Shopify Customer Privacy API does not block scripts

Not legal advice

This article describes how Shopify's Customer Privacy API behaves as a consent recording and signaling surface for themes and apps. It is not legal advice, not a Shopify support document, and not a guarantee that any configuration meets GDPR, CPRA, or other rules. Confirm Shopify's current docs before you ship a change. Admin labels and API names move. Last updated September 22, 2026.

Short answer

Shopify's Customer Privacy API lets themes and apps read whether a visitor has given consent for categories such as marketing and analytics. It records that choice and exposes it. It does not, by itself, stop every script, pixel, or theme app embed from loading. If an app injects a tracker on page load without reading the API, or reads the API after the request already left, cookies and requests can still fire before Accept.

This page covers that API limit. The Shopify pixel testing guide and the pre-consent audit checklist cover the full storefront pass: banner, embeds, reject hold, and the evidence table. Load the shop in a clean browser, leave the banner alone, and inspect the network and cookies. Then walk Reject All and Accept All in separate profiles.

The expectation merchants start with

Merchants turn on Shopify cookie consent or the Customer Privacy settings and expect every theme script, app, and pixel to wait. The API is the consent-state interface those surfaces can read. A block happens when theme code, pixels, and apps consult that state and gate their own loads.

Shopify's Customer Privacy API docs, checked September 22, 2026, say the API applies consent decisions to Shopify-managed surfaces such as pixels, audiences, and checkout. App pixels and custom pixels can declare the purposes they require. The pixel manager then loads those pixels when the visitor has granted each required purpose. That path covers pixels registered with Shopify. Theme Liquid, theme JavaScript, theme app embeds, and apps that inject their own script tags still need their own check.

What the API does

The API collects and stores the visitor's consent preferences. Merchants configure region-aware privacy settings in the admin. Theme JavaScript and participating apps can read the result after the storefront loads the consent-tracking API.

Current storefront calls, as documented on September 22, 2026, sit on window.Shopify.customerPrivacy after Shopify.loadFeatures loads consent-tracking-api. The documented reads include marketingAllowed, analyticsProcessingAllowed, preferencesProcessingAllowed, saleOfDataAllowed, and currentVisitorConsent. A visitorConsentCollected event fires when consent changes. setTrackingConsent records a choice the visitor made. Re-read Shopify's Customer Privacy API page before you copy a call into a theme. Names change.

Those docs also say Shopify collects the GPC signal for data-sale opt-out in regions configured for that opt-out, and that setTrackingConsent cannot override that collection. That line is about Shopify's consent record. Confirm the live page, then prove theme embeds with the network log. A Shopify privacy banner writes the same consent state. Other loaders see the choice only if their code asks.

What still loads

A marketingAllowed value of false is the API state at the moment you read it. Scripts that never call the API, or that fire before the read, still send requests. Read the runtime audit versus CMP guide when banner copy and the wire disagree. The rows below are places to look. They are not a verdict on any vendor.

Test the live storefront

Test the public hostname customers open. An admin preview can miss the theme and the apps that the live theme loads. Keep each consent action in its own clean profile.

1. Open a clean browser profile. Load the homepage and one product URL. Do not click the banner.
2. In DevTools, list cookies and the Network log. Mark marketing or analytics requests that appear before any Accept click.
3. Optional: after the Customer Privacy API has loaded, read marketingAllowed, analyticsProcessingAllowed, and currentVisitorConsent in the console. Use the method names from Shopify's current docs. Write the values next to the request list. A false read is the API state. The request list shows whether tags waited.
4. Click Reject All, or the equivalent control. Treat the click as done only when the banner state or a preference value changes. Navigate once. Check whether marketing requests stay quiet on the next page.
5. Open another clean profile. Accept All. Record the vendors that appear. This visit is the baseline for an accepted load. If the reject visit matches it, reject did not change the wire.
6. Package the files and send them to the theme or app developer. For the full banner, embed, and reject-hold table, use the pre-consent audit checklist and the Shopify pixel testing guide.

Evidence pack

Label screenshots fresh, reject, or accept. Include the cookie table, the request URLs, which apps or embeds you suspect, timestamps, and the theme name if you know it. ConsentProbe ties findings to the request, the cookie, and the screenshot. A banner screenshot alone does not show whether a pixel fired before Accept.

DIY compared with a saved audit

Two URLs in DevTools can show a tag that loads before Accept. A saved audit stores the same scenarios with linked evidence.

Share a labeled storefront pack

Run ConsentProbe on the public storefront URL and send the evidence pack to your developer or agency, next to the pre-consent audit checklist. A free US-baseline visit does not produce an EU or California conclusion. This page is not legal advice.

FAQ

Related guides

The Shopify pixel testing guide and the pre-consent audit checklist are the full pass. The reject leftovers page covers the reject click. The free versus paid guide says what a US-baseline file can support.

• Testing Shopify Pixels Before Consent
• Pre-consent audit checklist: what to verify before Accept
• Pre-Consent Cookie Audit: A Storefront Checklist
• Reject All Still Tracking: What to Check After You Say No
• What does a free US-baseline cookie audit prove vs paid EU or California scans?
• Runtime Audit vs CMP: What Each One Measures
• ConsentProbe methodology
• Pricing and listed regional products