I’m really looking for engagement with Shopify staff on this issue as it’s been ongoing and appears to have no resolution - though I’m happy to be disabused of this understanding.
tl;dr: Shopify stores are all in breach of GDPR/PECR privacy legislation and Shopify must act to correct this before Bad Things happen.
For cookies and analytics to be legally compliant in the UK & EU, users MUST opt-in for optional (analytics) cookies and tracking. Currently, this is impossible with Shopify as GA and Pixel codes are entered through store preferences and deployed on the site outwith the theme layout. This is problematic, not least because the UK ICO has stated an increased focus in businesses who are not complying with correct consent for tracking.
Cookie compliance will be an increasing regulatory priority for the ICO in the future. However, as is the case with all our powers, any future action would be proportionate and risk-based. Start working towards compliance now - undertake a cookie audit, document your decisions, and you will have nothing to fear.
Sources:
- https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/#rules5
- https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/
This topic has been raised in a few places on different boards, often for various reasons, and so I felt it appropriate to try and unify into one single topic which should be of critical importance to anyone: (i) in the EU and doing business in the EU, and (ii) outside the EU and doing business in the EU. So, pretty much everybody.
The blanket silence, wilful ignorance, and usual comment of ‘there’s an app for this’ from Shopify is, quite frankly, astonishing, given the seriousness of the position everyone is being exposed to by their negligence. This is not meant to be taken as a gibe but a statement of fact.
Whilst there is a clear interest in merchants being able to track analytics throughout the store, and through checkout to conversion, this must be balanced by the requirement to meet regulations and not be left open for legal action. The potential levels of fine for merchants would close businesses.
If there is an infringement of other provisions, such as administrative requirements of the legislation, the standard maximum amount will apply, which is 10 million Euros (or equivalent in sterling) or 2% of the total annual worldwide turnover in the preceding financial year, whichever is higher.
Shopify should be acutely aware of this - the repercussions of a successful case against an EU merchant would be a flood of merchants leaving the platform. This would be terrible for merchants, Shopify, and bad for us - as Partners.
Simple cookie notice banners are insufficient and not compliant.
The requirements for a solution are thus:
- Customers must have the option to opt-in for analytics
- Merchants must be given the means to control analytics from theme level - this includes Shopify analytics
You can see from the ICO’s own website that they use a controller produced by a UK company called Civic (https://www.civicuk.com/cookie-control) [we are not affiliated with Civic in any way - we use their controller because they provide a free ‘community’ licence which is suitable for most use cases]. This controller allows cookies to be enabled and disabled, and call the GA revoke function to clear local cookies. If it’s good enough for the ICO then it will be good enough for everyone else. We would normally use the cookie controller as a wrapper to deliver GTM, itself then a wrapper for analytics and various other ‘optional’ scripts [heatmapping, page activity tracking, etc] - though we can’t do that in Shopify due to the lack of access to the Checkout template. Some implementation of this to control cookies and analytics would look to be the way to go. An even better way would be for Shopify to develop a native solution which mimics this functionality so that customers opt-in, and then analytics can be used right through checkout.
Shopify must acknowledge this issue and respond - preferably with a roadmap to GDPR/PECR compliance.
I’d welcome input from other merchants/partners - this is too big an issue for ignorance to lead everyone down the path to legal action.
