Shopify Integration

Install ConsentStack on any Shopify theme and report consent to Shopify's Customer Privacy API automatically, so Shopify Analytics and web pixels follow each visitor's choice.

ConsentStack runs on Shopify as a standard script install: three tags in your theme's <head>, no app required. On a Shopify storefront the SDK also does something extra. It detects Shopify automatically and reports every consent decision to Shopify's Customer Privacy API, so Shopify's own analytics and web pixels stay in sync with your banner.

This page covers the install and exactly how the Customer Privacy integration behaves. For the general install reference, see SDK Installation. For the product overview, see Cookie consent for Shopify.

Install on a Shopify theme

Add the three ConsentStack tags to the <head> of your theme, before any other script tags. Replace <YOUR_SITE_KEY> with the key from your dashboard:

<link rel="preconnect" href="https://cdn.consentstack.io" />
<script src="https://cdn.consentstack.io/consent.js?k=<YOUR_SITE_KEY>"></script>
<script src="https://cdn.consentstack.io/consent-core.js?k=<YOUR_SITE_KEY>"></script>

In the Shopify admin, go to Online Store > Themes, open your theme's menu, choose Edit code, and paste the tags into layout/theme.liquid just after the opening <head> tag. Save, and the banner is live on your storefront.

Do not add defer or async to either script tag, and keep both tags ahead of any other scripts in the head. The SDK must install its script observer before third-party tags execute, or those tags can run before consent enforcement is active. Details in SDK Installation.

What is Shopify's Customer Privacy API?

It is Shopify's browser JavaScript API for recording and reading a visitor's data-processing consent. Shopify's developer documentation describes it as the API you use to verify permissions or build a cookie consent banner, and Shopify's help center tells merchants who use a third-party banner to integrate it with these settings.

The record matters because Shopify gates its own tracking with it. If your banner never writes it, Shopify has no record of what the visitor chose: analytics sessions and web pixels either keep firing without consent, or stay silent for shoppers who said yes. Either way, what Shopify does no longer matches what your banner showed.

Automatically. On a Shopify storefront the SDK detects the window.Shopify global, loads Shopify's consent-tracking API ahead of time, and writes the visitor's choice with setTrackingConsent whenever an explicit decision exists. There is nothing to configure: install the tags and the bridge is active.

The mechanics, in order:

Detection. The bridge activates only when window.Shopify is present, so it costs nothing on non-Shopify pages.
Warm-up. If Shopify.customerPrivacy is not on the page yet, the SDK loads it through Shopify.loadFeatures (the consent-tracking-api feature) during initialization, so the API is ready before the visitor touches the banner. Nothing is written at this stage.
Explicit decisions only. Shopify's guidance is to record consent on visitor interaction, never automatically. The bridge follows it: regional default states are never written to Shopify. Only an actual decision is recorded, whether that is a fresh accept or reject, or a saved preference from an earlier visit.
No redundant writes. Before writing, the SDK reads Shopify's current record with currentVisitorConsent and skips the call when nothing has changed.

Shopify's API is a consent ledger, not a runtime switch. setTrackingConsent writes a durable first-party record (the _tracking_consent cookie plus a consent ID) that Shopify then applies to the tracking it controls.

How categories map to Shopify's signals

Each explicit decision is translated from ConsentStack's consent categories into the four fields Shopify's API expects:

ConsentStack category	Shopify consent field
Analytics	`analytics`
Marketing	`marketing`
Functional	`preferences`
Marketing, unless GPC applies	`sale_of_data`

sale_of_data is the one with a twist: it is granted only when the visitor consented to marketing and ConsentStack is not honoring a Global Privacy Control signal for them. When GPC applies, sale_of_data is recorded as denied even for a shopper who accepted marketing, which is what US state opt-out rules expect. See Global Privacy Control for how GPC is detected and honored.

What Shopify does with the record

Shopify applies it to everything it controls. The consent record gates Shopify Analytics, including the _shopify_y and _shopify_s session cookies and storefront page-view tracking, and every sandboxed web pixel, including pixels installed by apps. When the record says no, Shopify's own tracking holds back. When it says yes, it runs normally and your attribution stays intact.

What about scripts Shopify does not control?

They are handled by script blocking, not by this integration. Tags added to the theme directly (the Meta Pixel, TikTok, Klaviyo, heatmap tools) do not read Shopify's consent record, so ConsentStack blocks them in the browser until the visitor consents. The Shopify bridge never bypasses that blocking; it adds the Shopify side on top.

Platforms with native consent APIs of their own (Google, Meta, TikTok, Bing, and others) also get dedicated consent signaling, described in Platform Integrations.

Usually not on its own. Shopify's help center says its cookie banner governs Shopify-specific tools, and a Shopify Community answer puts it plainly: the built-in banner controls the first-party cookies Shopify sets, not tags like Google Tag Manager or the Meta Pixel. Shopify points merchants who use a third-party banner at the Customer Privacy integration this page describes.

If you are not sure what actually fires on your store before consent, run it through the free compliance scanner. It loads your storefront in a real browser, declines the banner, and reports which trackers fired anyway, with the evidence attached.

What's next

Cookie consent for Shopify. The product overview for Shopify stores.
Script Blocking. How third-party tags are held until the visitor consents.
Platform Integrations. Native consent signaling for Google, Meta, TikTok, and more.
SDK Installation. The full install reference.

On this page