Shopify cookie banner for UK stores: what it actually needs to do

If you sell to UK shoppers on Shopify, you need a cookie banner that does more than look the part. The banner's real job is to control what loads: analytics and advertising tags should wait until the shopper agrees. This guide covers what that means in practice, how Shopify's tools handle it, and how to check yours.

The rules in brief

PECR: the cookie rule

The Privacy and Electronic Communications Regulations (PECR), regulation 6, cover storing or accessing information on a user's device. That includes cookies, local storage, pixels and similar technologies. The general rule is that you must give clear information and get consent, unless the cookie is strictly necessary to provide the service the user asked for.

Strictly necessary typically covers things like the shopping basket, checkout, security and keeping someone logged in. Analytics, advertising pixels, remarketing and session recording are generally not strictly necessary.

UK GDPR: the standard for consent

PECR borrows its standard of consent from UK GDPR. Consent must be freely given, specific, informed and an unambiguous, clear positive action. In cookie terms, the ICO's guidance reads that as:

• No pre-ticked boxes for non-essential categories.
• No implied consent from scrolling, continuing to browse or closing the banner.
• Nothing non-essential before a choice. Tags shouldn't fire while the banner is waiting.
• Rejecting should be as easy as accepting. The ICO has publicly pressed website operators on this point. A prominent "Accept all" next to a buried "Manage settings" is the classic problem.
• Easy to change your mind. Withdrawing consent should be as easy as giving it.

What changed with the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 amended PECR. It raised the maximum fines to UK GDPR levels and introduced some limited exceptions to the consent rule, including for certain analytics used to improve a service, subject to conditions such as clear information and a simple way to object. These changes are being brought in in stages, and they don't cover advertising or cross-site tracking. Check the ICO's current guidance before relying on any exception. For most shops, ad pixels still need opt-in consent.

Your Shopify options

Shopify's own cookie banner

Shopify provides a built-in consent banner, managed in the admin under the customer privacy settings. You choose which regions see it. It records choices in Shopify's Customer Privacy API, which Shopify's own tracking and app pixels respect. It's free and tightly integrated, though it offers less design and category control than dedicated apps.

Third-party consent apps

Apps such as Pandectes, Consentmo, Cookiebot and CookieYes offer more options: cookie scanning, detailed categories, auto-generated cookie lists, consent logs and Google Consent Mode v2 settings. If you choose one, check that it:

• writes the choice to Shopify's Customer Privacy API, so Shopify's pixels follow it
• supports Google Consent Mode v2, with all four signals and a denied default
• can block scripts that don't go through Shopify, such as hard-coded tags
• lets you set UK visitors to opt-in

Whichever you pick, use one banner. Two consent tools fighting each other is a surprisingly common cause of broken tracking.

The settings that matter

1. Region: make sure the banner shows to visitors in the United Kingdom, not just the EU. Many apps default to "EU only" or GDPR regions, and the UK is sometimes a separate tick box.
2. Opt-in mode: UK visitors should see an opt-in banner where nothing non-essential loads until they choose, not a "notice only" banner.
3. First-layer buttons: "Accept all" and "Reject all" side by side, with equal visual weight, plus a "Manage preferences" option.
4. Categories: at least necessary, analytics, marketing and preferences, with plain-English descriptions.
5. Re-open link: a "Cookie settings" link in the footer or a small floating icon.
6. Google Consent Mode v2: switch it on and check the mapping (Analytics to analytics_storage; Marketing to ad_storage, ad_user_data and ad_personalization). Our Consent Mode v2 explainer covers how this works.
7. Cookie policy link: point it to a page listing the cookies your store actually uses.

The part most banners miss: scripts that ignore it

A banner can only control what goes through it. On Shopify, the usual leaks are:

• Hard-coded tags in theme.liquid, such as Meta Pixel, GA4 or TikTok pasted straight into the theme
• App embeds from review, pop-up, affiliate or chat apps that load their own trackers
• GTM tags without consent checks. Non-Google tags don't read Google Consent Mode.
• Custom pixels in Settings › Customer events whose privacy permission doesn't require consent

Our guide to Meta Pixel firing before consent shows how to find and fix each of these.

Check your banner in five minutes

1. Open your store in a private window with DevTools › Network open (tick "Preserve log").
2. Don't click the banner. Look for requests to facebook.com/tr, /g/collect, TikTok or Pinterest, and check Application › Cookies for _ga, _fbp or _ttp.
3. Click Reject all, reload and browse a product page. Nothing non-essential should appear.
4. In a fresh private window, click Accept all. Tracking should now work.

The 10-minute consent audit has the full version with the Google Consent Mode checks.

Don't forget the paperwork

• Cookie policy: list the cookies you found, what they do, who sets them and how long they last. Some consent apps generate this from a scan, but check the result against what you saw in DevTools.
• Privacy policy: name the third parties that receive data (for example Google and Meta).
• Records: keep a note of your banner configuration and when you tested it. Some apps keep consent logs too.

Common questions

Can I just show a notice saying "we use cookies"?

Not for non-essential cookies under the general PECR rule. A notice without a real choice, or one that assumes consent if the visitor keeps browsing, doesn't meet the UK GDPR consent standard as the ICO describes it.

Do I need consent for Shopify's own cookies?

Cookies Shopify needs to run the basket and checkout are generally treated as strictly necessary. Shopify's analytics and marketing cookies are categorised as such and follow the Customer Privacy API. Check Shopify's own cookie documentation for the current list.

Will a banner hurt my analytics?

Some visitors will reject, so GA4 will show fewer users and purchases than your store records. That's expected. Our guide to why GA4 doesn't match Shopify explains how to tell normal consent loss from broken tracking.

This article is technical guidance, not legal advice. Platform menus change; check the vendor's current documentation if a setting has moved.