GDPR check for Shopify

Shopify stores often embed tracking via apps, the sales channels (Google, Meta) and the “Customer Events” area — much of this requires consent.

With the Customer Privacy API, Shopify has created its own interface through which the consent status in the shop is managed. For it to work, a consent tool from the Shopify App Store or a custom implementation has to set this status — and the tracking apps in use have to query it. If the chain is broken at one point, pixels load despite a rejection.

The “Customer Events” area (formerly “Additional Scripts” in the checkout) is a common source: pixel snippets stored here often run independently of the consent tool. Since the switch to Checkout Extensibility, native pixels respect the consent status better, but self-inserted custom pixels have to be explicitly connected to the Privacy API.

The Google and Meta sales channels bring their own tags. Consent Mode should be active for the Google channel, and the limited data use mode for the Meta channel — but neither replaces consent, they only limit what happens without it. The privacy policy should name all active channels, apps and the US transfer.

Do not overlook: Shopify itself processes. The shop's own analytics dashboard, the accelerated payments (Shop Pay, Apple Pay, Google Pay), fraud detection and the Shopify Inbox chat widget run independently of the marketing apps. Shop Pay recognises returning customers via a Shopify account — that is more than a technically necessary operation and should be carried along in the consent and data protection assessment.

For a Shopify shop's privacy policy, “complete” means: Shopify Inc. as the platform processor (with a DPA), the payment providers (Shopify Payments/Stripe, PayPal, Klarna …), the shipping/fulfilment service provider, every active sales channel integration (Google, Meta, TikTok, Pinterest), every tracking or marketing app from the App Store, and email/review tools (Klaviyo, Judge.me …). A generator only provides the framework for this — the app and channel list has to be reconciled from your own Shopify admin area.

Is this a risk?

Marketing and analytics pixels may only load after consent under § 25 (1) TDDDG. Shopify's Customer Privacy API and a suitable consent tool must be connected so that pixels respect the consent status. Data flows often go to the USA.

What you can do

• Use a consent tool connected to the Shopify Customer Privacy API.
• Check all tracking apps: do they load before consent?
• Run the Google and Meta channels with Consent Mode or restricted data mode.
• In the privacy policy, name all apps, channels and the US transfer.

Häufige Fragen

What has to go into a Shopify shop's privacy policy?

At minimum: Shopify Inc. as processor, the payment provider used, the shipping service provider, every active sales channel integration (Google, Meta …), every tracking/marketing app and email/review tools. For each service, purpose, legal basis, recipient country and storage period belong in it. The list has to be reconciled from your own admin area — a template text alone is not enough.

Is Shopify's standard cookie banner enough?

Since 2023 Shopify provides its own consent banner connected to the Customer Privacy API. For the German market it should be checked whether it offers a genuine reject option on the first level and whether all tracking apps actually evaluate the status.

Do Shopify apps load trackers before consent?

That depends on the app. Apps that use the Customer Privacy API correctly wait for consent. Older or poorly maintained apps write their code directly into the theme and ignore the consent status — check such apps in the network tab.

What about the checkout?

In the checkout, only technically necessary scripts may run without consent. Marketing pixels in the checkout need the same consent as in the shop; with Checkout Extensibility they are controlled via custom pixels and the Privacy API.

Does Shopify data go to the USA?

Yes. Shopify Inc. is based in Canada (adequacy decision in place), but many connected services — Google, Meta, partly Shopify infrastructure — process in the USA. The transfer belongs in the privacy policy.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.