GDPR and Cookie Compliance for Shopify: Beyond the Banner

Open the developer tools on most Shopify stores selling into Europe and you'll see the same thing. The cookie banner appears. Behind it, the analytics script, the Meta pixel and three app scripts have already fired.

That's the single most common compliance failure, and a banner doesn't fix it — it disguises it. Consent obtained after the tracking has started isn't consent. The banner exists to make the store look compliant, and in that specific sense it works, which is why nobody checks.

The broader issue is that the banner is one requirement among several, and the others are less visible. What data are you collecting and on what legal basis? What happens when a customer emails asking for everything you hold on them? Does every app touching your customer data have an agreement in place? Who finds out if there's a breach, and how quickly?

And it applies based on where your customers are, not where you are. A store in Melbourne selling to Berlin is in scope. That's the same reasoning that makes the European Accessibility Act your problem too, covered in accessibility and ADA compliance.

This is a practical guide, not legal advice. Data protection law varies by jurisdiction and continues to develop, and the consequences of getting it wrong are legal rather than technical. Use this to have a better conversation with a qualified adviser — not instead of one.

Worth getting the scope right, because merchants routinely assume it doesn't apply to them.

GDPR applies to processing the personal data of people in the EU, regardless of where your business is registered. If you ship to Germany, run ads targeting France, or simply have EU visitors filling in your newsletter form, you're processing EU personal data.

The UK has its own version post-Brexit — UK GDPR alongside the Data Protection Act. Broadly similar obligations, separate regime. Selling to both means both apply.

Personal data is broader than most people assume. Not just names and emails: IP addresses, device identifiers, cookie IDs and order history all count. This matters because it means your analytics and advertising tools are processing personal data, not just your customer database.

Cookies are governed separately. A detail worth knowing — cookie consent comes primarily from the ePrivacy rules rather than GDPR itself, though GDPR sets the standard for what valid consent looks like. Practically they operate together, which is why the banner and the broader obligations get conflated.

Elsewhere: California's privacy law works on an opt-out model rather than opt-in, which is a genuinely different design — a compliant EU setup is usually more than sufficient, but the reverse isn't true. Other jurisdictions have their own frameworks, and the direction of travel globally is toward more regulation rather than less.

The practical read: build for GDPR and you have covered most of what other regimes ask for. Build for the loosest applicable regime and you'll be retrofitting.

The division of responsibility is the thing most merchants get wrong, usually in their own favour.

You are the controller. Shopify is a processor. You decide what data is collected and why; Shopify processes it on your instructions. That means the legal obligations sit with you, not with your platform. "Shopify handles that" is not a defence.

What Shopify provides: infrastructure security, its own compliance as a processor, a customer privacy and consent API that themes and apps can use, and webhooks that let apps respond to data requests. These are genuinely useful tools. They are tools, not compliance.

What is yours:

• Deciding your lawful basis for each kind of processing
• Your privacy policy actually describing what you do
• Configuring consent so it works before tracking fires
• Responding to data subject requests within the required timeframe
• Agreements with every app processing your customer data
• Knowing what happens in a breach and who is told

The app dimension is the one most often missed. Every app touching customer data is a processor working on your behalf, which makes it your responsibility to have an agreement in place and to know what they do with the data. A store running twenty apps has twenty processor relationships, and most merchants have never audited one. The wider case for knowing what your stack is doing is in best Shopify apps.

Since almost everyone has a banner and most are implemented wrongly, it's worth being specific about what valid looks like.

Nothing non-essential fires before consent. This is the requirement that fails most often. Analytics, advertising pixels, session recording, chat widgets, A/B testing tools — none should load until the visitor has agreed. If your banner appears while your pixel is already sending data, the banner is decoration.

Rejecting must be as easy as accepting. An "Accept all" button next to a link to a settings page, buried, is not equivalent. Regulators across Europe have been explicit about this pattern.

Consent must be granular. Visitors should be able to accept analytics but refuse advertising, rather than facing one all-or-nothing switch.

No pre-ticked boxes, no implied consent. "By continuing to browse you agree" does not meet the standard. Consent must be an affirmative action.

Withdrawal must be as easy as giving. A persistent way to change preferences, not a one-time banner that never reappears.

You must keep a record of who consented to what and when. This is where purpose-built tools earn their cost — options include Pandectes and Consentmo, which integrate with Shopify's consent API so scripts genuinely hold until consent is given.

How to check yours in two minutes: open your store in a private window with developer tools on the network tab, and watch what loads before you touch the banner. If analytics or pixel requests appear, you have the most common problem on the list.

The commercial reality worth naming: proper consent reduces the data you collect, because a meaningful share of visitors decline. That affects your analytics and attribution — and it's part of why platform numbers and reality diverge, as covered in marketing attribution. Blocking tracking is the point, not a side effect.

Five obligations beyond the banner. None require a lawyer to understand, though some require one to get right.

1. A lawful basis for every kind of processing. You need a legitimate reason to hold data. Fulfilling an order is contractual necessity — you don't need consent to process an address you're shipping to. Marketing usually requires consent. Analytics sits in contested territory. The point is that you should be able to say which basis applies to what.

2. A privacy policy that describes what you actually do. Most Shopify privacy policies are generic templates that don't match the store's real app stack. If you run session recording, retargeting pixels and a chat tool, the policy should say so. A template naming tools you don't use and omitting ones you do is worse than useless.

3. Handling data subject requests. Customers can ask what you hold, ask for corrections, ask for deletion, and ask for a portable copy. There are deadlines. Shopify provides mechanisms, but the process — who receives the request, who acts on it, how apps are included — is yours to define. Most stores have no process at all and discover this when the first request arrives.

4. Data processing agreements with your apps. Every processor needs an agreement. Reputable apps provide one; the obligation to have it sits with you.

5. Breach procedure. Tight notification deadlines apply. The realistic requirement is knowing in advance who is told and how quickly, rather than improvising during an incident.

Also worth keeping: a simple record of what data you process, why, where it goes and how long you keep it. Unglamorous, and it makes every other obligation easier to answer.

A distinction that causes real problems because the two get conflated.

Cookie consent and marketing consent are separate. Someone accepting cookies has not agreed to receive your emails. Someone subscribing to your newsletter has not agreed to be tracked across the web. Two different permissions, two different records.

Email and SMS marketing generally require consent in the EU and UK, given affirmatively. Practical implications:

• No pre-ticked subscribe boxes at checkout or on forms.
• Marketing opt-in must be separate from agreeing to terms. Bundling them invalidates both.
• Buying or renting lists is a problem — you cannot inherit consent given to someone else.
• Unsubscribing must be easy and must actually work across every list.
• Keep the record: when they subscribed, by what method, to what.

SMS carries its own additional rules in several jurisdictions, which merchants consistently underestimate — covered alongside the platform choices in the SMS platform comparison.

The upside nobody mentions: a properly consented list performs better. Smaller, yes — and made of people who chose to hear from you, which is why deliverability and engagement improve. That connects directly to the programme work in retention and lifecycle marketing. Compliance and list quality push in the same direction here.

Assuming it doesn't apply because you're not in Europe. Scope follows the customer. The most common and most consequential misunderstanding.

A banner that doesn't block anything. The single most frequent technical failure. Check yours today.

A template privacy policy. Generic text that names tools you don't use and omits the ones you do.

No process for data requests. Fine until the first one arrives, then a scramble under a deadline.

Never auditing apps. Apps get installed, trials convert, nobody records what data each one touches. Every one is a processor relationship.

Pre-ticked marketing boxes. Still common at checkout, and clearly non-compliant.

Treating it as a one-off project. Install a banner, tick the box, never revisit. Every new app and every new tracking tool changes your position.

Over-collecting by default. Collecting data because a form field exists rather than because you need it. Less data means less obligation, less risk and less to explain — and most stores could delete fields nobody has ever used.

The banner check and the app audit are self-serve. Three situations warrant help.

Implementing consent so it genuinely blocks scripts. Making tracking wait for consent, across a theme and a full app stack, is technical work — privacy and GDPR compliance experts.

Selling into multiple regimes. EU, UK, California and others have different models — opt-in versus opt-out are structurally different, and serving both from one setup needs designing rather than improvising.

Anything involving a regulator or a breach. That's a lawyer first and a technical specialist second, in that order.

How to vet: ask how they'd verify that no scripts fire before consent, and ask what they'd do about your app stack specifically. Anyone whose answer is "install a consent app" is describing a purchase rather than a process. And be sceptical of anyone guaranteeing compliance — the honest offer is reducing risk and documenting good faith, not eliminating exposure.

Worth pairing with accessibility. Both are EU obligations following where you sell, both are commonly ignored until something forces the issue, and both are cheaper to build into a redesign than to retrofit — see accessibility and ADA compliance. If you're commissioning one, scope both.

If you're expanding into these markets deliberately, the setup side is in Shopify Markets setup, and specialists are listed for Germany, France and the United Kingdom.

Open your store in a private window with the network tab showing and watch what fires before you touch the banner. That takes two minutes and tells you whether you have the most common problem on this list.

Then list every app touching customer data and check you have an agreement with each. Then read your privacy policy and ask whether it describes the store you actually run.

Those three checks cost an afternoon and cover most of the exposure. If tracking is firing before consent, or you sell into several regimes, browse privacy and GDPR compliance experts. Free matching, verified experience, no commissions.

Related guides on compliance, data and international selling:

• Privacy & GDPR Compliance Experts — consent implementation and data request processes
• Accessibility & ADA Compliance Experts — the other obligation that follows where you sell
• Accessibility & ADA Compliance — scope both together if commissioning work
• Shopify Markets Setup — the configuration side of selling internationally
• Retention & Lifecycle Marketing — why consented lists perform better
• Marketing Attribution — why consent reduces the data your platforms see
• Best Shopify Apps 2026 — knowing what your stack is actually doing