Shopify Customer Privacy

What it does. Calls Shopify's Customer Privacy API so Shopify's built-in tracking, and any app that reads consent through it, sees the visitor's choice.

Consent category. analytics and marketing.

How it works

Shopify takes all three flags in one call:

window.Shopify.customerPrivacy.setTrackingConsent({
  analytics: true,
  marketing: true,
  preferences: true
}, callback);

The bridge fills them from the resolved consent state on each update. analytics comes from analyticsStorage and marketing from adStorage.

One thing to know before you rely on it: preferences is currently set from the analytics value, not from a preferences category. If you use Shopify's preferences flag to gate anything meaningful, check that it's behaving the way you expect, because a visitor who accepts analytics and declines preferences will still be reported to Shopify as having allowed preferences.

Setup

On by default. Toggle it under Vendor Consent Signals on the banner's App Integrations page, then publish.

The API has to be on the page for the call to land. The bridge calls it when consent resolves, and if Shopify hasn't loaded its Customer Privacy script yet, that call is dropped. The CookieBeam app below loads the API itself and replays the choice once it's ready, so use the app rather than pasting the script tag into the theme.

Install with the CookieBeam app

The CookieBeam Shopify app is a theme app embed. There is nothing to paste into theme code, and it survives theme updates and theme switches.

1. In CookieBeam, add the store's domains to the banner: the *.myshopify.com domain and any custom domain.
2. Install the CookieBeam app on the store.
3. Go to Online Store → Themes → Customize → App embeds and turn on CookieBeam consent banner.
4. Paste the banner ID from Deployment → Install in the dashboard (the UUID in the script URL). Leave Environment empty for production. Save.
5. In Shopify admin, go to Settings → Customer privacy and turn off Shopify's own cookie banner, so visitors don't see two.
6. Publish the banner in CookieBeam.

The embed does two things:

• It loads the banner in <head> from the same URL as the install snippet.
• With Sync consent with Shopify Customer Privacy on (the default), it loads Shopify's Customer Privacy API with Shopify.loadFeatures([{ name: 'consent-tracking-api' }]) and passes every choice to setTrackingConsent. It also sets sale_of_data from the marketing value, which the bridge doesn't send. That way Shopify's opt-out of sale is honoured for US visitors.

If the bridge is also on, Shopify receives the same answer twice, which does no harm.

Theme app extensions don't run on checkout pages, so the banner doesn't appear at checkout. The choice made on the storefront is stored by Shopify's Customer Privacy API and carries over.

Testing

Read the current state back from Shopify:

window.Shopify.customerPrivacy.currentVisitorConsent()

Make a choice in the banner and call it again. The returned flags should match what you chose, allowing for the preferences behaviour above.