# Install FlowConsent on Shopify

Install FlowConsent on Shopify: paste the snippet in theme.liquid right after <head>, then switch off Shopify's native cookie banner and channel pixels.

> Canonical: https://www.flowconsent.com/en/doc/install-shopify
> Last updated: 2026-10-01
On Shopify, the FlowConsent snippet goes into your theme's **`theme.liquid`** file, **right after the `<head>` tag** and therefore before `{{ content_for_header }}`: you reach it through **Online Store → Themes → … → Edit code**. Installation takes three steps. The main trap: Shopify ships its own cookie banner, and its sales channels (Google & YouTube, Facebook & Instagram) inject their pixels outside the theme, where your snippet cannot hold them back.

## Before you start

- An account on [app.flowconsent.com](https://app.flowconsent.com) (free Free plan, no credit card, up to 25,000 sessions per month).
- A banner created and deployed. On the Free plan, deployment goes through your own Cloudflare account ([Cloudflare guide](/en/doc/cloudflare-deployment)); on Pro and Enterprise, it is one click.
- Access to the Shopify admin with permission to edit themes.

## Step 1: Copy the snippet

Open **Builder → Deployment → Integration** and copy the snippet from the **HTML / No-code** tab. It has two parts, in this order: the Google Consent Mode v2 stub (`denied` defaults), then the banner loader.

## Step 2: Paste it in theme.liquid

1. In the Shopify admin, go to **Online Store → Themes**.
2. As a precaution, duplicate the theme first: Shopify recommends this so you keep a backup copy.
3. On your live theme, click the **…** icon, then **Edit code**.
4. In the **Layout** folder, open **`theme.liquid`**.
5. Paste the snippet **right after the opening `<head>` tag**, above `{{ content_for_header }}` and any other script, then click **Save**.

```html title="Layout → theme.liquid"
<head>
  <script>
  // FlowConsent Loader - place BEFORE any other script in the <head>
  window.dataLayer=window.dataLayer||[];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent','default',{
    'ad_storage':'denied',
    'analytics_storage':'denied',
    'ad_user_data':'denied',
    'ad_personalization':'denied',
    'wait_for_update':500
  });
  gtag('set','url_passthrough',true);
  gtag('set','ads_data_redaction',true);
  </script>
  <!-- FlowConsent CMP -->
  <script src="https://YOUR-LICENSE-CODE.consent.flowconsent.com/cookie-manager.js?code=YOUR_LICENSE_CODE"></script>

  <meta charset="utf-8">
  <!-- … the rest of your theme's <head>, including {{ content_for_header }} -->
</head>
```

The `{{ content_for_header }}` object loads the scripts that Shopify and your apps add to the store, so the snippet has to come **before** it. Anything placed above the snippet escapes prior blocking.

> [!NOTE]
> Updating your theme from the Theme Store may not carry over your code edits. After every theme update, check that the snippet is still at the top of `theme.liquid`.

## Step 3: Neutralize Shopify's native banner and pixels

Trackers must no longer be injected by Shopify itself, otherwise they fire without regard for FlowConsent.

**The Google & YouTube and Facebook & Instagram channels.** These apps install *app pixels* managed under **Settings → Customer events**. They run in a Shopify sandbox, outside your theme: your snippet cannot hold them back. They follow the consent recorded through Shopify's **Customer Privacy API**, not the FlowConsent banner. To route everything through FlowConsent, turn off data sharing in those channels (or remove the measurement IDs you entered there), then declare Google Analytics, Google Ads or Meta Pixel in **Builder → Services**: the banner only loads them after consent.

**Shopify's native banner.** Two banners on one store means two conflicting consents. Once your trackers are declared in FlowConsent, remove Shopify's banner: **Settings → Customer privacy → Cookie banner**, then **More actions → Remove cookie banner**.

> [!WARNING]
> Checkout does not run your theme code: `theme.liquid` applies neither to checkout nor to the Thank you and Order status pages, and Shopify has retired the old "additional scripts". The FlowConsent banner therefore does not appear during checkout. Do not paste trackers in those places: conversion tracking goes through Shopify's **Customer events**, which also depend on the Customer Privacy API.

If you run Google Tag Manager in the theme, do not load FlowConsent from GTM (it would arrive too late): keep the snippet **above** the GTM container in `theme.liquid`. Details in the [Google Consent Mode guide](/en/doc/google-consent-mode).

## Verify the installation

1. Open the store in a private window: the banner appears.
2. In the developer tools **Network** tab, no request to Google, Meta or any other third party leaves before you click **Accept**.
3. Run the [setup wizard](/en/doc/setup-wizard) (Builder → Integration): it checks the live page (loader present with the right license code, Consent Mode stub present and placed before every Google tag).
4. Finish with a decline scan from the **Compliance** tab ([compliance verification](/en/doc/compliance-verification)).

## Do it from your AI agent (MCP)

FlowConsent has an official MCP server, `https://mcp.flowconsent.com`, usable from Claude, ChatGPT or any MCP client. You connect with OAuth 2.0 using your FlowConsent account, no API key needed. Your agent fetches the snippet and placement instructions (`get_banner_snippet`, `get_setup_instructions`), verifies the installation with a real scan (`verify_consent_compliance`) and can set up recurring monitoring (`monitor_compliance`). You still paste the snippet into `theme.liquid` yourself: the MCP server provides the snippet, the instructions and the verification.

Example request:

> Give me my banner snippet for my Shopify store and check that it is correctly installed on https://mystore.com

Learn more: [MCP server](/en/doc/mcp-server) and [FlowConsent for AI agents](/en/mcp).

## Frequently asked questions

### Can I install FlowConsent without editing theme code?

Theme code is the reliable method, because it is the only one that guarantees the snippet runs before `{{ content_for_header }}`. Code blocks added through the theme editor land in the page body, too late for prior blocking.

### Why does Google Analytics still send data after a decline?

Almost always because the Google & YouTube channel (or another app pixel) is still active under **Customer events**. That pixel does not go through your theme: turn off its data sharing and declare Google Analytics in **Builder → Services**.

### Does the banner show up at checkout?

No. Shopify checkout does not run theme code. Visitors make their choice on the storefront, before they reach checkout.

### Should I remove Shopify's cookie banner?

Yes, once your trackers are declared in FlowConsent: two banners would collect two conflicting choices. Shopify warns that after removal, non-essential data from its own pixels may no longer be collected, which is expected since tracking now goes through FlowConsent.