Shopify Cookie Banner, GDPR and CCPA: Which Parts Are Yours

You opened Settings > Customer privacy and found a cookie banner, an opt-out page and a privacy policy, and two questions followed: which of them does your store need, and does switching them on make it compliant? Shopify answers the second one itself. Its privacy help says it does what it can to set you up for success, but there are steps you'll need to take on your own.

This guide draws that line for GDPR and the California Consumer Privacy Act (CCPA): what the platform does, what you switch on, what an app must do, and what stays with you as the business that decides how customer data is used. It is a map of the official sources, not legal advice.

Who Does What: Shopify, You and Your Apps

Shopify's GDPR page puts the split in one sentence: you're generally the controller of your customers' data, and when Shopify acts as a processor, it follows your instructions on how to handle that data. Its data processing addendum (DPA), last updated on July 7, 2026, says the same in contract language: you decide the purposes and means of processing, including the legal basis for it.

The DPA names circumstances where Shopify is a controller too, and the one the rest of this page keeps returning to is the Enhanced Services that run on Shopify Network Intelligence: for those, Shopify is a data controller of your customer data as well, deciding its own purposes and legal basis. What Shopify does there sits outside the processor role.

Two more sentences close the gap. The DPA says Shopify has no obligation to interpret or advise you on your obligations under data protection law, and the Help Center says you have an independent obligation to comply, including obligations that result from your use of Shopify's services. We drew the same platform-versus-merchant line for card data in which parts of PCI compliance are yours on Shopify; privacy splits along the same seam.

Shopify's own summary of where its tools stop is shorter still:

Do GDPR and the CCPA Apply to Your Store?

Neither law starts with where your company is registered. GDPR's Article 3(2) applies to a controller outside the EU when its processing relates to offering goods or services to people in the Union, or to monitoring their behaviour there. Shopify's help puts it more cautiously: if you make goods and services available to individuals in Europe, GDPR might apply to your business.

One figure circulates in two versions. The California Attorney General's CCPA page, read on October 16, 2026, still says a gross annual revenue of over $25 million. The California Privacy Protection Agency lists $26,625,000, effective January 1, 2025, after the inflation adjustment the statute requires.

Use the CPPA figure: the Attorney General's page describes itself as general consumer information, not legal advice or regulatory guidance. Then look again after January 1, 2027, the next date the statute sets for an adjustment.

What Settings > Customer Privacy Controls

Shopify's help lists what you can do there: set up a privacy policy, add a cookie banner, allow visitors to opt out of their data being sold or shared, update your Shopify Network Intelligence settings, and view the geographic storage location of your data. The cookie banner and data sharing are managed per region; the Network Intelligence setting takes effect globally.

In Shopify adminOpen in your store

1. Settings
2. Customer privacy

Zoom

Shopify announced these controls as built-in privacy settings in its Winter '24 Edition. The two-minute announcement below is an overview rather than a walkthrough; the names and steps on this page come from the current Help Center.

What Is On by Default

When you set up a new store, Shopify activates automated privacy settings by default and configures the cookie banner for visitors in the UK and EEA, if you have active markets in those regions. Existing stores can activate the same automation, so the privacy policy updates itself when you change certain settings, such as Network Intelligence.

• Banner in the UK and EEA: on by default for a new store with active markets there.
• Banner elsewhere, such as the US: off by default, because Shopify treats those regions as not requiring opt-in consent for cookie-based data collection — but you can use it in any region.
• Banner on checkout: off by default; you enable it in the Customer privacy settings.
• Updates made by automated privacy settings: logged in your Store activity log.

Shopify's first instruction is to review those defaults and check whether they reflect your business operations and any third-party services integrated with your store. No page we have found lists which states and countries the automation switches on beyond the UK and EEA banner for new stores (see what we looked for and did not find), so read the regions in your own admin rather than assuming them.

Shopify Network Intelligence Changes Shopify's Role

When Shopify Network Intelligence is enabled, Shopify securely uses your customer data together with customer data from other merchants to generate insights that power advanced features it calls Enhanced Services. For that processing, the DPA makes Shopify a controller, and where you or your customers are in the EEA, UK or Switzerland, it states that you must obtain consent for targeted advertising as part of the Enhanced Services, and for cookies, to the extent the law requires.

Shopify's Network Intelligence requirements add privacy-policy disclosures for every store and steps that depend on where your customers are. Where your store or customers are in the UK, EEA or Switzerland, obtain customers' consent to see ads based on their activity in your store, with other merchants and with Shopify, and give them a way to withdraw it.

In US states with privacy laws, give customers a right to opt out of their data being used for "sharing" or "targeted advertising". A merchant outside the United States whose store is available in those states needs to indicate the markets where it operates to activate these tools.

Switching it off has a cost Shopify spells out. These apps and features are deactivated and uninstalled when you disable it:

• Managed payment methods
• Shop channel
• Shopify Audiences
• Shopify Collabs
• Shopify Collective
• Shopify Collective: Supplier
• Shopify Messaging
• Shopify Product Network
• Shopify Search & Discovery

Only the store owner or staff with the Administrator role can enable or disable it, and Shopify's Terms of Service say you can disable it anytime in Settings > Customer Privacy.

In Shopify adminOpen in your store

1. Settings
2. Customer privacy

Zoom

Marketing Consent at Checkout

The Customer privacy page carries two Marketing settings: e-mail and SMS marketing at checkout, which confirms customer marketing preferences during checkout, and double opt-in, which confirms contact details for marketing as an extra layer of consent.

Where the checkbox is preselected is your call. When you turn on email collection, the Regions you choose setting is active by default, and with it no regions are selected — so nothing starts ticked until you pick regions. The alternative, regions recommended by Shopify, keeps the setting in sync with the local law of the customer's country at the time of shopping, and Shopify's help on customer contact information notes it isn't a substitute for legal advice.

In Shopify adminOpen in your store

1. Settings
2. Checkout

Zoom

Consent is captured when the customer ticks the box and selects Pay now on one-page checkout or Continue to shipping on three-page checkout. If marketing consent at checkout is on, the same checkbox has also appeared at customer sign-in since March 23, 2026, with the regions you already set.

The boundary on the other side is GDPR's recital 32: "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." The regional detail, and how Shopify's recommended regions behave, is in does Shopify pre-check the email marketing checkbox at checkout.

What Shopify's Cookie Banner Covers, and What It Doesn't

The banner exists because of one sentence in the EU's ePrivacy Directive, Article 5(3): storing information, or reading information already stored, on a user's device is only allowed once the user has consented after clear and comprehensive information. The exception is storage that is strictly necessary to provide a service the user explicitly asked for. Because it is a directive, it reaches you through each country's national law.

Regulators read that strictly. The European Data Protection Board's cookie banner taskforce recalled in 2023 that, by default, no cookies which require consent can be set without it, and that consent must be a positive action by the user.

What the Banner Governs

Shopify draws the banner's scope in its own words: it governs Shopify-specific tools, including cookies and Shopify Pixels, that help Shopify provide services to you and your customers. The next sentence on the same help page is the one most stores need:

Expect thinner reports once it is on. In the regions where the banner shows, non-essential data is collected only after consent, which Shopify says might reduce the data available for analytics, marketing and personalization.

In Shopify adminOpen in your store

1. Settings
2. Customer events

Zoom

If your ads run through the Facebook & Instagram channel, the next question is what a declined banner switches off for Meta's pixel and Conversions API — our Meta guide answers it in what a customer's consent switches off.

And before you paste a tag into theme code, it is worth knowing which route keeps it inside the banner's reach: where tracking code goes in Shopify compares the app-pixel and custom-pixel routes.

Turning It On and Choosing Regions

1. Publish a privacy policy. Before you can use a cookie consent banner, Shopify requires a published privacy policy.
2. Open Cookie banner in Settings > Customer privacy and pick its regions. The region picker opens a dialog listing all available countries and states.
3. Decide on checkout. Showing the banner on checkout is off by default; without it, customers reach their choices through Cookie preferences in your store's footer menu.
4. Know where it appears. The banner may be displayed on the storefront, cart, checkout and customer account pages to visitors in the configured regions, and customers can reopen it to change their choice at any time.

In Shopify adminOpen in your store

1. Settings
2. Customer privacy
3. Cookie banner

Zoom

Languages need a check of their own. When you add a language, Shopify provides professional translations of the privacy policy, cookie banner and data sharing opt-out page for themes built by Shopify.

Its languages requirements page lists 33 such languages, with no Arabic and no Hebrew. The privacy settings page, read the same day, says the feature supports all 32 languages supported in checkout and themes.

Neither page explains the difference. Before you rely on the automatic text, find your language by name on the languages list — and if your theme isn't built by Shopify, the professional translations aren't promised for it.

What the banner must offer is set by the regulators, not by Shopify. In the EDPB taskforce's report, members confirmed that pre-ticked boxes don't give valid consent, and a vast majority of authorities considered a banner without a refuse option on any layer that has a consent button an infringement. The report states a common denominator of regulators, not a green light from any of them.

You may have read that cookie banners are going away. The European Commission's "Digital Omnibus" proposal of November 19, 2025 would move this processing under GDPR and, in the Commission's words, stop cookies used only for non-risk purposes, like counting website visits, from triggering consent pop-ups. On October 16, 2026 the European Parliament's procedure file showed it awaiting a committee decision: a proposal, not law.

Consent Records: What Shopify Keeps

Where processing rests on consent, GDPR's Article 7(1) says the controller must be able to demonstrate that the person consented. For stores using Shopify's own banner, a Shopify changelog post of May 21, 2025 describes a consent audit log of customer consent preferences given in the past 30 days, and the Customer Privacy API carries a consent ID for checking a visitor's history in that log. Updates made by automated privacy settings are logged in your Store activity log, and keeping records of changes to your policies is your responsibility, Shopify adds.

US Privacy Laws: the Opt-Out Page and GPC

The California texts we read describe no opt-in requirement for adults' cookies (see what we looked for and did not find); their model is a notice at collection plus an opt-out of sale and sharing.

Shopify's tool for the opt-out is the data sharing opt-out page: a dedicated page in your store where visitors opt out of the sale or sharing of their personal data with Shopify and other third parties, and of processing that may count as targeted advertising. When it is on, the form is available to visitors from the configured regions, which Shopify's developer docs say is usually US states.

Whether you need it is a judgement Shopify leaves with you. Its US state privacy laws page says some Shopify services may be considered "sharing" or "targeted advertising" under state laws, that you might also be engaged in selling, sharing or targeted advertising depending on how you operate your store, and that it's up to you to assess your obligations and provide the notices and opt-outs that apply.

One thing California's regulations settle outright: the cookie banner you may already show doesn't do this job.

Setting it up takes three moves, in this order:

1. Publish a privacy policy. Like the banner, the opt-out page needs one first.
2. Turn on the data sharing opt-out page in Settings > Customer privacy. The form is then available to visitors from the regions you configure.
3. Add a link to it in your store menu through the customer privacy feature. Shopify injects an icon next to the link text automatically, and says that icon may be required in jurisdictions where you do business.

In Shopify adminOpen in your store

1. Settings
2. Customer privacy
3. Data sharing opt-out page

Zoom

Note the wording, too. No Shopify page we have found calls the link "Do Not Sell or Share My Personal Information" (see what we looked for and did not find) — Shopify speaks of the data sharing opt-out page and its "Your Privacy Choices" icon. That longer phrase is the title California's statute gives the homepage link, which the regulations place in the header or footer; a business may instead offer the Alternative Opt-out Link or process opt-out preference signals in a frictionless manner.

Global Privacy Control Works Only Where the Opt-Out Page Runs

Global Privacy Control (GPC) is a signal a visitor's browser sends to say "don't sell or share my data". When the GPC header is present, Shopify activates opting out of data sale, sharing and targeted advertising by Shopify and third parties — for visitors in regions where you use a data sharing opt-out page.

Shopify's Customer Privacy API documentation adds that the signal is collected and honoured automatically there and can't be adjusted through setTrackingConsent, that the opt-out is enforced independently from consent, and that opt-outs should be initiated by the customer rather than presented with a banner on page load.

California's regulations make the signal mandatory for a business that sells or shares personal information: it must process an opt-out preference signal that meets their requirements as a valid opt-out request, and a business that does not sell or share isn't required to.

An online business that does must accept the signal and at least one more method:

• the form behind the "Do Not Sell or Share My Personal Information" link;
• the Alternative Opt-out Link;
• or its privacy policy, if it processes signals frictionlessly.

Posting the link doesn't excuse it from the signal.

The Attorney General has enforced this. In August 2022 it announced a settlement with Sephora after alleging the retailer failed to process opt-out requests sent through user-enabled global privacy controls; Sephora agreed to pay $1.2 million in penalties. It is one retailer's case, not a typical fine, but it is why GPC is not a technicality.

Virginia, Colorado and Other States

Shopify's help says state privacy laws might apply to your handling of personal information when residents of those states visit and transact with your store, and that its list of requirements is not comprehensive because those laws are continuously changing. Its February 2025 changelog says the data sale opt-out automation was updated to include US states with laws effective January 1, 2025.

Deletion requests from Virginia or Colorado residents run on a 45-day clock like California's, but each state sets its own test for who is covered — see how a Virginia or Colorado deletion request compares with California's.

Whether you must honour GPC there has a different answer per state: must a Shopify store honour a universal opt-out signal in Virginia or Colorado.

Native Cookie Banner or a Consent App?

Shopify treats third-party privacy apps as an alternative to its Customer privacy settings. The native banner passes consent automatically to the Customer Privacy API, the layer Shopify uses to apply consent decisions to its managed surfaces: pixels, audiences and checkout.

A consent app has to plug into that same layer. Shopify's rule for app pixels is that a third-party tool managing consent must sync it to Shopify through the Customer Privacy API; if it doesn't, your pixels might not fire even after a customer agrees. The regions must match as well: use the same consent regions in Customer privacy and in the app, because when they differ, non-essential data can be processed before a visitor consents.

So the choice turns on what tracks your visitors. No Shopify page we have found says the native banner blocks cookies, scripts or app embeds added by hand or by apps (see what we looked for and did not find).

If everything arrives through Shopify's channels and pixels, the native banner already governs it. If you or an app put code into the theme, or you want something a listing names — a cookie scanner, consent logs, IAB TCF — the table shows what seven apps in the Shopify App Store's Cookie consent category said about themselves.

The two tests above are not columns: whether an app syncs consent through the Customer Privacy API and uses the same regions is something to confirm on its listing or with its developer before you install. If records older than 30 days are your reason, look for consent logs in the plan columns.

If Google tags are part of your stack, check one more thing: Shopify says you need to configure customer privacy settings correctly for consent to reach Google and for data to be usable for personalized advertising. How that signal travels is covered in Consent Mode v2 for Google tags on Shopify.

Which Privacy Setup Fits Your Store?

The verdict at the top answers one signal at a time. Your store is a combination — where your customers are, how tracking gets onto it, how far back you need consent records — and these five questions put the answers together into one route, with the settings to switch on.

Access and Deletion Requests

Shopify's help is direct about whose duty this is: as a Shopify merchant, you're responsible for complying with the privacy and data protection laws that apply to your business. GDPR has a processor assist the controller in answering requests, and California's statute has a service provider cooperate with the business; in both, the answer to the customer stays with you. The full split is in does Shopify handle customer data deletion requests for you.

Where the Requests Live in Your Admin

1. Open Customers and select the customer who made the request.
2. For an access request, click More actions > Request customer data. The data appears on the customer's profile page and, if you're the store owner, is also sent to your email.
3. For a deletion request, click More actions > Erase personal data instead. The request covers your store and any apps and channels you've installed.

In Shopify adminOpen in your store

1. Customers

Zoom

Only the store owner or staff with the required customer permissions can complete these requests, and you may need to verify the customer's identity before processing them, as permitted or required under applicable law.

What Erase Personal Data Leaves Behind

• Order facts stay. What was sold, and the date and time of the sale, remain visible in your admin.
• The profile isn't deleted. Erasing a customer's personal data is different from deleting a customer profile.
• Shop and Shop Pay data stays. The request doesn't erase data Shopify receives through the customer's own relationship with Shopify; the customer goes through the Shop app or privacy.shopify.com for that.
• Pre-authorized payments stop. For a customer with active pre-orders or subscriptions, the remaining payments aren't charged and subscription contracts are canceled — Shopify says you incur a loss on those partial sales if the customer doesn't pay the remaining amount before the request.
• Apps get the same request. It is sent to every installed app that might have the customer's information; to confirm deletion, Shopify's help on choosing apps says you check with the app's developer directly.

One more line is easy to miss, because it points outside Shopify altogether:

The timing changed this year. Shopify's developer changelog says that as of March 23, 2026, erasure requests are no longer held for 180 days after the customer's most recent order: they are processed 10 days after the request was submitted, regardless of when that order was placed.

Those 10 days are also your window to cancel a request. The exception is a recipient of a scheduled gift card, whose request stays pending until the gift card is delivered.

Shopify's own pages don't yet agree. Its app privacy law compliance page, read on October 16, 2026, still describes the older hold for customers with a recent order, while the changelog entry is dated and later. Plan on the changelog's 10 days, and if an app developer works from the older page, send them the changelog entry.

How Long You Have to Answer

Shopify's request tools work the same whichever law a request comes under; the law decides how long you have.

Why one Shopify erasure route meets two different clocks is the subject of does a CCPA deletion request work like a GDPR one on Shopify.

What Your Apps Must Do for You

Apps are bound from Shopify's side. Every app distributed through the Shopify App Store must subscribe to three compliance webhook topics — customers/data_request, customers/redact and shop/redact — and must respond to data subject requests regardless of whether it collects personal data. Shopify also requires public apps to provide the same privacy rights for all personal data, wherever the person is located.

Access is gated, too. An app with access to customer or order data receives a redaction webhook with the IDs it needs to delete, and Shopify approves a public app for protected customer data if the requested data is the minimum its functionality needs; custom apps have levels 1 and 2 without review, except that a custom app created in your admin gets level 2 — name, address, phone or email fields — only on the Grow plan or higher.

Since March 2026, Settings > Apps shows which apps have access to sensitive customer data or other personal data. What an app can see, field by field, is in what customer data a Shopify app can access.

Your part is at the edges. 48 hours after you uninstall an app, Shopify sends its developer a request to erase all your customers' personal information the app collected during installation. No page we have found describes what happens to an erasure request for a custom or unlisted app that doesn't use the compliance webhooks (see what we looked for and did not find), so for such an app, confirm deletion with whoever built it.

And if an app still loads tracking through a script tag, note the date: Shopify stops injecting script tags into storefronts on March 1, 2027. Its replacements are app embed blocks and web pixels, and web pixels run in a sandbox that respects customer privacy permissions.

What the Automated Privacy Policy Leaves to You

You can draft the policy yourself or click Use automated policy to apply Shopify's template text, which updates automatically as your settings change. The template is built from Liquid variables: six that fill in store details such as your address and the opt-out page link, and nine conditions such as whether you sell to the United States or Europe, use the cookie banner or have Network Intelligence on. Shopify says many required disclosures are already included, but there are some things it can't automate that you need to review and add.

In Shopify adminOpen in your store

1. Settings
2. Policies

Zoom

For a store or customers in the UK, EEA or Switzerland, Shopify's GDPR compliance guide lists what to add. The law adds the rest:

• The legal basis for each of the purposes you process personal data for.
• Contact details for your data protection officer, if you've appointed one, and for your representative in the EEA, UK or Switzerland if you have no establishment there.
• If Network Intelligence is on and you use Enhanced Services: Shopify says you must link to Shopify's Consumer Privacy Policy — a link its Network Intelligence requirements ask of every store with it enabled — and to its privacy portal.
• The recipients, or categories of recipients, of the personal data — GDPR's Article 13 asks for them at the time data is collected.
• For California, if the CCPA covers you: what you collect and why, given at or before the point of collection, and an update of the policy at least once every 12 months.
• Practices the template doesn't describe — each app and pixel that receives customer data is worth checking against the text.

Shopify's help on store policies is plain about the limits: the automated templates are for informational purposes only, aren't legal advice and don't guarantee compliance, and automation doesn't replace your responsibility to identify missing information or to notify customers of changes when required. Keeping records of changes to your policies is yours as well.

Set It Up in This Order

Steps one and two apply to every route; three and four go by region — the banner for the UK and EEA, the opt-out page for US states whose laws call for it, both if you sell to both; step five only to the consent-app route. Step six belongs before any new pixel goes live, not after it.

The Bottom Line

Shopify gives you more privacy tooling than most merchants use, and it is honest about where that tooling ends. The work that stays with you is narrow but real: the regions, the policy text, the code outside pixels, and the answer to each customer who asks.

Frequently Asked Questions