GDPR/PECR, cookie consent, Shopify and Google Analytics - regulatory and important

Shopify Discussion

Topic summary

Shopify stores face ongoing GDPR/PECR compliance issues regarding cookie consent, particularly for UK and EU merchants. The core problem: analytics cookies (Google Analytics, Facebook Pixel) are deployed through Shopify’s admin settings outside theme control, making proper opt-in consent impossible—especially at checkout, which remains inaccessible on non-Plus plans.

Key compliance gaps identified:

  • Shopify’s own analytics cookies (_shopify_y, _s, etc.) load before user consent, even with “Limit tracking to EU” enabled
  • The Facebook/Instagram app sets the _fbp marketing cookie regardless of consent status
  • Shopify’s Consent Tracking API and native consent banner don’t actually block these cookies on initial page load
  • Third-party GDPR apps claim compliance but often only delete cookies after they’ve already fired, not prevent them from loading

Regulatory context:

The UK ICO has flagged cookie compliance as an enforcement priority. EU regulations require explicit opt-in for non-essential cookies before they’re set. Fines are being issued to non-compliant sites.

Proposed solutions discussed:

  • Google Consent Mode integration (mandatory by March 2024 per Google)
  • Custom script blocking using Shopify’s Customer Privacy API
  • Third-party tools like OneTrust or specialized Shopify apps
  • Manual deletion of problematic cookies via JavaScript

Current status (as of August 2025):

No out-of-the-box solution exists. Merchants remain liable for fines despite platform limitations. The discussion reflects frustration that this critical issue, first raised in 2019-2020, remains unresolved by Shopify.

Summarized with AI on October 26. AI used: claude-sonnet-4-5-20250929.
11

Hi Pandectes,

This is interesting. Thanks for sharing. I took a look at the demo store. When rejecting all cookies I expected to see only essential cookies when checking in dev tools. However, when cross referencing the cookies present against the cookies list on the demo site I can see that a lot of the analytics cookies are still loaded and a lot of unlisted ones are too. I’d be happy to hear whether I’m getting something wrong here if you’re happy to take a look.

Here’s the full list of cookies after rejecting all.

Value Category
_pandectes_gdpr essential
_gid Not listed by pandectes
cart_ver Not listed by pandectes
_pin_unauth Not listed by pandectes
cart_sig Not listed by pandectes
cart Not listed by pandectes
_shopify_evids Not listed by pandectes
_gid Not listed by pandectes
_ga Not listed by pandectes
_shopify_m Not listed by pandectes
_uetsid Not listed by pandectes
master_device_id Not listed by pandectes
_shopify_sa_p Analytics
_s Analytics
_y Analytics
_tracking_consent Not listed by pandectes
cart_ts Not listed by pandectes
_ga Not listed by pandectes
_orig_referrer Analytics
secure_customer_sig essential
_scid Not listed by pandectes
!lithiumSSO Not listed by pandectes
lithiumSSO:covpk78932 Not listed by pandectes
_shopify_s Analytics
localization Not listed by pandectes
_y Analytics
_shopify_sa_t Analytics
_biz_pendingA Not listed by pandectes
_s Analytics
_clsk Not listed by pandectes
_biz_flagsA Not listed by pandectes
_biz_nA Not listed by pandectes
_landing_page Analytics
_shopify_y Analytics
_biz_uid Not listed by pandectes
storefront_digest Not listed by pandectes
_ga_69WFXNJXQV Not listed by pandectes
utag_main Not listed by pandectes
optimizelyEndUserId Not listed by pandectes
_shopify_evids Not listed by pandectes
_gcl_au Not listed by pandectes
_shopify_tw Not listed by pandectes
_shopify_tm Not listed by pandectes
_shopify_y Analytics
_clck Not listed by pandectes
_rdt_uuid Not listed by pandectes
__kla_id Not listed by pandectes
_shopify_s Analytics
_uetvid Not listed by pandectes
_fbp Not listed by pandectes