Consent Mode v2 on Shopify with the Customer Privacy API

If you sell to Europe and run Google Ads, Consent Mode v2 isn’t optional: without it, Google limits remarketing and audience features, and conversion modelling can’t fill the gaps left by visitors who refuse cookies. On Shopify, doing it properly means connecting three things: your cookie banner, Shopify’s Customer Privacy API, and your Google tags, in the theme and in pixels. Here is how, step by step.

This is a technical guide, not legal advice. Have your legal team or DPO validate your banner and your choice of basic or advanced mode.

Choosing the banner type, where to load it and what happens to the first page view before consent are covered in how to set up a cookie consent banner on Shopify.

How the pieces fit together

1. The cookie banner asks the visitor and records the choice.
2. The Customer Privacy API is where Shopify stores that choice. The banner must write to it.
3. Pixels are loaded or blocked by Shopify according to that choice and their permission settings.
4. Consent Mode tells Google’s tags (GA4, Google Ads, Floodlight) what they may do with cookies and user data.

The most common failure is a broken link between 1 and 2: a banner that blocks scripts in the theme but never tells Shopify. Pixels and the checkout then ignore the visitor’s choice.

The four Consent Mode v2 signals

Signal	What it controls	Shopify permission
analytics_storage	Analytics cookies (GA4’s _ga)	Analytics
ad_storage	Advertising cookies (Google Ads, Floodlight)	Marketing
ad_user_data	Sending user data to Google for advertising	Marketing
ad_personalization	Remarketing and personalized ads	Marketing

The two v2 signals (ad_user_data and ad_personalization) are the ones Google requires for European traffic. Shopify has a single “marketing” permission, so the three ad signals follow it together.

Step 1: choose a banner that uses the Customer Privacy API

• Shopify’s own cookie banner (from the Customer Privacy settings) writes to the API natively. Good enough for many stores, with limited design and wording options.
• Banner apps built for Shopify (for example Consentmo, Pandectes, Axeptio or Cookiebot’s Shopify integration) usually write to the API too. Check their documentation for “Customer Privacy API” before installing.
• A generic banner added in theme.liquid must call the API itself, as in step 2. Without that call, it doesn’t control pixels or the checkout.

In Settings → Customer Privacy, set the regions where consent is required (at least the EEA, UK and Switzerland) so the banner shows there.

Step 2: if your banner isn’t integrated, connect it

The Customer Privacy API is loaded on the theme and exposes setTrackingConsent. Call it when the visitor makes a choice:

window.Shopify.loadFeatures(
  [{ name: "consent-tracking-api", version: "0.1" }],
  (error) => {
    if (error) return;
    // call this from your banner's accept / reject / save callbacks
    window.saveShopifyConsent = (choice) =>
      window.Shopify.customerPrivacy.setTrackingConsent(
        {
          analytics: choice.analytics,
          marketing: choice.marketing,
          preferences: choice.preferences,
          sale_of_data: choice.marketing
        },
        () => {}
      );
  }
);

You can check the stored choice in the console at any time with Shopify.customerPrivacy.currentVisitorConsent().

Step 3: set Consent Mode in your custom pixel

If GTM runs in a custom pixel, the pixel reads the current choice from init.customerPrivacy and listens for updates. This must run before GTM loads:

window.dataLayer = window.dataLayer || [];
function gtag() { window.dataLayer.push(arguments); }

const consentState = (p) => ({
  analytics_storage: p.analyticsProcessingAllowed ? "granted" : "denied",
  ad_storage: p.marketingAllowed ? "granted" : "denied",
  ad_user_data: p.marketingAllowed ? "granted" : "denied",
  ad_personalization: p.marketingAllowed ? "granted" : "denied"
});

gtag("consent", "default", { ...consentState(init.customerPrivacy), wait_for_update: 500 });

customerPrivacy.subscribe("visitorConsentCollected", (event) => {
  gtag("consent", "update", consentState(event.customerPrivacy));
});

// then load GTM

The full pixel, with GTM loading and ecommerce events, is in building a full ecommerce dataLayer from a Shopify custom pixel.

Step 4: if Google tags still run in the theme

If GTM or gtag is in theme.liquid, it needs the same logic: a default before the container loads, and an update when consent changes. Shopify dispatches a visitorConsentCollected event on the document when the visitor decides:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }
  gtag("consent", "default", {
    analytics_storage: "denied", ad_storage: "denied",
    ad_user_data: "denied", ad_personalization: "denied",
    region: ["AT","BE","BG","HR","CY","CZ","DK","EE","FI","FR","DE","GR","HU","IS","IE","IT","LV","LI","LT","LU","MT","NL","NO","PL","PT","RO","SK","SI","ES","SE","CH","GB"],
    wait_for_update: 500
  });
  gtag("consent", "default", {
    analytics_storage: "granted", ad_storage: "granted",
    ad_user_data: "granted", ad_personalization: "granted"
  });
  document.addEventListener("visitorConsentCollected", (e) => {
    const c = e.detail;
    gtag("consent", "update", {
      analytics_storage: c.analyticsAllowed ? "granted" : "denied",
      ad_storage: c.marketingAllowed ? "granted" : "denied",
      ad_user_data: c.marketingAllowed ? "granted" : "denied",
      ad_personalization: c.marketingAllowed ? "granted" : "denied"
    });
  });
</script>

Returning visitors who already chose don’t trigger the event again, so also read Shopify.customerPrivacy on page load once the API is ready and send an update. My advice: move Google tags out of the theme and into a single custom pixel, which avoids this double logic and works on the checkout.

Step 5: the pixel permission setting

Each pixel in Customer events has a permission setting. This decides which Consent Mode you actually get:

Pixel setting	What happens before consent	Consent Mode
Requires analytics and marketing	Shopify doesn’t load the pixel at all	Basic: no data before consent
Not required	The pixel loads; your code sets Consent Mode to denied	Advanced: cookieless pings, used for modelling

Advanced mode recovers more conversions through Google’s modelling, but it means Google receives cookieless signals before consent. Some legal teams accept it, some don’t. Decide with them, then set the pixel accordingly. App pixels follow the same rule through their own settings.

Step 6: test it

1. Open the store in a private window from a European location (or a VPN), so the banner shows.
2. Before choosing: in the Network tab, filter on collect. In basic mode there should be no GA4 requests. In advanced mode, requests should carry gcs=G100 (everything denied) and no _ga cookie should exist.
3. Accept everything: requests now carry gcs=G111 and the _ga cookie appears.
4. In a new private window, refuse: gcs stays at G100, and no Meta or TikTok requests leave the browser.
5. Repeat on the checkout and thank-you page: the choice must carry over.
6. In Google Ads, check the consent status in each conversion action’s diagnostics a few days later.

The full five-minute test, with what to look for on Meta and other platforms, is in does your cookie banner actually reach your pixels?

Common problems

• Banner shown, but pixels fire anyway: the banner doesn’t write to the Customer Privacy API, or the pixel’s permissions are set to “Not required” without Consent Mode code inside.
• Consent Mode default arrives after GA4 loads: the default must be the first thing in the data layer.
• Everything granted by default worldwide: use a region-specific default, or the visitor’s real choice from Shopify.
• Meta and TikTok ignore Consent Mode: Consent Mode is Google-only. Other platforms must be blocked or allowed by the pixel permission or by GTM triggers that check consent.
• Old scripts in the theme: a forgotten gtag or Meta Pixel snippet in theme.liquid bypasses everything.

Frequently asked questions

Does Shopify support Consent Mode v2?

Shopify stores the visitor’s choice in its Customer Privacy API and passes it to pixels. Its Google app applies it to Google tags. If you use GTM, you map Shopify’s analytics and marketing permissions to the four Consent Mode signals yourself, as shown above.

Do I need a cookie banner app on Shopify?

Shopify’s own banner is enough for many stores. Use an app if you need more design control, TCF support or detailed cookie categories, and check that it writes to the Customer Privacy API. Don’t run two banners at once.

Why doesn’t my custom pixel see the consent from my banner?

GTM in a custom pixel has its own data layer and never sees Consent Mode updates made on the theme. It only knows the choice through init.customerPrivacy and the visitorConsentCollected event, which is why the code above is needed.

Does Consent Mode affect attribution?

Yes. Mismatched consent between the store and the checkout is a common cause of purchases in Direct or Unassigned. See Shopify purchases attributed to Direct or Unassigned.

Consent Mode v2 is included in every one of my Shopify tracking packages, from the Starter package at 1,300€. If you’re not sure your current setup respects consent, book a free 30-minute call.