Most Shopify stores in Europe have a cookie banner. Far fewer have a banner that actually controls their tracking. In audits, I regularly find GA4, Meta or TikTok firing before the visitor clicks anything, or ignoring a refusal on the checkout. Here is the five-minute test I use, what each result means, and how to fix what fails.
What you need
- Google Chrome, with a private (incognito) window for each test.
- A European location, or a VPN set to a European country, so the banner shows.
- The browser’s DevTools (right-click → Inspect), with the Network and Application tabs.
Minute 1: before any choice
- Open a private window, open DevTools on the Network tab, check “Preserve log”, then load your home page.
- Don’t touch the banner.
- In the Network filter, type each of these and note what you see:
collect(GA4),facebook.com/tr(Meta),analytics.tiktok.com(TikTok),googleadservicesorgooglesyndication(Google Ads). - In the Application tab, under Cookies, look for
_ga,_fbp,_gcl_auand_ttp.
Pass: no Meta or TikTok requests, no advertising or analytics cookies. GA4 requests are acceptable only if you chose advanced Consent Mode, and then they must carry gcs=G100 (open the request and look at its parameters).
Fail: any request to Meta or TikTok, any _fbp or _ga cookie, or GA4 requests with gcs=G111.
Minute 2: refuse
- Click “Reject” (or “Refuse all”).
- Browse two or three pages, open a product, add it to the cart.
- Check the same filters and cookies again.
Pass: nothing new to Meta or TikTok, no tracking cookies. GA4 requests, if any, still carry gcs=G100.
Minute 3: the checkout, still refused
- Go to the checkout and fill in the contact step with a test email.
- Check the Network tab again.
This is the step most setups fail. The checkout runs pixels, not theme scripts, so a banner that only blocks scripts in the theme does nothing here.
Pass: no Meta, TikTok or Google Ads requests on the checkout.
Minute 4: accept
- Open a new private window and load the store.
- Click “Accept all”.
- Browse a product page.
Pass: GA4 requests now carry gcs=G111, the _ga, _fbp and _gcl_au cookies appear, and Meta’s requests to facebook.com/tr start. If nothing fires after acceptance, your banner is blocking too much, and you are losing data from visitors who agreed.
Minute 5: check what Shopify knows
Open the Console tab and type:
Shopify.customerPrivacy.currentVisitorConsent()It should return the choice you just made, for example { analytics: "yes", marketing: "yes", preferences: "yes", sale_of_data: "yes" }. Do the same in the refusal window: you should see "no". If the values are empty or don’t match the banner, your banner doesn’t write to Shopify’s Customer Privacy API, which is why pixels and the checkout ignore it.
Reading the gcs parameter
| gcs | Ads storage | Analytics storage |
|---|---|---|
| G100 | Denied | Denied |
| G101 | Denied | Granted |
| G110 | Granted | Denied |
| G111 | Granted | Granted |
No gcs at all on a GA4 request means Consent Mode isn’t set up for that tag.
What failures usually mean
| Symptom | Likely cause | Fix |
|---|---|---|
| Tags fire before any choice, on the theme | Scripts hardcoded in theme.liquid or added by an app outside Customer events | Remove them and move tracking to pixels |
| Theme respects refusal, checkout doesn’t | Banner doesn’t write to the Customer Privacy API | Use an integrated banner, or call setTrackingConsent |
| Custom pixel fires regardless of choice | Pixel permission set to “Not required” with no consent logic inside | Require consent on the pixel, or add Consent Mode code |
| Meta fires after refusal | Meta app’s data-sharing settings, or a Meta tag in GTM with no consent trigger | Check the app’s permissions; add a consent condition to Meta tags |
No gcs on GA4 hits | No Consent Mode default | Add the default before GTM loads |
| Nothing fires after acceptance | Pixel only reads consent at load and misses the update | Subscribe to visitorConsentCollected |
The full fix, with code for the theme and for custom pixels, is in Consent Mode v2 on Shopify with the Customer Privacy API.
Frequently asked questions
Does Shopify’s cookie banner block all pixels?
It controls pixels managed through Customer events, according to each pixel’s permissions. Scripts hardcoded in the theme or injected by apps outside Customer events aren’t controlled by it.
Should a purchase still work after rejecting cookies?
Yes. The checkout must work normally after a refusal. Only tracking stops. Place a test order after refusing to confirm it.
Why does my app pixel fire before consent?
Check the app’s own consent settings and the pixel’s permissions in Customer events. Some apps let you choose how they behave before a choice is made, and the defaults aren’t always what your legal team expects.
Why this matters beyond compliance
If the test fails and you want to rebuild the setup properly, see how to set up a cookie consent banner on Shopify.
A banner that leaks is a legal risk. A banner that blocks too much is a data problem: if accepted visitors aren’t tracked, your ad platforms optimize on a fraction of your sales. Both show up in the numbers: compare GA4 purchases with Shopify orders, as explained in why GA4 shows fewer purchases than Shopify.
Consent is one of the eight areas of my Shopify tracking audit (from 800€), and Consent Mode v2 is included in all my Shopify tracking packages. Not sure what your results mean? Book a free 30-minute call.