How to Set Up Cookie Consent on Shopify (Step by Step)

Who it is for

Store owners selling to the UK, EU or US

Time needed

About an hour, including testing

What you need

Admin access and a list of your apps and pixels

Switching on a cookie banner in Shopify takes about ten minutes. The harder part is making sure tracking actually waits for the visitor's answer. On a lot of stores I review, the banner looks right, the visitor clicks decline, and an ad pixel that someone pasted into the theme two years ago has already fired. The banner was never the problem. The scripts behind it were.

This guide covers both halves: the admin steps for Shopify's own banner and opt-out page, and the checks that make them work. Shopify's settings and the rules below come from Shopify's Help Center, the European Commission's Your Europe pages, GOV.UK and the California Attorney General, as checked on 7 November 2026.

What the rules ask for, by region

The UK and EU work on opt-in: no non-essential cookies until the visitor agrees. US state laws mostly work on opt-out: you may track, but people must be able to stop the sale or sharing of their data. One store selling to all three needs both setups.

EU. The European Commission's guidance says tracking cookies used for advertising, analytics or market research need consent, and that they can't be set when the page first opens. Cookies that are strictly necessary for a service the visitor asked for, such as the shopping cart or a logged-in account, are exempt. Consent has to be specific to each purpose, so visitors must be able to accept some types and refuse others. Withdrawing consent must be as easy as giving it.

UK. The Data (Use and Access) Act 2025 keeps the ban on storing or reading information on a visitor's device without consent, unless an exception applies. Strictly necessary storage is still exempt, and the Act adds a new exception for collecting statistical information about how your online service is used, so you can improve it. That exception is narrow. Advertising and retargeting cookies still need consent, and whether your analytics setup qualifies depends on how it's configured, so read the ICO's current guidance before relying on it. On UK and EU stores I usually keep analytics behind consent anyway, so the banner behaves the same in both places.

US. The CCPA applies to for-profit businesses doing business in California that meet one of three tests: gross annual revenue over $25 million, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning half or more of their revenue from selling it. "Sharing" means cross-context behavioral advertising, which is exactly what ad pixels do. A covered business that sells or shares personal information must give a clear "Do Not Sell or Share My Personal Information" link and treat a Global Privacy Control (GPC) signal as a valid opt-out. Plenty of small stores fall below those thresholds, but Shopify's opt-out page costs nothing to switch on, so I add it to most US-facing stores.

Before you switch anything on

1. Publish a privacy policy. Go to Settings > Customer privacy > Privacy policy, choose Use automated policy or write your own, and click Save. Shopify won't activate the banner or the opt-out page without one.
2. List everything that tracks. Open Settings > Customer events to see app pixels and custom pixels, then check your installed apps and your theme code for scripts pasted in directly. The free Shopify app detector shows which apps load on your storefront, which is a quick way to spot ones you forgot about.
3. Check your markets. Automated banner regions follow your active markets in Settings > Markets. If you sell to the UK or EU without a market for them, the automated setup may not cover those visitors.
4. Decide between Shopify's banner and an app. Both work. The comparison further down helps you choose before you configure anything twice.

How to turn on Shopify's cookie banner

1. Open the banner settings. Go to Settings > Customer privacy and click Cookie banner.
2. Choose the regions. In Regions and content, turn on Use automated settings to follow Shopify's recommendations. To pick regions yourself, click Edit in the Regions section, select them, click Done, then Save.
3. Write the wording. Click Edit in the Content section. Say in one or two sentences what you use cookies for and that visitors can change their choice later. Click Done, then Save.
4. Set the appearance. Adjust colors and preferences, then click Save. Give declining the same size and contrast as accepting. A banner that hides the reject option is hard to square with the rule that saying no must be as easy as saying yes.
5. Pick the position. In Position, choose where the banner sits, click Save, then click View to preview it.
6. Translate it. From the banner page, click More actions > Localize. This opens Translate & Adapt, where the banner text sits under Online store. A Dutch or German visitor shouldn't get an English-only consent request.
7. Check the footer link. Visitors change their mind through a Cookie preferences link in the footer menu or the policies section. Open your storefront and make sure it shows.

In the regions you choose, the banner appears on the storefront, cart, checkout and customer account pages, so one setting covers the whole buying path.

Add the data sharing opt-out page for US visitors

1. Check staff permissions. The person setting this up needs Manage settings, Blog posts and pages and Menus permissions, because Shopify creates a page and a menu link.
2. Open the page settings. Go to Settings > Customer privacy and click Data sharing opt-out page.
3. Set regions and content. Turn on Use automated settings, or click Edit in Regions to choose the regions, and Edit in Content to change the text.
4. Place the link. In the Menus section, choose where the link appears, usually the footer, and click Save. Shopify adds an opt-out icon next to it automatically. A developer can restyle it with the CSS class shopify-dns-link-icon.
5. Link it from your privacy policy. If you edit the policy by hand, the Liquid variable {{data_sharing_opt_out_page_url}} inserts the page address, and {% if data_sale_opt_out_enabled %} lets you show the paragraph only when the page is on.

You don't need a separate setting for Global Privacy Control. When a visitor's browser sends the GPC signal, Shopify opts them out of data sale, sharing and targeted advertising in the regions where your opt-out page is active.

Make your pixels and apps respect the choice

Shopify's consent features control what runs through Shopify. A script pasted straight into theme.liquid or a section file never asks Shopify for permission, so it fires whatever the visitor chose. That's the most common leak I find, and no banner setting fixes it.

• Custom pixels. Go to Settings > Customer events, click the Custom pixels tab and open each pixel. Under Permission, choose Required and tick the purposes it serves: marketing, analytics or preferences. Set the Data sale option for visitors who have opted out, then click Save.
• Hard-coded scripts. Move them into a custom pixel or the vendor's official Shopify app, so they inherit the consent check. Delete the old snippet afterwards, or it keeps firing.
• Google consent mode. If you send data to Google through a custom pixel, Shopify says you have to add the Google Consent Mode v2 code yourself. Without it, and without valid consent, Google won't use that data for personalized advertising for visitors such as those in the EEA.
• Third-party banners. If you use a consent app, it must be properly integrated with Shopify's customer privacy settings. Otherwise Shopify doesn't know what the visitor chose.

Shopify's banner or a consent app

For most stores, Shopify's banner is enough. An app makes sense when your adviser wants something the built-in banner doesn't offer, such as a detailed cookie declaration, or when you run the same consent tool across several sites. If you go that way:

1. Install and configure the app. Pick one from the Cookie Consent category of the Shopify App Store, turn on its banner and set its regions.
2. Remove Shopify's banner. In Settings > Customer privacy > Cookie banner, if Remove cookie banner is available, click the horizontal menu icon, then Remove cookie banner and Remove. Two banners at once confuse visitors and give you two consent records that may disagree.
3. Match the regions exactly. Click the menu icon and Set custom banner regions, or Edit in the Regions section, select every region where the app's banner shows, and click Save. Shopify warns that if the regions don't match, non-essential data can be processed before a visitor consents.

Test it like a visitor would

1. Open a private browser window, so no earlier choice is stored.
2. Appear to be in a banner region. If you're outside one, use a VPN location inside it, or add your own region to the banner while you test.
3. Watch the network before you click. Open your browser's developer tools, go to the Network tab and load a product page. Filter for your ad and analytics vendors. Nothing that needs consent should load yet.
4. Decline, then browse. Click decline, add a product to the cart and go to checkout. Check the Network tab again on each page.
5. Accept in a fresh window. Repeat with accept and confirm your pixels now fire. If they don't, your consent settings are blocking too much.
6. Change your mind. Use the Cookie preferences footer link to switch from accept to decline, and check tracking stops.
7. Test the US opt-out. In a US region, open the opt-out page and opt out, then repeat with a browser that sends the GPC signal.

Common mistakes

• Tracking code in the theme. Pixels pasted into theme.liquid ignore the banner. This is the one I fix most often.
• A third-party banner with different regions. Data from visitors outside the overlap can be processed before consent.
• A hidden or tiny decline option. If accepting takes one click and declining takes four, consent is hard to defend.
• Manual regions that never get updated. If you picked regions by hand and later open a new market, check the banner covers it.
• An English-only banner on translated storefronts. Localize it in Translate & Adapt along with the rest of the store.
• Turning the banner off because conversions dropped. Measured conversions fall because less is measured, not because fewer people buy.
• A privacy policy that doesn't match reality. If you add apps or pixels, update the policy so it describes what you actually collect.

Cookie consent checklist

• Privacy policy published under Settings > Customer privacy.
• Cookie banner on for the UK, EEA and any other region you've chosen.
• Decline is as easy to find and click as accept.
• Banner text translated for every storefront language.
• Cookie preferences link visible in the footer.
• Data sharing opt-out page live and linked in the footer for US visitors.
• Every custom pixel set to Required with the right purposes.
• No tracking scripts hard-coded in theme files.
• Google Consent Mode v2 code added to any custom Google pixel.
• Third-party banner regions, if used, match Shopify's exactly.
• Tested with decline, accept, a changed choice and GPC.

Next steps

Cookie consent is one part of handling customer data properly. My GDPR guide for Shopify stores covers the rest: privacy policies, marketing consent and customer data requests. If you sell mainly to American shoppers, my Shopify developer page for US stores explains how I work with US brands.

If you want someone to check what fires before consent on your store, I can look at your pixels, apps and theme code as part of a free store review. Moving tracking into custom pixels is usually a small job, and store development work starts from $300 with a fixed quote.

Frequently asked questions

Sources

1. Privacy settings, Shopify Help Center
2. Understanding customer privacy settings, Shopify Help Center
3. Managing custom pixels, Shopify Help Center
4. Online privacy: cookies, European Commission, Your Europe
5. Data (Use and Access) Act factsheet: PEC Regulations, GOV.UK
6. California Consumer Privacy Act (CCPA), State of California Department of Justice

Related services and work

Written by Ashraf Siddik

I'm a Shopify developer and CRO specialist. I have built and improved Shopify stores since 2018, completed more than 1,000 projects, and hold a 4.96 average rating across 719 client reviews.

About me · Client reviews