GDPR Cookie Consent on Shopify: What EU Stores Need

If your Shopify store sells to people in the European Union, then you must obtain their consent before analytics and advertising cookies run. Many stores make the mistake of loading Meta pixel and Google tags before the user even interacts with the site. This guide explains the proper technical setup for GDPR-compliant cookie consent.

Strictly necessary cookies like those needed for the shopping cart and checkout do not require consent. Analytics, advertising, and most marketing cookies do need consent, and that consent must be given before these cookies load. Rejecting consent must be as easy as accepting. A prominent "Accept all" button next to a hidden "Settings" link does not constitute fair consent.

The Data Protection Commission in Ireland advises that consent should not be assumed to continue indefinitely, and it is prudent to seek reassurance every six months.

To implement GDPR-compliant cookie consent on your Shopify store, follow these steps:

1. Enable Shopify's built-in cookie banner, accessible through Settings → Customer privacy. Configure the banner to display to visitors in the EU and UK, and include a clear reject button. If you are using third-party consent apps, ensure they transmit the shopper's choice to Shopify's Customer Privacy API; otherwise, your apps will continue tracking despite the user's refusal.

2. Identify any tracking mechanisms that disregard user consent. This may include hard-coded Google Analytics or Google Ads tags in theme.liquid, a manually added Meta pixel layered over the Facebook and Instagram app, which can double-count purchases, and old scripts residing in Settings → Checkout or the order status page. Additionally, certain chat widgets, heatmaps, and review apps may set their own cookies.

Move these tracking mechanisms into Shopify's customer events (pixels) or use the official apps, which respect user consent, and remove any hard-coded copies.

3. Configure Google Consent Mode v2, as required by Google starting in March 2024. For advertisers seeking remarketing and conversion measurement for users in the European Economic Area, Google Consent Mode v2 is mandatory. Without this mode, Google Ads audiences will be smaller, and conversions will be missed. The Google and YouTube app on Shopify supports Consent Mode v2 and automatically reads the shopper's consent status from Shopify's privacy settings.

Thus, with the built-in banner, this generally involves connecting the official app instead of manually pasting tags.

4. Verify which scripts actually load on your store. Open your site in a private window from an EU location or use a VPN set to Ireland. Before clicking the consent banner, inspect the browser's developer tools and check the Network tab. There should be no requests to Meta, Google Ads, TikTok, or other analytics tools. After clicking "reject" and browsing a few pages, no tracking requests should be recorded.

Repeat the process using a new private window, this time clicking "accept," to confirm that the tags load correctly and display a page view.

5. Note that cookie consent does not automatically grant permission for marketing emails. Use an unticked box during the checkout process or customer signup to solicit marketing email preferences, and keep a record of who has provided this consent. Existing customers may have previously received marketing emails without a fresh opt-in if they had a reasonable chance to opt out.

However, it is advisable to check with your data protection adviser. When migrating from another platform, ensure you only import customers who have explicitly opted in as subscribers.

Misconfigurations to avoid include banners that only offer "Accept" and "Close," a banner that only appears on the homepage while shoppers may access the site directly through product pages, and a privacy policy that fails to list all the apps and tools used by the store.