Shopify Cookie Consent Banner with Customer Privacy API

A third-party cookie consent banner for Shopify that integrates with Shopify's Customer Privacy API and Google Consent Mode v2. Theme install, no app.

ConsentStack is a third-party cookie consent banner for Shopify that integrates with Shopify's Customer Privacy API. It installs as three tags in your theme's <head>, with no app to add, detects Shopify automatically, and records every visitor decision through Shopify's setTrackingConsent, so Shopify Analytics and web pixels follow the same choice your banner showed. Tags Shopify does not control, such as the Meta Pixel, TikTok, Klaviyo, or a Google Tag Manager container added to the theme, are blocked in the browser until the visitor consents, and Google tags receive Consent Mode v2 signals from the same decision.

Shopify's own guidance is why the integration matters. Its Help Center says: "If you have manually installed third-party cookies or pixels or integrated them through apps on your store, then you may need to use a third-party cookie banner or add custom logic to ensure they are honoring customer consent." Shopify then points merchants at "a third-party cookie banner app properly integrated with the Customer Privacy API". This page covers the install, exactly how that integration behaves, and what Shopify asks of a third-party banner. Verified against Shopify's Help Center and developer documentation on September 11, 2026.

For the general install reference, see SDK Installation. For the product overview, see Cookie consent for Shopify.

Install on a Shopify theme

Add the three ConsentStack tags to the <head> of your theme, before any other script tags. Replace <YOUR_SITE_KEY> with the key from your dashboard:

<link rel="preconnect" href="https://cdn.consentstack.io" />
<script src="https://cdn.consentstack.io/consent.js?k=<YOUR_SITE_KEY>"></script>
<script src="https://cdn.consentstack.io/consent-core.js?k=<YOUR_SITE_KEY>"></script>

In the Shopify admin, go to Online Store > Themes, open your theme's menu, choose Edit code, and paste the tags into layout/theme.liquid just after the opening <head> tag. Save, and the banner is live on your storefront.

Do not add defer or async to either script tag, and keep both tags ahead of any other scripts in the head. The SDK must install its script observer before third-party tags execute, or those tags can run before consent enforcement is active. Details in SDK Installation.

What is Shopify's Customer Privacy API?

Shopify describes it as "a browser-based, JavaScript API that you can use to verify data processing permissions or build a cookie consent banner". It applies to Shopify-managed surfaces: pixels, audiences, and checkout. Shopify's help center tells merchants who use a third-party banner to integrate it with these settings.

The record matters because Shopify gates its own tracking with it. If your banner never writes it, Shopify has no record of what the visitor chose: analytics sessions and web pixels either keep firing without consent, or stay silent for shoppers who said yes. Either way, what Shopify does no longer matches what your banner showed.

Automatically. On a Shopify storefront the SDK detects the window.Shopify global, loads Shopify's consent-tracking API ahead of time, and writes the visitor's choice with setTrackingConsent whenever an explicit decision exists. There is nothing to configure: install the tags and the bridge is active.

The mechanics, in order:

Detection. The bridge activates only when window.Shopify is present, so it costs nothing on non-Shopify pages.
Warm-up. If Shopify.customerPrivacy is not on the page yet, the SDK loads it through Shopify.loadFeatures (the consent-tracking-api feature, version 0.1) during initialization, so the API is ready before the visitor touches the banner. Nothing is written at this stage.
Explicit decisions only. Shopify's rule is that recording consent "should only be done on a visitor interaction" and "never done automatically on behalf of the visitor". The bridge follows it: regional default states are never written to Shopify. Only an actual decision is recorded, whether that is a fresh accept or reject, or a saved preference from an earlier visit.
No redundant writes. Before writing, the SDK reads Shopify's current record with currentVisitorConsent and skips the call when nothing has changed.

Shopify's API is a consent ledger, not a runtime switch. setTrackingConsent writes a durable first-party record (the _tracking_consent cookie plus a consent ID) that Shopify then applies to the tracking it controls.

How categories map to Shopify's signals

Each explicit decision is translated from ConsentStack's consent categories into the four fields Shopify's API expects:

ConsentStack category	Shopify consent field
Analytics	`analytics`
Marketing	`marketing`
Functional	`preferences`
Marketing, unless GPC applies	`sale_of_data`

sale_of_data is the one with a twist: it is granted only when the visitor consented to marketing and ConsentStack is not honoring a Global Privacy Control signal for them. When GPC applies, sale_of_data is recorded as denied even for a shopper who accepted marketing, which is what US state opt-out rules expect. See Global Privacy Control for how GPC is detected and honored.

What Shopify does with the record

Shopify applies it to everything it controls. The consent record gates Shopify Analytics, including the _shopify_y and _shopify_s session cookies and storefront page-view tracking, and every sandboxed web pixel, including pixels installed by apps. When the record says no, Shopify's own tracking holds back. When it says yes, it runs normally and your attribution stays intact.

Shopify's Customer Privacy API and Google Consent Mode v2 are two different signals, and a store that runs Google Ads or GA4 usually needs both. ConsentStack sends both from one decision:

Google tags loaded from your theme (gtag.js or a Google Tag Manager container) receive Consent Mode v2 defaults before they load, with ad_storage, ad_user_data, ad_personalization, and analytics_storage denied until the visitor decides, then an update carrying the decision. Details in Platform Integrations.
Pixels installed through Shopify apps run inside Shopify's web pixel sandbox and follow the Customer Privacy record described above rather than the browser-side Consent Mode signal.

Shopify's Help Center lists three things to do when you replace its banner with a third-party one. All three take a few minutes:

Remove Shopify's own banner so shoppers do not see two. In the Shopify admin, go to Settings > Customer privacy, click Cookie banner in the Privacy settings section, then More actions > Remove cookie banner. Do this after the ConsentStack tags are live, since Shopify warns that removing its banner without a replacement can stop non-essential data from being collected.
Name Shopify in your banner text. Shopify's suggested wording is: "We and our partners, including Shopify, use cookies and other technologies to personalize your experience, show you ads, and perform analytics, and we will not use cookies or other technologies for these purposes unless you accept them. Learn more in our Privacy Policy." The banner title and description are editable in the config builder.
Link your privacy policy from the banner, and make sure that policy itself links to the Shopify Consumer Privacy Policy. The banner's policy links are set in the config builder as well.

What about scripts Shopify does not control?

They are handled by script blocking, not by this integration. Tags added to the theme directly (the Meta Pixel, TikTok, Klaviyo, heatmap tools) do not read Shopify's consent record, so ConsentStack blocks them in the browser until the visitor consents. The Shopify bridge never bypasses that blocking; it adds the Shopify side on top.

Platforms with native consent APIs of their own (Google, Meta, TikTok, Bing, and others) also get dedicated consent signaling, described in Platform Integrations.

If you are not sure what actually fires on your store before consent, run it through the free compliance scanner. It loads your storefront in a real browser, declines the banner, and reports which trackers fired anyway, with the evidence attached.

FAQ

Does ConsentStack integrate with Shopify's Customer Privacy API?

Yes, automatically. On any Shopify storefront the SDK detects Shopify, loads the consent-tracking API, and records each explicit visitor decision with setTrackingConsent. There is no setting to turn on and no app to install.

Do I need a Shopify app to use ConsentStack?

No. ConsentStack is a script install: three tags in layout/theme.liquid. The Customer Privacy integration, script blocking, and Consent Mode v2 all run from those tags.

Usually not on its own. Shopify's help center says its cookie banner "governs Shopify-specific tools, including cookies and Shopify Pixels", and a Shopify Community answer puts it plainly: the built-in banner controls the first-party cookies Shopify sets, not tags like Google Tag Manager or the Meta Pixel. For those, Shopify itself points merchants at a third-party banner integrated with the Customer Privacy API.

Yes. Google tags in your theme get Consent Mode v2 defaults and updates from ConsentStack, and Shopify's own pixels follow the Customer Privacy record. See Google Consent Mode v2 on Shopify above.

What happens when a shopper clicks Reject?

Shopify's record is written with analytics, marketing, preferences, and sale_of_data all denied, so Shopify Analytics and app pixels hold back. Tags in the theme stay blocked. The decision is stored in your consent logs, and the shopper can reopen the preferences panel later from the re-entry button.

What's next

Cookie consent for Shopify. The product overview for Shopify stores.
Script Blocking. How third-party tags are held until the visitor consents.
Platform Integrations. Native consent signaling for Google, Meta, TikTok, and more.
SDK Installation. The full install reference.