GDPR check for Shopify

Shopify stores often embed tracking via apps, the sales channels (Google, Meta) and the “Customer Events” area — much of this requires consent.

Is this a risk?

Marketing and analytics pixels may only load after consent under § 25 (1) TDDDG. Shopify's Customer Privacy API and a suitable consent tool must be connected so that pixels respect the consent status. Data flows often go to the USA.

What you can do

• Use a consent tool connected to the Shopify Customer Privacy API.
• Check all tracking apps: do they load before consent?
• Run the Google and Meta channels with Consent Mode or restricted data mode.
• In the privacy policy, name all apps, channels and the US transfer.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.