How to Set Up a Compliant Shopify Cookie Banner

Your Shopify store starts setting cookies the moment a visitor lands on it. Some are strictly necessary, and they keep the cart and checkout working. But the rest, including analytics cookies and marketing pixels, need explicit and active consent under certain privacy laws. 

Regulators are quick to crack down on e-commerce companies that violate cookie requirements. Just as one example, France's data protection authority, Commission Nationale de l'Informatique et des Libertés (CNIL), fined SHEIN EUR 150 million in 2025 after finding that advertising cookies landed on the site before visitors agreed to them.

This guide helps you understand how to set up Shopify cookie consent mechanisms in a way that respects user privacy and supports privacy regulation requirements. 

It covers how cookie consent works on the Shopify platform, what Shopify's native tools do and do not cover, and how to set up a consent management platform (CMP) to collect valid consent.

Which Cookies Does Your Shopify Store Set?

Shopify sets its own cookies for the cart, checkout, and analytics functionalities. But each app you install can add more. 

Under the General Data Protection Regulation (GDPR) and the ePrivacy Directive, only one of the four categories below is exempt from the consent requirement. So knowing what your store actually sets is the starting point for achieving privacy compliance.

• Strictly necessary cookies keep the store functioning: cart contents, checkout, session handling, load balancing, and fraud prevention. They are the only category exempt from consent under the ePrivacy Directive.
• Preferences, or functional cookies remember the choices a visitor has made, such as language, currency, or store region. They improve the shopping experience but aren’t necessary for it, which means they require explicit consent under some privacy laws.
• Analytics cookies measure how visitors move through the store: which products they view, and where they abandon their cart. Shopify's own analytics cookies fit in here, alongside Google Analytics, and any heatmap or session recording tool. 
• Marketing cookies support advertising, retargeting, and attribution. This is where many stores carry unlogged trackers they don’t remember installing, and opt-in privacy laws like the GDPR require you to collect valid consent before they run. 
• Social media cookies come from the platform code running on your store: such as Meta Pixel, TikTok and Pinterest tags, share buttons, and embedded YouTube videos or Instagram feeds. Most consent tools file these under marketing.

Is Shopify’s Built-In Banner Enough for Achieving Privacy Compliance?

Shopify's built-in cookie banner has some relevant features, and it costs you nothing beyond your existing plan fee. It detects a visitor's region and records their decision for each type of cookie, then passes that decision to the Customer Privacy API. 

In regions with privacy laws that require visitors to opt out of their data being sold, like the California Consumer Privacy Act (CCPA), Shopify automatically honors the Global Privacy Control signal. 

The built-in cookie banner also documents how consent flows through to Google Consent Mode v2, once your privacy settings are configured correctly.

The built-in banner is limited by how far that consent decision travels. Shopify's developer documentation states that the Customer Privacy API applies consent decisions to Shopify-managed surfaces only: pixels, audiences, and checkout. 

A Meta Pixel pasted into theme code sits outside those surfaces. It keeps firing whatever the visitor chose, unless your developer wrote a check against the Customer Privacy API into the pixel's installation code. Shopify does not add that check for you, so every tag you or an app placed in the theme needs it written in explicitly.

Shopify's consent audit log also retains consent preferences for the past 30 days only, which is a shorter window than record-keeping expectations under privacy laws like the GDPR.

Are There Alternatives to Shopify’s Built-In Banner?

Shopify's own documentation points merchants toward third-party privacy apps that can take over consent handling. 

Cookiebot by Usercentrics is built for e-commerce brands that want a simplified Shopify cookie consent infrastructure that covers key privacy compliance requirements. 

Setup runs in three steps with no code, and once it’s live, the platform automatically updates to meet evolving privacy compliance requirements. 

The CMP comes with: 

• Automated cookie scanning. Cookiebot by Usercentrics scans your storefront monthly and matches what it finds against a repository of more than 13,000 known cookies and trackers, then categorizes each one.
• Auto-blocking. Scripts stay blocked until a visitor gives explicit and active consent, so a pixel installed by an app won’t fire ahead of the banner.
• Google Consent Mode v2. Consent signals pass through to Google, which keeps ad measurement and attribution working even when visitors decline.
• Audit-ready consent logs. Each decision is recorded with a timestamp and easily exports to CSV.
• Cookie Declaration. A public, current list of every cookie your store sets, is available. And it is regenerated from each scan.
• Multi-regulation coverage. One account covers the GDPR, California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), and other regulations, with geotargeting so each visitor sees the banner that applies to where they are.

The practical appeal for a store owner is that this runs on its own. Scans repeat, your Cookie Declaration updates itself, and the platform automatically updates along with changes to regulations. 

Here’s a quick comparison of what cookie compliance looks like with Shopify’s built-in banner vs. the Cookiebot CMP. 

How to Set Up Cookiebot CMP for Shopify

Once Cookiebot CMP is live in your store, you get a hands-off cookie consent infrastructure. There are two ways to get there: through the Shopify App Store, or a manual install through your theme's code editor.

Cookiebot CMP recommends the app for most merchants, since it runs through Shopify's App Embed framework and handles script blocking without any code.

Step 1: Install Cookiebot CMP from the Shopify App Store and Disable Shopify's Native Banner

Open the Cookiebot CMP listing in the Shopify App Store and install it to your store by following these instructions. 

The app runs through Shopify's App Embed framework, which means it handles script blocking and writes consent decisions into the Customer Privacy API on its own. 

Setup connects the app to a Cookiebot CMP account, so create an account first if you don't already have one.

Once the install finishes, open Settings > Customer privacy in your Shopify admin and check that Cookiebot CMP is listed among your privacy apps. That confirms Shopify has registered it as the tool managing consent, which is important for the next step.

But the built-in Shopify banner is still enabled, and two banners showing on one storefront is a functional problem. Visitors get asked twice to share their consent choices, and Shopify keeps managing consent itself rather than deferring to Cookiebot CMP. 

So in your Shopify admin, go to Settings > Customer privacy > Cookie banner. Open More actions, select Remove cookie banner to get rid of the native banner, and confirm.

Step 2: Enable Google Consent Mode V2

Cookiebot CMP is a Google Gold Tier-certified partner. Once its script runs on your store, it signals consent to Google automatically when a visitor responds to the banner. 

You still set the default consent state yourself, which controls what happens between page load and the visitor's choice.

The mode you run decides what happens when someone declines. Basic Consent Mode blocks Google tags until consent, so nothing reaches Google from a visitor who says no. 

Advanced Consent Mode loads the tags and lets them adapt, so they send cookieless pings when consent is denied; those pings are what feed Google's conversion modeling.

If you loaded Cookiebot through Google Tag Manager rather than the Shopify app, check Enable Google Consent Mode in the Cookiebot CMP tag and set your default states there. Then, assign the tag the Consent Initialization - All Pages trigger so those defaults register before any Google tag looks for permission.

Step 3: Run Your First Cookie Scan

Activating the banner triggers first scan of your store. It catalogs the cookies and trackers actually running, matches them against its repository, assigns each a suggested category, and populates your Cookie Declaration with descriptions.

Review the results before you move on. Open the Services page in the app, check that each tracker sits in the right category, and look for anything you don't recognize.

Cookiebot CMP rescans your store on an ongoing basis and updates the Cookie Declaration from each scan. You can also trigger a scan yourself from the Services page, which is worth doing straight after installing a new app rather than waiting for the next scheduled scan.

Step 4: Customize Your Consent Banner

On Premium Plans, you can customize template layout and choose colors, logo, and text, so you can match your banner to your store’s branding. Beyond aesthetic and UX choices, design choices also directly affect privacy compliance.. 

The European Data Protection Board's (EDPB) Cookie Banner Taskforce states that pre-ticked boxes don't produce valid consent. Most supervisory authorities also expect a reject option next to accept, rather than buried behind a settings menu.

Regulators also expect withdrawing consent to be as easy as giving it, which is what the persistent consent trigger in Cookiebot CMP handles.

Once you’ve customized your banner, test it the way a regulator would. Open your store in a private window, and confirm that declining is as quick and easy as accepting.

How the Cookiebot CMP Helps Shopify Sites Support Ongoing Privacy Compliance

The Cookiebot CMP for Shopify makes it easier to collect valid consent when processing data on your Shopify store and comply with privacy regulations. 

It scans your storefront and categorizes what it finds, so a pixel some app added a month ago shows up in your Cookie Declaration instead of running unlabeled. Auto-blocking also holds third-party scripts until a visitor gives explicit and active consent. 

Consent Mode v2 keeps Google Ads and Analytics measuring across the visitors who decline. Every decision is also logged with a timestamp and exports to CSV when someone asks you to show it. 

The free tier covers an initial scan and up to 50 subpages on one domain, which is enough to see your own tracker list and decide if Cookiebot is the right way to manage Shopify cookies and customer consent.