Postscript after Reject: what loaded on two Shopify stores

What we tested

Store K was captured on 2026-10-20, 10:55-10:57 UTC+8. Store R was captured on 2026-10-21, 09:39-09:43 UTC+8. Both exits were direct from the US with no proxy, recorded as US-VA. The browser was headless Chrome, a clean profile each run, en-US, timezone America/Los_Angeles. Each store had a Fresh run, a Reject run, and an Accept run.

Store K's Osano banner is labeled Accept / Deny Non-Essential. Home: banner, wait 4 seconds, click, wait 12 seconds, scroll. Then one product page, about 23 seconds, scroll. No add-to-cart. Store R's Osano banner is labeled Accept / Deny. Home used the same timing. The product page waited 8 seconds, then one add-to-cart, a 20 second wait, and about 10 seconds of scroll. No checkout. The first add-to-cart click timed out at 8 seconds. Escape closed the overlay, and the second click added the item. The cart held one item on every Store R run. The Postscript phone popup did not appear. We did not fill it or submit it.

Store K: the loader ran, the SDK did not

The loader file is 2,211 bytes, fetched 2026-10-20. It has no consent check. It appends sdk.bundle.js.

We infer Osano stopped the second script from being inserted. The basis is that the loader itself contains no consent check, so the decision could not have come from Postscript's code.

Store R: nothing from Postscript until Accept, even with an add-to-cart

Each Store R run added one cart item. No run sent a data request to Postscript, including the 20 seconds after add-to-cart. Accept times in the table are milliseconds from the click mark.

The Accept home loader at -20 ms is within timing noise of the click mark. Here the loader never ran before Accept, so we infer Osano held back the loader tag itself. Same basis: the loader file is byte-identical to Store K's and has no consent check.

ps_acorn_storefront_pixel_contract_v1 and ps_acorn_storefront_pixel_ready_v1 were in localStorage on Fresh, Reject, and Accept. Fresh and Reject never requested sdk.postscript.io. We did not identify which script wrote the keys.

What we did not see

Six runs, and neither store's cookie list had a Postscript name.

No run sent a POST to Postscript. That includes Store R after add-to-cart. Postscript's developer docs describe page_view and add_to_cart as events fired for subscribers. The visitor was anonymous and did not subscribe, so subscriber events were not tested.

Both stores used Osano. A banner that leaves the tag in place could still load sdk.bundle.js after Reject. We did not capture that case. We did not check out. Attentive after Reject All on two Shopify stores records a different SMS app, on other stores, behind OneTrust.

Other requests after Reject

Fresh shows nearly the same counts (yofi 9, seel 3, rebuy 4).

Rebuy after Reject is another store's rebuyengine.com capture. Store letters are per-page labels.

Shopify's consent value on Store R

We ran every capture from a US exit in Virginia. Shopify's Customer Privacy API docs say: "For regions that are configured to require consent, non-essential purposes are not allowed by default until consent is given. For other regions, the default behavior is to allow all processing purposes." So the empty strings and marketingAllowed() returning true on Store R may depend on where the visitor is. We did not test from another region, and we cannot see which regions Store R requires consent for.

On Store R the four currentVisitorConsent() strings stayed empty before the click and at the end of Fresh, Reject, and Accept. marketing, analytics, and sale stayed true on all three.

How to check Postscript on your own store

1. Open a regular Chrome window in private mode. Open DevTools, Network tab, Preserve log on.
2. Load the store, click Reject in the banner, then add one item to the cart.
3. Filter for postscript and look for sdk.bundle.js. If it appears before you click Accept, the main SDK loaded after Reject.
4. Repeat in a new private window with no click, then with Accept.
5. In the Console, run currentVisitorConsent() on Shopify.customerPrivacy. Then run marketingAllowed() and analyticsProcessingAllowed().
6. In Application, localStorage, look for keys starting with ps_, including the contract key and the ready key.

For the method, see How to test an SMS tool before Accept.

Setup notes from the official docs

Steps below come from the official docs. We did not verify each one.

1. Postscript installs the SDK as a Shopify theme app embed: Online Store, Themes, Customize, App embeds. The JavaScript embed starts on. Save it. After a theme change, turn it on again or acquisition tools, cookies, and onsite events for automations stop. Source: Embed Postscript SDK via Shopify Theme App Extension, 2026-02-09. Those docs show no consent switch and no region switch.
2. A headless store pastes sdk.bundle.js with its shopId and sends page_view and add_to_cart itself. Sources: Postscript Headless Integrations and the SDK API Reference.
3. Installing Osano on Shopify says to add an osano-shopify snippet, call window.Osano.cm.ready("shopify"), and render it from theme.liquid. Without that, Osano says it does not govern Shopify cookies, scripts, and Pixels. Category map: Personalization to Preferences, Marketing to Marketing, Analytics to Analytics, Do Not Sell to Sale of Data. Also turn off automated cookie-banner settings, remove the Shopify banner, and choose regions that require consent.
4. Theme tags and tag-manager tags follow Osano categories and blocking. Shopify Pixels follow the Customer Privacy API. Source: Shopify and Osano Troubleshooting Guide.
5. Shopify's Customer Privacy API page says regions that are not set to require consent allow processing by default. The sentence is quoted in the previous section.

Not legal advice.

FAQ