings → Customer events to list every active pixel, then Settings → Apps and sales channels for apps that may inject scripts. Each pixel and each app is a potential source of cookies.

Step 3: classify and document

Sort cookies into essential, analytics, marketing and preferences, then update your cookie policy, including native Shopify cookies. Repeat after every app installation or update. The complete cookie audit method details each step.

Shopify's native banner vs an external CMP

Shopify offers its own cookie banner under Settings → Customer privacy, built on the Customer Privacy API. Pixels managed in Customer events and apps that read this API respect the choice recorded there.

Its limits are what matter for GDPR compliance:

• It only governs what goes through the Customer Privacy API. Scripts hard-coded in the theme, or injected by apps that do not read the API, keep running whatever the visitor chooses.
• Before relying on it, check that you could export timestamped consent records if a supervisory authority asked for them.
• Customisation is generally narrower than with a dedicated CMP, which matters if you need fine per-category choices, several languages or a design aligned with your brand.

For a store targeting visitors in the EEA, an external CMP is the most reliable way to prove that nothing runs before consent.

How to add a CMP to Shopify

Option 1: a Shopify consent app

The App Store offers consent apps such as Pandectes, Consentmo or CookieYes. They are simple to install, but some free apps only display a banner without actually blocking scripts. Test before trusting.

Option 2: an external CMP in theme.liquid

An external CMP like FlowConsent goes into the theme's theme.liquid file. This gives finer control and features such as Google Consent Mode v2 and compliance reports.

Installing FlowConsent on Shopify

The full procedure is in the Shopify installation guide. It takes three steps.

1. Copy the snippet from Builder → Deployment → Integration. It has two parts: a Google Consent Mode v2 block that sets every signal to denied by default, then the banner loader.
2. Paste it in theme.liquid. In Online Store → Themes, duplicate your theme as a backup, then click … and Edit code on the live theme. In the Layout folder, open theme.liquid and paste the snippet right after the opening <head> tag, above {{ content_for_header }}. That object loads the scripts Shopify and your apps add to the store, so the snippet must come first. After any theme update, check that the snippet is still there.
3. Neutralise Shopify's own banner and channel pixels. Two banners mean two conflicting consents, so remove Shopify's banner once your trackers are declared in FlowConsent (Settings → Customer privacy → Cookie banner, then More actions → Remove cookie banner). For the Google & YouTube and Facebook & Instagram channels, turn off data sharing (or remove the measurement IDs entered there) and declare Google Analytics, Google Ads or Meta Pixel in Builder → Services: the banner then loads them only after consent.

The Free plan costs nothing, needs no credit card and covers up to 25,000 sessions per month.

How to block scripts before consent on Shopify

There are three families of scripts, and each one is handled differently.

• Scripts in the theme or injected by apps. Remove tracking tags from the theme and let the CMP load them: in FlowConsent, declare them in Builder → Services. The generic alternative is type="text/plain" with a data-category attribute, which the CMP reactivates after consent.
• Custom pixels in Customer events. Each custom pixel has a Permission setting: set it to Required and pick the purposes (marketing, analytics, preferences) so it only fires once the matching consent has been given.
• Sales channel app pixels. They follow the consent recorded through the Customer Privacy API, not your banner. The cleanest route is the one above: turn off their data sharing and let the CMP load the tags.

If you run Google Tag Manager in the theme, never load the banner from GTM, as it would arrive too late: keep the CMP snippet above the GTM container.

Then check in a private window, DevTools Network tab: no request to Google, Meta, TikTok or any other third party should leave before you click Accept.

What about checkout?

Shopify's checkout does not run your theme code: theme.liquid applies neither to checkout nor to the Thank you and Order status pages, and Shopify has retired the old "additional scripts". Your banner therefore does not appear during checkout, and visitors make their choice on the storefront beforehand. Do not paste trackers into those pages: conversion tracking goes through Customer events, which depend on the Customer Privacy API. Checkout also sets its own strictly necessary cookies, which belong in your cookie policy.

Shopify Markets and multi-country compliance

If you sell internationally with Shopify Markets, the rules differ by region: the GDPR requires opt-in in the EEA, CCPA/CPRA works on an opt-out basis in California, and Brazil's LGPD has its own requirements. The safe baseline is to apply the strictest model (prior consent) wherever you cannot tell the regimes apart, and to check that your CMP can adapt the banner to each jurisdiction you target.

Shopify and Google Consent Mode v2

If your store uses GA4 or Google Ads, Consent Mode v2 is essential: without it, Google tags have no consent signal and your ad measurement suffers. It can be set up through GTM in theme.liquid or directly by the CMP. The FlowConsent snippet sets the denied defaults itself and updates them as soon as the visitor chooses. The Consent Mode documentation explains how other tags are handled.

Common mistakes on Shopify stores

• Meta Pixel and GA4 running without a banner. Both set advertising and analytics cookies on page load. Without blocking, every visitor is tracked without consent.
• Relying only on Shopify's native banner. It does not cover scripts outside the Customer Privacy API, and a full audit often reveals unmanaged cookies.
• Treating `_shopify_y` and `_shopify_s` as essential. Shopify itself classifies them as analytics cookies.
• Forgetting channel pixels. The Google & YouTube or Facebook & Instagram channels keep sending data after a refusal if their data sharing is still on.
• Not auditing app cookies. Every installed app can set its own undocumented cookies.
• Snippet below `{{ content_for_header }}`, or lost after a theme update.
• Pasting trackers into checkout pages, where the banner never runs.
• Not updating the cookie policy after each new app.
• No stored consent logs. During an inspection, you must prove that consent was collected.

Shopify cookie compliance checklist

• Run a scan of your store on every page type: homepage, collection, product, cart, checkout.
• List all active pixels in Settings → Customer events and all apps that may inject scripts.
• Install a CMP: a Shopify app or an external CMP in theme.liquid, right after <head>.
• Remove Shopify's native banner once trackers are declared in the CMP, to keep a single consent.
• Turn off data sharing in sales channels and let the CMP load Google and Meta tags.
• Set custom pixels to Permission: Required with the right purposes.
• Check that the banner offers Accept and Reject with equal visibility.
• Enable Google Consent Mode v2 if you use GA4 or Google Ads.
• Write a cookie policy that includes native Shopify cookies and checkout cookies.
• Adapt the banner to each jurisdiction if Shopify Markets is active.
• Enable timestamped consent logs and add a "Manage cookies" link in the theme footer.
• Test in private browsing, then re-audit after every app installation or theme update.

Verify and keep it compliant over time

What matters is not that a banner shows up, but what still runs when a visitor refuses. FlowConsent's compliance verification loads your store pages in a real browser with consent refused and lists everything that still fires. Each verification is dated and archived with a screenshot, so you build up audit evidence. Put your key templates under recurring monitoring to get an alert if a new app or pixel starts leaking.

Conclusion

Shopify simplifies e-commerce, but not cookie compliance. The native banner only covers part of the picture, and the app ecosystem keeps adding scripts. A CMP placed before {{ content_for_header }}, Shopify's own pixels brought under control and regular audits are what it takes to prove compliance.

Run a free scan of your Shopify store to see which cookies are active today, then follow the installation guide to put FlowConsent in place.