Is your Shopify store firing Meta Pixel before consent?

You installed a cookie banner, so your Meta Pixel should wait until a shopper clicks "Accept". On a lot of Shopify stores it doesn't. The pixel loads the moment the page opens, sets its _fbp cookie and sends a PageView to Meta before the banner has finished drawing.

That matters for two reasons. In the UK, PECR generally requires consent before non-essential cookies and similar technologies are used on a visitor's device, and advertising pixels are about as clearly non-essential as it gets. And it's a sign your tracking setup is fragmented, which usually means your ad data is less reliable than you think.

The good news: you can check it yourself in about five minutes, with nothing more than Chrome.

The 5-minute test

1. Open a private (incognito) window. Close any other private windows first so no old cookies carry over.
2. Open DevTools (F12, or Cmd+Option+I on a Mac) and go to the Network tab. Tick Preserve log.
3. In the filter box, type facebook.
4. Load your homepage and don't touch the banner.
5. Look for requests to connect.facebook.net (the pixel script) and, more importantly, facebook.com/tr (the actual tracking hits). Click a /tr request and you'll usually see ev=PageView in the URL.
6. Now open the Application tab › Cookies › your domain, and look for _fbp.

If you see facebook.com/tr requests or an _fbp cookie before you've clicked anything, your pixel is firing before consent.

Then do the second half of the test: click Reject all, reload, and browse to a product page. There should still be no /tr requests. A pixel that respects "no choice yet" but ignores "Reject all" is surprisingly common.

Why it happens: the four usual culprits

Shopify has a proper consent system: the Customer Privacy API. Shopify's own cookie banner and most consent apps record the visitor's choice there, and Shopify's app pixels read it. The problem is almost always a pixel that doesn't go through that system.

1. A hard-coded pixel in theme.liquid

Someone (a previous agency, a tutorial, you two years ago) pasted Meta's base code straight into theme.liquid. Code in the theme runs on every page load regardless of consent. Shopify can't hold it back because it doesn't know what it is.

How to check: Online Store › Themes › ⋯ › Edit code › layout/theme.liquid, and search for fbq( or fbevents.js. Also check snippets your theme includes.

2. Meta installed twice

The Facebook & Instagram app (Meta's sales channel) runs the pixel as an app pixel that follows Shopify's consent settings. But if there's also a hard-coded pixel, or a Meta tag in Google Tag Manager, that second copy ignores consent and double-counts your events. You'll often see two different pixel IDs, or the same ID firing twice, in the Network tab.

3. Third-party apps that inject scripts

Review apps, pop-up and email-capture tools, affiliate apps and "all-in-one" marketing apps sometimes load their own tracking, including Meta's, through theme app embeds. Check Online Store › Themes › Customize › App embeds and turn off anything you don't recognise, then re-test.

4. GTM with no consent check on the Meta tag

If you run Google Tag Manager in your theme, it's tempting to think Google Consent Mode covers everything. It doesn't. Meta Pixel does not read Google Consent Mode. Setting ad_storage to "denied" does nothing to a Meta tag unless you tell GTM to hold it.

How to fix it

Option A: let Shopify handle it (simplest)

1. Make sure your banner is set to show to UK visitors (Settings › Customer privacy, or your consent app's region settings) and that the consent app writes to Shopify's Customer Privacy API. Most mainstream Shopify consent apps do; check their documentation.
2. Run Meta only through the Facebook & Instagram app.
3. Delete every other copy: hard-coded snippets in theme.liquid, Meta tags in GTM, and any old pixel code in legacy order-status "Additional scripts".
4. If you use a custom pixel in Settings › Customer events for Meta, open its settings and make sure its customer privacy permission requires marketing consent.

Option B: keep Meta in GTM, but gate it

If you prefer GTM, open the Meta tag › Advanced Settings › Consent Settings › "Require additional consent for tag to fire" and add ad_storage. GTM then holds the tag until marketing consent is granted, and fires it when the consent update arrives. This only works if something is setting Google consent states from your banner. Either your consent app supports Google Consent Mode v2, or you sync Shopify's consent to Google yourself. Our Consent Mode v2 explainer covers how that sequence should work.

Option C: Meta's own consent switch

Meta's pixel has a built-in consent command. Calling fbq('consent', 'revoke') before fbq('init', …) holds the pixel until your banner calls fbq('consent', 'grant'):

fbq('consent', 'revoke');
fbq('init', 'YOUR_PIXEL_ID');
fbq('track', 'PageView');
// in your banner's "marketing accepted" callback:
fbq('consent', 'grant');

The pixel script itself still downloads from Meta with this approach. If you want no contact with Meta at all before consent, options A or B are stricter.

Don't forget the server side

If you send purchases through Meta's Conversions API (via the Facebook & Instagram app, another app, or server-side tagging), those events don't go through the browser at all, so a banner can't block them. Check how your integration handles consent and make sure it respects a shopper's "Reject all".

Will fixing this hurt my ads?

You'll see fewer browser-side events from people who reject cookies. That's the point. In practice, broken setups often over-report because of duplicate pixels, so cleaning up can make your numbers more honest rather than just smaller. Meta and Google both have modelling and server-side features designed for consented setups, and they work best with clean, single, consent-aware tagging.

Re-test after every change

Run the 5-minute test again after you fix things, and again every time you install an app or change theme. Apps are the most common way a fixed store becomes broken again. Our free cookie-consent checklist covers the full routine, including Google tags and the "Accept all" side, and this 10-minute audit guide walks through it step by step.

This article is technical guidance, not legal advice. Platform menus change; check the vendor's current documentation if a setting has moved.