Does Shopify require cookie consent?

Conditional. Core cookies like _session_id, cart, and secure_customer_sig are strictly necessary for checkout and require no consent. Analytics cookies _shopify_s, _shopify_y, and the Shop Pay cross-merchant cookie require analytics consent.

What cookies does Shopify set?

Essential: _session_id (session), cart (2 weeks), secure_customer_sig (1 year). Analytics: _shopify_s (30 min), _shopify_y (1 year), _shopify_sa_p and _shopify_sa_t (30 min each). Shop Pay adds _shopify_m (1 year) via pay.shopify.com.

How does ConsentStack manage Shopify consent?

ConsentStack splits Shopify into essential and analytics categories. Core checkout scripts load unconditionally. Analytics and attribution cookies are blocked via Shopify's Customer Privacy API until the visitor grants analytics consent.

What tracker domains does Shopify use?

ConsentStack has catalogued tracker domains for Shopify including shopify.com, shopifycdn.com and shops.myshopify.com, among 305 in total. These are the network destinations Shopify's scripts contact, which a consent platform blocks until a visitor agrees.

Shopify - Store Platform Consent & Privacy Profile

Back to Vendor Library

Overview

Shopify is the underlying e-commerce platform powering millions of online stores. Its JavaScript is ubiquitous on Shopify-hosted storefronts and handles everything from cart state and checkout to analytics and attribution. The Shopify script suite spans essential commerce infrastructure, first-party analytics, and the Shop Pay network — each with different consent implications.

What This Script Does

Core Storefront Scripts (Essential) Shopify loads core scripts from cdn.shopify.com that manage essential storefront functionality:

shopify.js and theme JavaScript handle cart state, product variant selection, quantity updates, and add-to-cart interactions
Checkout scripts at checkout.shopify.com manage the multi-step checkout flow including address entry, shipping selection, and order confirmation
Payment processing scripts handle credit card tokenization via Shopify Payments (powered by Stripe under the hood)

These scripts set essential cookies:

_session_id (first-party, session) — shopping session identifier for cart and checkout persistence
cart (first-party, 2 weeks) — cart contents serialized to maintain shopping progress across sessions
secure_customer_sig (first-party, 1 year) — encrypted customer login signature for account authentication
storefront_digest (first-party, session) — storefront authentication for password-protected stores

Shopify Analytics and Attribution Shopify loads analytics.js from cdn.shopify.com that tracks the conversion funnel across all storefront pages:

Fires page view events on every storefront page including product pages, collection pages, and search results
Records product impression data: which products were viewed, in what order, at what prices
Tracks add-to-cart, checkout initiation, and order completion events
Attributes sales to referring traffic sources (UTM parameters, referrers, ad clicks)

Cookies set for analytics:

_shopify_s (first-party, 30 minutes) — analytics session identifier
_shopify_y (first-party, 1 year) — analytics visitor identifier
_shopify_sa_p (first-party, 30 minutes) — page attribution data for last-click attribution
_shopify_sa_t (first-party, 30 minutes) — traffic source attribution
_shopify_fs (first-party, 1 year) — first session timestamp for new vs. returning visitor segmentation

Shop Pay and the Shopify Network Shop Pay allows customers to save payment and shipping information for one-click checkout across all Shopify stores. The Shop Pay button:

Loads from pay.shopify.com and checks whether the visitor's email is enrolled in Shop Pay via a network lookup
Sets cross-site identifiers that enable the one-click checkout experience across different Shopify merchants
_shopify_m (third-party via pay.shopify.com, 1 year) — Shop Pay cross-merchant identity cookie

Script filenames loaded: shopify.js, analytics.js, checkout.js, theme bundle files

Domains contacted: cdn.shopify.com, checkout.shopify.com, pay.shopify.com, {merchant}.myshopify.com, monorail-edge.shopifysvc.com (analytics pipeline)

Consent & Compliance

GDPR/ePrivacy: Shopify's core cart and checkout cookies (_session_id, cart, secure_customer_sig) are strictly necessary for e-commerce functionality and exempt from consent requirements under ePrivacy. The analytics cookies (_shopify_s, _shopify_y, _shopify_sa_p, _shopify_sa_t, _shopify_fs) are non-essential and require explicit opt-in consent. The Shop Pay cross-merchant cookie (_shopify_m) is a third-party tracking cookie that requires consent.

CCPA/CPRA: Shopify analytics data collection and the Shop Pay network's cross-merchant tracking constitute personal information collection that must be disclosed.

EU-US Data Transfers: Shopify Inc. (Canadian entity) processes EU data subject to GDPR. Shopify participates in the EU-US Data Privacy Framework (DPF) for US processing.

Consent category: Essential (cart, checkout, payment) and Analytics (Shopify Analytics, attribution tracking).

Should You Block This Without Consent?

Conditional. Core Shopify e-commerce scripts — cart management, checkout processing, payment handling — are essential and must always load. Shopify Analytics cookies (_shopify_s, _shopify_y, _shopify_sa_p, _shopify_sa_t, _shopify_fs) and Shop Pay cross-merchant tracking require analytics consent before being set. Shopify's Customer Privacy API provides a built-in mechanism to gate analytics cookie setting on consent status — use it to ensure compliance.

Is Shopify GDPR compliant?

Shopify typically loads analytics and functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Shopify can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Shopify, not on Shopify itself.

Visit website

Products (7)

Shopify Pixel

Shopify Pixel is Shopify's built-in event tracking system that captures customer behavior on Shopify-powered storefronts. Scripts track page views, product views, add-to-cart events, and completed purchases, forwarding event data to connected marketing channels and analytics tools. Sets first-party cookies for session tracking and customer journey attribution.

Shopify Analytics

Shopify Analytics is Shopify's built-in store analytics tracking visitor behavior and sales performance. Scripts collect page views, product interactions, cart events, and checkout completions for sales reports. Sets first-party cookies for visitor identification and session tracking across the storefront.

Shopify Balance

Shopify Balance is Shopify's financial services product for merchants, offering business accounts and cards. When detected on storefronts, scripts handle payment processing integration and financial transaction flows. Sets secure session cookies for payment authentication and maintains encrypted transaction state during checkout and financial operations.

Shopify Collabs

Shopify Collabs is an influencer and creator partnership platform integrated into Shopify storefronts. Scripts load affiliate link tracking, creator storefront widgets, and commission attribution code on product pages. Sets cookies to track referral sources from creator content and attribute sales back to specific influencer partnerships for commission payouts.

Shopify Email

Shopify Email is Shopify's native email marketing tool for e-commerce stores. Tracking pixels embedded in sent emails measure open rates and click-through events when recipients view messages. On the storefront, scripts track campaign-attributed visits and conversion events to report email marketing ROI and build customer engagement segments.

Shopify Inbox

Shopify Inbox is a live chat and messaging tool built into Shopify storefronts for real-time customer support. Scripts load the chat widget, display automated responses, and connect visitors with store operators for pre-sale questions. Sets session cookies to maintain conversation history and identify returning customers across chat interactions.

Shopify Markets

Shopify Markets is Shopify's cross-border commerce solution that adapts storefronts for international buyers. Scripts handle currency conversion, language detection, regional pricing display, and geo-based store redirects. Sets cookies to remember visitor location preferences and selected market settings for consistent localized shopping experiences across sessions.

Consent Categories

Essential Analytics

Also Known As

Shopify analyticsShop PayShopify cookiesShopify checkout trackingShopify GDPR

Industries

Programming and Developer SoftwareComputers Electronics and Technology

Tracked Domains (305)

Shopify's trackers are common, seen on about 4% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

shopify.comAnalytics

shopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on about 4% of scanned sites.

shopifycdn.comEssential

shopifycdn.com is an essential domain operated by Shopify, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

shops.myshopify.comAnalytics

shops.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on under 1% of scanned sites.

githubfix.myshopify.comAnalytics

githubfix.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

ligonierministries.myshopify.comAnalytics

ligonierministries.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

eufy-us.myshopify.comAnalytics

eufy-us.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

d9b960-6b.myshopify.comAnalytics

d9b960-6b.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

honey-birdette-usa.myshopify.comAnalytics

honey-birdette-usa.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

parkseed.myshopify.comAnalytics

parkseed.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

766ad1-ab.myshopify.comAnalytics

766ad1-ab.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

soundcoreusa.myshopify.comAnalytics

soundcoreusa.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

forgedleather.myshopify.comAnalytics

forgedleather.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

prosuro-dev-merchant-demo.myshopify.comAnalytics

prosuro-dev-merchant-demo.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

maryruth-organics.myshopify.comAnalytics

maryruth-organics.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

makeblock-xtool.myshopify.comAnalytics

makeblock-xtool.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

loopearplugs.myshopify.comAnalytics

loopearplugs.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

vroomtec.myshopify.comAnalytics

vroomtec.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

drsquatchsoapco.myshopify.comAnalytics

drsquatchsoapco.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

roborock-official-website.myshopify.comAnalytics

roborock-official-website.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

rackwarehouse.myshopify.comAnalytics

rackwarehouse.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

bluelandhome.myshopify.comAnalytics

bluelandhome.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

laurageller.myshopify.comAnalytics

laurageller.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

trueclassictees-com.myshopify.comAnalytics

trueclassictees-com.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

ep-prod.myshopify.comAnalytics

ep-prod.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

kuiu-shop.myshopify.comAnalytics

kuiu-shop.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

koreessentials.myshopify.comAnalytics

koreessentials.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

kitschllc.myshopify.comAnalytics

kitschllc.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

honey-buns-shapewear.myshopify.comAnalytics

honey-buns-shapewear.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

aventonbikes.myshopify.comAnalytics

aventonbikes.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

haynes-us.myshopify.comAnalytics

haynes-us.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

vego-gardening-store.myshopify.comAnalytics

vego-gardening-store.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

32degrees.myshopify.comAnalytics

32degrees.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

hatch-insane-deal.myshopify.comAnalytics

hatch-insane-deal.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

grp-site.myshopify.comAnalytics

grp-site.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

zc1uwf-et.myshopify.comAnalytics

zc1uwf-et.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

princesspollydev.myshopify.comAnalytics

princesspollydev.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

peakdesignstore.myshopify.comAnalytics

peakdesignstore.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

greater-good-2.myshopify.comAnalytics

greater-good-2.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

oats-3.myshopify.comAnalytics

oats-3.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

chem-guys-staging.myshopify.comAnalytics

chem-guys-staging.myshopify.com is an analytics domain operated by Shopify, used to measure visits, sessions, and on-site behavior. Seen on a small share of scanned sites.

+ 265 more tracked domains, shown by how common they are across scanned sites.

Cookies Shopify Sets (8)

_shopify_essential

Shopify internal storefront routing and integrity cookie. Set on every visit to a Shopify-powered shop to route the request through the correct shop and protect checkout state. Required for the store to function.

_shopify_y

Shopify visitor identifier set on the customer (store) apex by Shopify's analytics layer. One-year expiration.

_shopify_s

Shopify session identifier set on the customer (store) apex. 30-minute expiration.

_shopify_analytics

Shopify customer-privacy opt-in flag for analytics. Stores whether the visitor has consented to analytics tracking on the shop; gates the Shopify analytics pixel and merchant-installed analytics apps.

_shopify_marketingMarketing

Shopify customer-privacy opt-in flag for marketing. Stores whether the visitor has consented to marketing tracking on the shop; gates retargeting pixels and merchant-installed marketing apps.

secure_customer_sig

Shopify logged-in customer authentication signature. Set when a shopper signs into their Shopify customer account so subsequent requests can verify the session without re-authenticating.

_y

Shopify legacy visitor identifier (pre-Web-Pixels). One-year expiration.

_s

Shopify legacy session identifier (pre-Web-Pixels). 30-minute expiration.