Choosing a cookie consent app for a UK Shopify store: what actually matters

Search the Shopify App Store for "cookie consent" and you'll get dozens of results, all promising GDPR compliance in one click. Most look alike in the screenshots. What separates them is what they do behind the banner: whether they actually control your tracking, and whether they do it without breaking your analytics.

We're not going to name a "best" app. Features and prices change too often for that to stay true, and the right choice depends on your store. Instead, here's how to evaluate any consent app, with the questions that matter for a UK store. (For what the banner itself must do under UK rules, see our Shopify cookie banner guide.)

First: do you need an app at all?

Shopify has a built-in cookie banner that records choices in its Customer Privacy API. Shopify's own tracking and app pixels follow it. If your store has a simple setup, Shopify's banner may be enough. That means tracking installed only through official sales-channel apps (like Google & YouTube and Facebook & Instagram) or custom pixels, with nothing hard-coded in the theme.

A dedicated app starts to earn its place when you need any of these:

• more control over banner design, wording and categories
• a cookie scanner and an auto-generated cookie list for your policy
• blocking of scripts that don't go through Shopify, such as theme code or app embeds
• Google Consent Mode v2 settings beyond what Shopify's integrations offer
• consent logs or records
• multiple languages and regions

The eight things that actually matter

1. It writes to Shopify's Customer Privacy API

This is non-negotiable. If the app records consent only in its own cookie, Shopify's pixels (including checkout and purchase tracking) won't know the visitor's choice. Depending on configuration, they'll then either track everyone or no one. Check the app's documentation for an explicit statement that it integrates with the Customer Privacy API.

2. Google Consent Mode v2, done properly

Look for support for all four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization). It should set a denied default before Google tags load and send an update on every page for returning visitors, not just on the click. If you use GTM, a published GTM template is a plus. Our Consent Mode v2 explainer covers why the order matters.

3. UK as an opt-in region

Some apps treat "GDPR" as EU-only or make the UK a separate setting. You want UK visitors to get an opt-in banner, where nothing non-essential runs until they choose, and you want to be able to set that explicitly.

4. Equal "Accept" and "Reject" options

The app should let you put "Reject all" on the first layer with the same prominence as "Accept all", with no pre-ticked boxes. Some free tiers lock design options. Check the plan you'd actually use.

5. Script blocking for everything else

Hard-coded Meta Pixels, chat widgets, heatmap tools and app embeds don't go through Shopify's consent system. Ask how the app handles them: auto-blocking, manual rules, or nothing at all. This is where many stores leak, as our Meta Pixel guide explains.

6. A cookie scanner you can check

Scanners help you build an accurate cookie policy, but they miss things. They usually scan without logging in or adding to basket, and often only from one region. Treat the scan as a starting point and compare it with what you see in DevTools. Our guide to writing a cookie policy for an online shop covers what to list.

7. A way to change your mind

A persistent footer link or icon that reopens preferences, and a withdrawal that actually stops tracking on the next page.

8. Performance and support

Every app adds a script. Check it loads quickly and doesn't delay the page. Look at the support channels and how recently the app was updated, because consent requirements and Shopify's APIs keep changing.

Red flags

• "Notice only" or implied consent by default for UK visitors ("By continuing to browse you agree…")
• Compliance guarantees. No app can make your store compliant on its own; what matters is how it's configured and what else runs on your site.
• No mention of the Customer Privacy API anywhere in the documentation
• Consent Mode "v2" that only sets two signals
• Two consent apps installed at once. Remove the old one completely, including its app embed.

Questions to ask before you install

1. Does it write consent to Shopify's Customer Privacy API?
2. Does it set all four Consent Mode v2 signals, with a denied default and an update for returning visitors?
3. Can I set the UK to opt-in, with "Reject all" on the first layer?
4. How does it block scripts that don't go through Shopify?
5. Which features are on the plan I'd use: design, scanner, logs, languages?
6. How do I fully remove it if I switch?

Test before you commit

Install on a duplicate theme if possible, configure it, then run three checks in fresh private windows with DevTools open. Don't trust the app's dashboard; trust what the browser actually does.

Test	Pass if…
Land, don't click	No _ga, _fbp or _ttp cookies; no facebook.com/tr hits; Tag Assistant shows all four signals denied
Reject all, browse and add to basket	Still nothing non-essential
Accept all	Tracking works: gcs=G111, cookies set, Meta PageView sent
Test order with consent accepted	Exactly one purchase in GA4 DebugView

The full routine is in our 10-minute consent audit.

Switching apps safely

When changing apps, uninstall the old one and check its app embed and any theme snippets are gone. Then configure the new one, re-run the tests, and keep an eye on GA4 purchases against Shopify orders for a couple of weeks. A sudden drop usually means something in the consent chain isn't connected.

This article is technical guidance, not legal advice. Platform menus change; check the vendor's current documentation if a setting has moved.