We're using a third party cookie compliance management service called OneTrust on some of our Shopify stores - they're supplying us with a Cookie Banner & Preference Centre, as well as a cookie categorisation facility. Most importantly they offer an 'auto-blocking' feature intended to block the source of all NOT strictly-necessary cookies until user permission is provided.
However...
We've found that this technology is not successfully blocking a range of Shopify cookies - _shopify_y, _shopify_s, _y, _s, _shopify_evids etc - which are, to quote ThomasBorowski on this thread https://community.shopify.com/c/shopify-discussions/eu-high-court-decision-regarding-cookies-and-sho... : "set by Shopify's analytics scripts [and] injected into the store automatically".
Tech support at OneTrust had this to say:
"Unfortunately overall, it seems we are unable to block Shopify Cookies. We have no control over cookies that might be set by an external resource on a different domain. These (third party) cookies are set on the "external domain", not the domain of your site."
Concerned about what this might mean for the compliance status of our sites, I went to Shopify Plus Support to asked if it was possible and/or desirable to block these cookies on page load, and was told:
"It could be possible however it is not something that we would support as it could greatly effect the merchants analytics, it could effect store front loading, it could also effect the admin as well."
Since I was fully into web detective mode now, I went and inspected a number of prominent Shopify sites and saw the same cookies appearing in the browser, regardless of what kind Compliance Banner was implemented and before any interaction with a banner.
The questions all this raises are:
What is the correct categorisation for the cookies listed above?
If a cookie is integral to "store front loading" and the functioning of the store admin, in addition to store analytics, can it be correctly categorised as strictly necessary?
If these cookies cannot be designated strictly necessary, and leading compliance services can't block them, what recourse do store owners have to ensure that they're GDPR compliant?
Would really appreciate the thoughts of both other store owners and Shopify staff.
Andy.
