GDPR/PECR, cookie consent, Shopify and Google Analytics - regulatory and important

Shopify Discussion

Topic summary

Shopify stores face ongoing GDPR/PECR compliance issues regarding cookie consent, particularly for UK and EU merchants. The core problem: analytics cookies (Google Analytics, Facebook Pixel) are deployed through Shopify’s admin settings outside theme control, making proper opt-in consent impossible—especially at checkout, which remains inaccessible on non-Plus plans.

Key compliance gaps identified:

  • Shopify’s own analytics cookies (_shopify_y, _s, etc.) load before user consent, even with “Limit tracking to EU” enabled
  • The Facebook/Instagram app sets the _fbp marketing cookie regardless of consent status
  • Shopify’s Consent Tracking API and native consent banner don’t actually block these cookies on initial page load
  • Third-party GDPR apps claim compliance but often only delete cookies after they’ve already fired, not prevent them from loading

Regulatory context:

The UK ICO has flagged cookie compliance as an enforcement priority. EU regulations require explicit opt-in for non-essential cookies before they’re set. Fines are being issued to non-compliant sites.

Proposed solutions discussed:

  • Google Consent Mode integration (mandatory by March 2024 per Google)
  • Custom script blocking using Shopify’s Customer Privacy API
  • Third-party tools like OneTrust or specialized Shopify apps
  • Manual deletion of problematic cookies via JavaScript

Current status (as of August 2025):

No out-of-the-box solution exists. Merchants remain liable for fines despite platform limitations. The discussion reflects frustration that this critical issue, first raised in 2019-2020, remains unresolved by Shopify.

Summarized with AI on October 26. AI used: claude-sonnet-4-5-20250929.
20

@Pandectes I took the opportunity to install the app on my store and check out the trial. Digging into the code, it shows that you store all _shopify_y (Analytics related) cookies under category 1 which are according to your app “fuctionalityStorage” and “personalizationStorage” related.

If you were audited by law/tech firms, you will no doubt have received feedback about these cookies being analytics related. As per GDPR guidelines, no cookies are allowed but those that are essential to the functioning of your website such as language preferences or cart sessions. Analytics cookies clearly fall out of that bucket, meaning you are not GDPR compliant.

As I said multiple times before, Shopify does not allow you to disable these cookies because they are essential to the functioning of their Analytics suite. There simply is no way to not load them on pageload, period.