All posts
·11 min read

How to add cookie consent to a Shopify store (2026 setup guide)

Step-by-step guide to adding a cookie consent app to your Shopify store in 2026 — what to pick, how to install it in under 5 minutes, and how to verify it actually blocks trackers before consent. Written by a Shopify cookie consent app maker.

shopifycookie-bannergdprhow-to

Quick Answer

TL;DR: Install a Shopify-native cookie consent app (we recommend Consentico — free under 5,000 banner views/month with full features), enable the theme app embed, pick your compliance region, and test in incognito DevTools. Total setup time: under 5 minutes with no code. Shopify's built-in banner alone isn't enough — it records consent but doesn't block trackers, which GDPR Article 5(3) requires.

If you sell on Shopify and any of your visitors come from the EU, UK, EEA, or California, you need a real cookie consent banner — not just Shopify's built-in one. This guide walks through why, how to add one in under 5 minutes, how to pick the right app, and how to verify it actually works.

Written by: the team behind Consentico, a Shopify-native cookie consent app. We're biased, but we've made this guide useful whether you pick us or a competitor.

Shopify added a built-in cookie banner to Dawn 12+ in 2023. It records the visitor's consent choice via the Customer Privacy API. That's useful — but it's not enough for compliance.

What Shopify's built-in banner does:

  • Shows a banner to EU visitors
  • Records their Accept / Reject choice
  • Exposes the choice via window.Shopify.customerPrivacy for other apps

What Shopify's built-in banner does NOT do:

  • Block tracking scripts before consent. GA4, Meta Pixel, Klaviyo, and TikTok Pixel all fire before the visitor sees the banner. GDPR Article 5(3) requires actual blocking, not recording.
  • Provide granular per-category consent. GDPR Article 7 requires that consent be "specific" — an all-or-nothing Accept button fails this.
  • Provide a consent log. No audit trail = no way to prove consent if a regulator asks.
  • Handle Google Consent Mode v2. GCM v2 has been mandatory for EU/EEA traffic since March 2024. Without it, remarketing audiences degrade.
  • Handle GDPR webhooks. Shopify apps that store customer data need customers/data_request, customers/redact, and shop/redact webhooks handled — Shopify's built-in banner doesn't do this.

For a fuller breakdown of the built-in banner's limitations, see our Shopify GDPR compliance guide.

A cookie consent app (or "CMP" — consent management platform) sits between your visitors and every tracking script on your store. Its job is:

  1. Show a compliant banner — Accept, Reject, Preferences buttons with equal visual weight (this alone fails on many stores; see the Italian Garante's €12.5M Poste Italiane fine for what happens when you get it wrong).
  2. Block scripts before consent — GA4, Meta Pixel, TikTok Pixel, Klaviyo, all held back until the visitor decides.
  3. Sync with Google Consent Mode v2 — sets the four required signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) so Google Ads keeps working.
  4. Log every consent decision — timestamp, hashed IP, banner version, choice. Exportable as evidence.
  5. Handle GDPR webhooks — respond to Shopify's data deletion requests within 30 days.
  6. Honour GPC — the Global Privacy Control browser signal for California CPRA compliance.

If your current setup doesn't do all six, it's not compliant.

Not every store needs the same app. Quick decision tree:

You want the cheapest option with a real free tier → Consentico (5k views free, all features)

You want the most-reviewed Shopify-native app → Consentmo (5.0★, ~1,785 reviews)

You run multiple platforms (Shopify + WordPress + Webflow) → CookieYes (cross-platform)

You're enterprise with legal team + IAB TCF requirement → Cookiebot

You want the cheapest paid plan and don't need a big free tier → Consentik ($6.99/mo)

Full head-to-heads: vs Consentmo, vs Cookiebot, vs CookieYes, vs CookieFirst, vs Consentik.

What to actually check on any candidate

Cut through marketing copy — here's the 7-point audit checklist:

  1. Real script blocking, not just recording — DevTools test above
  2. Google Consent Mode v2 defaults in <head> before any tag — view source, search for gtag('consent', 'default', make sure it's above GTM/GA4 scripts
  3. GPC honouring — install Brave or DuckDuckGo, visit your store, banner should auto-set "Do Not Sell"
  4. Granular consent categories — essential / functional / analytics / marketing, not all-or-nothing
  5. Consent log with hashed IP + timestamp + version — required as evidence
  6. Total cost at your projected volume — some apps 5× at higher tiers
  7. GDPR webhook handling — app must respond to customers/data_request, customers/redact, shop/redact

Using a script-snippet CMP instead of a theme app extension

Script snippets pasted into theme.liquid load after your tags, so default-deny fails. They also break on theme switches. Always prefer a Shopify theme app extension.

Configuring Google Consent Mode inside GTM

GTM loads asynchronously — by the time consent defaults fire from inside GTM, GA4 has already sent its first pageview. Defaults must be inline in <head> before GTM. Details: GCM v2 for Shopify.

Not testing in incognito with DevTools

Your logged-in session already has consent stored. Every real test must be in an incognito window with a fresh Network tab. If you skip this, you'll miss the pre-consent leakage bug.

Assuming Shopify's built-in banner is enough

It records consent but doesn't block scripts. This is the single most common mistake we see. Article 5(3) requires blocking.

Blocking EU traffic instead of adding a banner

Some merchants try geo-blocking as a workaround. It's not airtight (VPNs), and any leakage exposes you anyway. Adding a compliant banner is faster and cheaper.

Frequently asked questions

Ready to install?

If you want the fastest path to compliance: install Consentico from the Shopify App Store. Free under 5,000 banner views/month with every feature included — geo-targeting, script blocking, GCM v2, consent log, and Shopify GDPR webhook handling. Uninstalls cleanly if it's not for you.

Still comparing? Read the full 2026 comparison of the top 6 apps or jump into head-to-heads: vs Consentmo, vs Cookiebot, vs CookieYes, vs CookieFirst.

Related reading