Why Shopify's Built-In Cookie Banner Isn't Enough
Shopify includes a basic cookie consent banner through its Customer Privacy settings (Settings > Customer privacy). It does three things: shows a banner, records a consent choice, and fires Shopify's own analytics conditionally.
That covers Shopify's own tracking. It doesn't cover yours.
The moment you add Google Analytics, Meta Pixel, Klaviyo, TikTok Pixel, Hotjar, or any third-party script through theme code or an app, those scripts load independently of Shopify's consent mechanism. The built-in banner has no way to block them. It doesn't know they exist.
For a store that only sells domestically in the US with no third-party tracking, the built-in banner might be enough. For everyone else, it leaves gaps that regulators have started noticing.
Shopify Markets and Cookie Consent
If you use Shopify Markets to sell in multiple regions, your consent requirements change per visitor location. An EU visitor needs prior opt-in consent (GDPR). A California visitor needs an opt-out mechanism (CCPA/CPRA). A Canadian visitor falls under PIPEDA. Shopify's built-in banner doesn't adapt to the visitor's region. CookieBeam does this automatically using regional consent rules.
What You Actually Need for Shopify Cookie Compliance
A compliant Shopify store needs four things the built-in banner doesn't provide:
- Script blocking before consent — Third-party scripts must not fire until the visitor opts in (in GDPR regions) or until they've had a chance to opt out (in CCPA regions).
- Category-level consent — Visitors should be able to accept analytics but reject marketing cookies, or vice versa. A blanket accept/reject isn't granular enough for GDPR.
- Regional adaptation — The banner text, buttons, and legal behavior should change based on where the visitor is. EU visitors see an opt-in banner with a reject button. US visitors see a "Do Not Sell" link.
- Consent records — You need to store proof of each consent decision: what was shown, what was chosen, and when. This is your evidence if a regulator asks.
Adding CookieBeam to Your Shopify Store
CookieBeam works on Shopify the same way it works on any website: one script tag in the <head> of your pages. No app install required, no Shopify app store dependency, no monthly app fee on top of your consent tool subscription.
Method 1: Edit theme.liquid (Recommended)
This is the simplest approach and works for all Shopify themes.
- Go to Online Store > Themes > Actions > Edit code
- Open
theme.liquid(orlayout/theme.liquid) - Find the
</head>closing tag - Add this line directly before it:
<script src="https://cdn.cookiebeam.com/banner/YOUR_BANNER_ID/default/loader.js" async></script>Replace YOUR_BANNER_ID with the ID from your CookieBeam dashboard (found under Deployment > Banner ID).
That's it. The banner will appear on all pages, including your checkout if you're on Shopify Plus.
Shopify Checkout and Cookie Consent
On standard Shopify plans, you can't add custom scripts to the checkout page. Only Shopify Plus merchants can edit checkout.liquid. If you're on a standard plan, the consent banner will appear on all pages except checkout. This is generally acceptable because checkout pages typically only use Shopify's own first-party cookies, which are strictly necessary for the purchase to work.
Method 2: Use Google Tag Manager
If you already use GTM on your Shopify store, you can deploy CookieBeam through the CookieBeam GTM Template from the Community Template Gallery. This approach gives you centralized tag management and automatic consent signal integration with all your GTM tags.
- In GTM, go to Templates > Search Gallery
- Search for "CookieBeam"
- Add the template and create a new tag from it
- Enter your Banner ID and set the trigger to Consent Initialization - All Pages
- Publish your container
The advantage of the GTM method: all your marketing and analytics tags can read consent state directly through GTM's built-in consent checks. No extra wiring needed.
Integrating with Shopify's Customer Privacy API
Shopify's Customer Privacy API lets apps and themes check whether a visitor has consented to tracking. When you use CookieBeam alongside Shopify, you want both systems to agree on the visitor's consent state.
CookieBeam automatically sets Google Consent Mode v2 signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) that Shopify's own consent-aware features can read. For Shopify apps that use the Customer Privacy API directly, you can bridge the two with a small snippet in your theme:
document.addEventListener('cookiebeam:consent', function(e) {
var consent = e.detail;
if (window.Shopify && window.Shopify.customerPrivacy) {
window.Shopify.customerPrivacy.setTrackingConsent({
analytics: consent.analytics,
marketing: consent.marketing,
preferences: consent.preferences
}, function() { /* consent synced */ });
}
});This ensures Shopify apps that respect the Customer Privacy API also honor the choices your visitors make through the CookieBeam banner.
Handling Google Consent Mode v2 on Shopify
Since March 2024, Google requires Consent Mode v2 for any site using Google Ads or GA4 in the EEA. This applies to Shopify stores too.
CookieBeam handles this automatically. When your visitor loads the page, CookieBeam sets the default consent state to denied for all consent types. When the visitor makes a choice, it updates the consent state through gtag('consent', 'update', ...). Google's tags then fire (or don't) based on that state.
You don't need to add any extra consent default snippets or configure consent settings in GTM manually. CookieBeam's loader script handles the full lifecycle: default denied, visitor choice, consent update, and tag behavior.
Shopify Built-In Banner vs. CookieBeam
| Feature | Shopify Built-In | CookieBeam |
|---|---|---|
| Basic consent banner | Yes | Yes |
| Third-party script blocking | No | Yes |
| Category-level consent | No | Yes (necessary, analytics, marketing, preferences) |
| Regional adaptation (GDPR/CCPA) | No | Yes, automatic by visitor location |
| Google Consent Mode v2 | No | Yes, built-in |
| Microsoft Consent Mode | No | Yes |
| Meta Pixel consent | No | Yes |
| Cookie scanner | No | Yes, automated with AI classification |
| Consent analytics | No | Yes, real-time dashboard |
| A/B testing | No | Yes |
| Custom banner design | Limited | Full visual editor with themes |
| Works on checkout | Yes (native) | Shopify Plus only |
Dealing with Shopify Apps and Cookies
Every Shopify app you install can add its own cookies and tracking scripts. Review apps like Judge.me, Klaviyo, Privy, and Omnisend all drop marketing cookies. Analytics apps add their own tracking. Even upsell and cross-sell apps often include third-party scripts.
After installing CookieBeam, run a cookie scan from your dashboard. This will detect every cookie and script on your store, including those added by Shopify apps. CookieBeam's AI classifier will automatically categorize most of them. For the rest, you can manually assign categories in the scanner inventory.
Once classified, CookieBeam will block marketing and analytics scripts until the visitor consents. Strictly necessary scripts (like Shopify's own session cookies) continue to work without consent.
Quick Setup Checklist
Create your CookieBeam banner
Sign up at cookiebeam.com and create a banner. Use the visual editor to match your store's branding.
Configure regional rules
Set up GDPR rules for EU visitors and CCPA opt-out rules for California visitors. CookieBeam includes preset templates for common regulations.
Add the script to theme.liquid
Copy your script tag from the Deployment tab and paste it before </head> in your theme.liquid file.
Run a cookie scan
Trigger a scan from your CookieBeam dashboard to detect all cookies and scripts on your store.
Review and classify
Check the scan results. Most items will be auto-classified. Manually review any unknowns.
Publish and test
Publish your banner, then clear your browser storage and visit your store. Verify the banner appears, respects your choices, and blocks scripts until consent.
Shopify-Specific Gotchas
Shopify Analytics and Consent
Shopify's own analytics (the reports in your admin dashboard) use first-party cookies that are strictly necessary for the platform to function. You don't need to block these. They're categorized as necessary by default in CookieBeam.
Accelerated Checkout Buttons
Shop Pay, Apple Pay, and Google Pay buttons on product pages may load external scripts. These are considered part of the payment flow (strictly necessary) and don't require consent. CookieBeam's default configuration handles this correctly.
Shopify Audiences
If you use Shopify Audiences for ad targeting, the data sharing happens server-side through Shopify's infrastructure. Your consent banner should still cover the client-side tracking that feeds into Audiences (typically Meta Pixel and Google Ads tags).
Headless Shopify (Hydrogen)
If you're running a headless storefront with Hydrogen or a custom React frontend, the setup is the same as any React app. Add the CookieBeam script tag to your root HTML template or layout component. See our React Cookie Consent Guide for framework-specific details.
Frequently Asked Questions
Do I need a cookie consent banner on Shopify?
If you sell to customers in the EU, UK, or California, yes. Shopify's built-in banner handles Shopify's own tracking, but it doesn't block third-party scripts like Google Analytics, Meta Pixel, or Klaviyo. If you use any of these, you need a proper consent management solution.
Can I use CookieBeam without a Shopify app?
Yes. CookieBeam is a script-based solution, not a Shopify app. You add one line of code to your theme.liquid file. This means no app review delays, no app-store dependency, and no extra Shopify app fees.
Will CookieBeam slow down my Shopify store?
The CookieBeam loader script is under 10 KB gzipped and loads asynchronously. It won't block your page render. In fact, by deferring third-party marketing scripts until consent, it can actually improve your initial page load time for visitors who haven't consented yet.
Does CookieBeam work with Shopify's Online Store 2.0 themes?
Yes. CookieBeam works with all Shopify themes, including Online Store 2.0 (Dawn, Refresh, etc.) and legacy themes. The installation is the same: one script tag in theme.liquid.
What about the Shopify checkout page?
On standard Shopify plans, you can't add scripts to the checkout. This is usually fine because checkout only uses Shopify's strictly necessary cookies. On Shopify Plus, you can add the CookieBeam script to checkout.liquid for full coverage.
Next Steps
Setting up cookie consent on Shopify takes about 10 minutes with CookieBeam. Start with the script in theme.liquid, run a cookie scan, and review your results. For stores selling internationally through Shopify Markets, the regional consent rules will automatically adapt the banner for each visitor's location.
If you're using Google Tag Manager, check our GTM Integration Guide for the template-based setup. For server-side tracking with sGTM, see Server-Side Tagging with Consent for Shopify.