Shopify’s Customer Privacy API reports consent — it does not enforce it. Shopify’s own docs are explicit: it “does not automatically block third-party scripts”. Turning on the cookie banner and assuming your apps respect it is the single most common Shopify compliance failure.
What the Customer Privacy API actually is
It’s a browser-side JavaScript interface that holds the visitor’s consent state and lets apps, pixels and checkout ask about it. It tracks four purposes:
- marketing — targeted advertising
- analytics — understanding site interactions
- preferences — personalisation such as language and currency
- sale_of_data — third-party sharing, handled as an opt-out for US state laws
Apps read it through calls like analyticsProcessingAllowed() and marketingAllowed(), which fold in merchant settings and visitor location, or subscribe to the visitorConsentCollected event to react when the choice changes. In regions where consent is required, the non-essential purposes default to denied until the visitor acts.
The gap: signalling is not blocking
This is the whole post in one line. The API publishes a signal. Something still has to honour it, and that something is each individual app. In a typical store the tag inventory looks like this:
- Shopify’s own pixels and checkout — respect the API. Fine.
- Apps using the Web Pixels API — run sandboxed and are gated on consent by the platform. Mostly fine.
- Anything pasted into
theme.liquid— a Meta Pixel snippet, a TikTok tag, a chat widget, an affiliate script. These are raw<script>tags in your theme. They fire on page load. They have never heard of the Customer Privacy API. - Legacy apps injecting via ScriptTag — same problem, and worse because you may not remember installing them.
That third bucket is where the demand letters come from. The banner is up, the merchant believes the store is compliant, and a hardcoded pixel has been firing before consent the entire time.
Two Shopify-specific traps
Consent must follow an interaction. Shopify’s guidance is that consent should only be recorded on a visitor interaction — never set on page load. Custom banners that call the API on init to “initialise” the state are manufacturing consent nobody gave.
Custom banners don’t wire themselves. Shopify’s built-in banner passes its result to the API automatically. A third-party or hand-rolled banner does not — the integration is yours to write. A store that swapped the native banner for a prettier one and skipped that step has a banner that controls nothing at all.
Auditing a store properly
- Open the store in a clean browser profile and do not touch the banner.
- Check for the tell-tale pre-consent cookies:
_fbp(Meta),_ttp(TikTok),_ga(GA4). - Read
theme.liquidtop to bottom for pasted snippets, then review installed apps for ScriptTag injection. - Repeat on a product page and at checkout — app behaviour differs by template, and stores that pass on the homepage routinely fail on product pages.
If you also run GA4 or Google Ads on the store, the consent signal has to reach Google separately through Consent Mode — the Customer Privacy API doesn’t do that for you. Our Consent Mode v2 GTM guide covers that wiring, and gating the Meta Pixel covers the tag most often found firing early on Shopify.
The fastest way to know where you stand: paste your store URL into CookieInspector’s free scanner. It loads the storefront as a first-time visitor and lists every cookie and tracker that fires before the banner is answered — which, on a Shopify store with a few years of installed apps, is rarely nothing.
Shopify gives you a consent API, not consent compliance. The difference is every script your theme loads that never asks.