Quick Answer
TL;DR: Open your Shopify storefront in incognito with DevTools Network tab open. If you see requests to google-analytics.com, connect.facebook.net, or klaviyo.com before clicking Accept, your cookie banner is decorating not blocking — a GDPR Article 5(3) violation. Full 7-check audit takes 15 minutes with just Chrome + Google Tag Assistant.
Your Shopify store has a cookie banner. Congrats. But is it actually compliant, or just performing compliance? The gap between "there's a banner" and "regulator-defensible compliance" is where most Shopify stores live — and where fines happen.
This guide is a 7-check audit you can run in 15 minutes, quarterly. If you're not testing this often, you're guessing.
Why testing matters
Non-compliant banners are hunted:
- NOYB files hundreds of complaints per year, many targeting Shopify stores specifically
- vzbv (German consumer watchdog) tests top-100 e-commerce sites monthly
- AEPD (Spain) and Garante (Italy) proactively sweep for dark-pattern banners
- The UK ICO raised its PECR fine ceiling to £17.5M in February 2026
- Cookie Information's June 2026 report found 84% of Danish e-commerce sites non-compliant
And even if you dodge regulators, silent leakage costs revenue: Google Consent Mode v2 misconfiguration quietly degrades your remarketing pool. We've seen stores lose 40–60% of remarketing list size within 30 days of a broken GCM v2 setup — with no admin alerts.
What you need
Free tools only:
- Chrome (or Brave, Edge, any Chromium browser)
- Google Tag Assistant Legacy extension (install)
- Brave or DuckDuckGo browser for GPC testing (or the GPC Chrome extension)
Total testing time: 15 minutes.
The 7-check audit
Checklist summary
| Check | Test | Failure = |
|---|---|---|
| 1. Script blocking | No collect hits before Accept in DevTools | GDPR Article 5(3) violation |
| 2. GCM v2 defaults | gtag('consent', 'default' in <head> before GTM | Silent GA4 leakage on first hit |
| 3. GCM v2 update | All 4 signals flip on Accept | Broken remarketing |
| 4. GPC honouring | Brave visit → auto-opted-out | CPRA violation (California) |
| 5. Button prominence | Reject as visible as Accept | Dark pattern — CNIL/Garante/AEPD fine risk |
| 6. Consent log | All decisions recorded with timestamp + hash | No evidence for regulator |
| 7. Granular categories | Analytics-only Accept works | GDPR Article 7 specificity fail |
Pass all 7 = you're defensible. Fail any = fix it.
What to do if you fail
If you fail Check 1 (script blocking): switch to a real Shopify-native CMP. This isn't a config issue — the app fundamentally can't do what you need. See our comparison for apps that actually block.
If you fail Check 2 or 3 (GCM v2): the fix is usually to move the consent defaults out of GTM and into inline <head> script, or upgrade from v1 to v2 signals. See our Google Consent Mode v2 for Shopify guide.
If you fail Check 4 (GPC): most CMPs have a GPC toggle in admin — enable it. If your CMP doesn't support GPC at all, switch.
If you fail Check 5 (button prominence): reconfigure banner styling. Most CMPs allow this; some (annoyingly) require higher-tier plans.
If you fail Check 6 or 7: upgrade CMP tier or switch to one that includes consent logs and granular categories on entry plans.
Automate this audit
Manually running these 7 checks every quarter is tedious. Consentico's Pro tier includes an automated compliance monitor that runs a subset of these checks daily and pings you on Slack/email if any fail. Regressions from new Shopify apps or theme updates get caught within 24 hours.
Install Consentico to get compliance monitoring on the free tier.
Frequently asked questions
Related reading
- How to add cookie consent to a Shopify store — full setup walkthrough
- Google Consent Mode v2 for Shopify — the deep-dive on GCM v2
- Best cookie consent apps for Shopify — 2026 comparison
- Shopify GDPR compliance guide — the underlying legal framework
- Shopify CCPA/CPRA compliance — California specifics
If any of the 7 checks failed, install Consentico — free under 5,000 banner views/month, passes all 7 checks out of the box, five minutes to install.