Cookies and GDPR on a Shopify store: banner and consent

Before you start: this is not legal advice

The GDPR (RGPD in Spain) and Spanish cookie regulations determine what you must disclose, how to ask for consent and what text you need in your privacy and cookie policies. That part depends on your business, the tools you use and how you process data, and it should be reviewed by a legal advisor.

What we can explain is how Shopify works under the hood: which tools it includes, how they connect to pixels and apps and which technical mistakes cause a store to load cookies too early even when it has a banner.

Which cookies a Shopify store uses

Shopify uses cookies required for the store to work, such as those for the cart, the checkout session or security. On top of that there are Shopify's own analytics and preference cookies, and the ones added by the tools you install: GA4, Meta, TikTok, review apps, chats or heatmaps.

The first step is to take inventory. Review the pixels in Settings > Customer events, the installed apps and any script pasted into the theme. Each of them can set cookies or send data to a third party, and your cookie policy has to reflect that.

Pay attention to old scripts: tracking codes pasted into theme.liquid years ago, tags for tools you no longer use or leftovers from uninstalled apps. These are usually the ones loading cookies without going through consent, because nobody has them on the list.

• Necessary: cart, checkout, session and security
• Analytics: Shopify reports, GA4 and similar
• Marketing: ad and remarketing pixels
• Preferences: language, currency and visitor settings

Shopify's native cookie banner

In Settings > Customer privacy you can turn on the Shopify cookie banner. It is shown to visitors from the regions you choose, such as the European Economic Area, and lets them accept, reject or manage preferences by category. You can adjust the text, position and appearance so it fits your theme.

Its advantage is that it is connected out of the box to Shopify's consent system: app pixels and custom pixels turn on or off based on the visitor's choice, with no extra setup for each tool.

The Customer Privacy API

The Customer Privacy API is the interface that stores and checks each visitor's consent preferences. The native banner uses it under the hood, and third-party consent management apps integrate with it so Shopify knows what the customer has accepted.

If the theme or a custom section loads a third-party script, that code has to check the API before running and listen for consent changes. This is where stores fail most often: the banner exists, but a script pasted into theme.liquid loads anyway before the visitor decides.

The fix is to route all third-party code through the consent system: ideally as a custom pixel in customer events, with its permissions configured, and only if that is not possible, from the theme by checking the API. That gives you a single point of control and makes it easier to audit what loads and when.

Pixels, permissions and Google's consent mode

In customer events, each custom pixel has a permissions setting where you specify which consent categories it needs, such as analytics, marketing or preferences. If the visitor has not accepted those categories, the pixel receives no events. Configure this for every pixel instead of leaving it as not required.

For Google tools, the Google & YouTube app passes the consent status through Google's consent mode, so GA4 and Google Ads adjust their behavior based on what was accepted. If you load Google with your own code, you will have to implement that signal yourself.

Third-party consent apps

The native banner covers the basics. Some stores need more: a detailed consent log, automatic cookie scanning, tightly controlled copy per language or integration with a corporate consent platform. In those cases you use an app that integrates with the Customer Privacy API.

Choose one that explicitly states that integration and turn off the native banner so you do not show two. Then check that pixels respond to the app's consent the same way they do with the Shopify banner.

How to check that it works

Open the store in a private window with the browser's developer tools and reject all optional cookies. Check which cookies are set and which requests go out to Google, Meta or other domains. Then repeat the test accepting them and compare. If something loads before the visitor decides, track down its source in the theme or the apps.

Repeat the check every time you install an app or add a script. At Weblineo we build themes so that every third-party script respects consent at the code level, and we leave the legal setup in the hands of your advisor.