Does impact.com tracking stop after Reject All on Shopify?

What we ran

We ran one Accept run and two Reject runs on October 15, 2026, from a US connection. This is the same capture as our Rebuy after Reject page; this page looks at the Impact requests. The Searchspring requests from the same visits are on Searchspring after Reject All.

• Store J: Shopify with a OneTrust banner (Accept All, Reject All and Cookie Settings on the first layer). Store letters are labels for this page only.
• Chrome Guest window, recorded with chrome://net-export in raw-bytes mode from before the first page load. The first page request in each run had no cookies.
• Before any click, OneTrust stored C0001:1, C0002:0, C0003:0, C0004:0. Reject All kept C0002 to C0004 at 0.
• We did not arrive through an affiliate link, so there was no Impact click ID to carry.

What Impact sent after Reject All

Each PageLoad body had these fields (names only): CampaignId, PageUrl, EventDate, ReferringUrl, CustomProfileId, UserAgent, ClickId, IntegrationSource, FirstPartyCookie. IntegrationSource was Shopify in every request. ClickId and FirstPartyCookie were empty strings. No request had a TrackingConsent field.

CustomProfileId matched the shopify_client_id cookie in all three runs and did not change when the visitor clicked. On the same visits, the TikTok app pixel sent the same value as external_id, so two vendors received one Shopify visitor ID after Reject.

Each run also sent one PageLoad on the first page, before any click, while OneTrust still stored C0004 (Targeting) as 0.

Why this can happen

Impact's help article on its Shopify plugin says the pixel checks customerPrivacyStatus.marketingAllowed and fires the Page Load API when it is true. The same article warns that a third-party banner which never calls Shopify's setTrackingConsent leaves the Customer Privacy API on its default values, and that Impact reads those defaults.

On Store J, Shopify's own analytics requests after Reject reported "marketing_allowed": true in every payload that carried the field (8 in run 1, 11 in run 2), with gdpr_enforced and ccpa_enforced both false. Shopify's automatic settings treat US visitors as opt-out by default, so true before the click is the expected starting value. What stands out is that it was still true after Reject All. Visitors in regions where Shopify asks for opt-in start from a different default, so this result applies to the US connection we used. No _tracking_consent cookie appeared in any run. The log does not show the OneTrust choice reaching Shopify, and Impact behaved the way its docs describe for that state. How Shopify exposes consent to app pixels is covered in Shopify Customer Events vs the Customer Privacy API.

What Impact's docs say to configure

Steps are from impact.com's and Shopify's official documentation; we have not verified each one.

• Keep Shopify's Customer Privacy settings in place. Impact says the cookie banner region lists decide which consent regime applies to everything that reads the Customer Privacy API, including Impact, even when a third-party CMP draws the banner.
• Confirm your CMP calls Shopify's setTrackingConsent. OneTrust's Shopify app does this through its Consent Mapping step.
• Do not turn on Impact's Consent Mode alongside the Shopify plugin. Impact says the two are not yet compatible.
• Visitors from cashback or loyalty partners with im_rewards=1 in the landing URL are tracked by design. Impact treats the referral itself as consent.
• When consent is denied, Impact says its Conversion API removes CustomerEmail, CustomerEmailSHA256, CustomerId, IpAddress and FirstPartyCookie. It still sends OrderId, the order line items, OrderPromoCode, IntegrationSource, CampaignId, and any ClickId captured before the denial. CustomProfileId is not removed, but it is empty if it was not captured before the denial.

Check your own store (5 minutes)

1. Open a Guest or Incognito window, open DevTools, tick Preserve log, then load the store.
2. Click Reject All, then reload once.
3. In the console, run Shopify.customerPrivacy.currentVisitorConsent(). Note the marketing value.
4. Filter Network for PageLoad. Open a POST to trkapi.impact.com, then Payload.
5. Compare CustomProfileId with the shopify_client_id cookie in Application > Cookies.

If step 3 still says marketing is allowed after Reject, the banner choice is not reaching Shopify, and every app pixel that trusts Shopify will keep sending. Our Reject All still tracking check shows what an after-Reject record holds. For other apps on other stores, see the Shopify Reject All guide.

FAQ

Limits

One store on one day: one Accept run and two Reject runs, from a US connection. We did not arrive through an affiliate link, log in, add to cart, check out, or call the Shopify consent API in the console. We see what left the browser; we cannot see what impact.com or Shopify stored on their servers. Not legal advice.