How do you test whether a Shopify storefront honors Global Privacy Control?

Not legal advice

This article explains a storefront test for whether a Shopify shop appears to change cookies and third-party requests when Global Privacy Control is on versus off. It is not legal advice, not a CPRA guarantee, and not a certificate that any shop honors GPC under California law. ConsentProbe reports are technical observations. They do not replace counsel.

Last updated September 23, 2026. The GPC definition and the enable steps are on the Global Privacy Control test guide. This page is the Shopify paired protocol.

Short answer

To test whether a Shopify storefront honors Global Privacy Control, run two clean visits to the same shop URL: one with GPC off, with no Sec-GPC header, and one with GPC on. Do not click Accept or Reject unless the plan says so. Record cookies, storage, and third-party ad or analytics requests on both runs, plus screenshots of any banner or GPC-detected UI. If the GPC-on visit still shows the same sale or share style pixel fan-out as GPC-off, the storefront is not gating those scripts on the signal.

Shopify's Customer Privacy API can record consent preferences. It does not automatically block theme, app, or pixel scripts when Sec-GPC is present. The API limits guide covers that boundary. A free US-baseline ConsentProbe scan is not a GPC conclusion. Use California or GPC scenarios when the claim is regional. This page is testing guidance, not legal advice and not a CPRA guarantee.

Why a Shopify shop needs its own GPC check

GPC is a browser signal. The W3C Global Privacy Control specification describes Sec-GPC on the HTTP request, and some browsers also expose navigator.globalPrivacyControl in page JavaScript. A Shopify storefront still loads theme Liquid, app embeds, customer events, and pixels. Those pieces may never read the header.

Banner text or a policy line that says the shop honors GPC is a claim. The paired visits are the check. The GPC versus CMP claims guide is the mismatch write-up when the UI says the signal was detected and the network still matches the GPC-off visit.

Reject All and GPC are different controls. Reject All is a click on the banner. GPC is a header the browser sends without that click. The Shopify Reject All guide owns the click path. Keep this page on the signal.

Prep the two Shopify visits

Use a production or staging shop URL you control. Note the theme and the apps you expect to see, because the failure usually sits in one of those installs. Do not walk a Shopify Admin menu in this write-up. Menu names change. Confirm the current Customer Privacy API and pixel privacy docs when you need the admin side.

A California conclusion needs a California context or ConsentProbe paid California or GPC scenarios. A free US-baseline visit teaches report format. The free versus paid guide states that split.

Paired protocol: GPC off, then GPC on

Change only the signal between the two runs. Keep the URL, the navigation depth, and the observation window the same. Confirm Sec-GPC: 1 on the document request before you treat a file as GPC-on. A missing header means the profile did not send the signal.

An optional third pass opens a collection or product after the GPC-on home load, to see whether suppression holds. Label it GPC-on and write the second URL on the file.

How to read the diff

Line the hosts up before you write a sentence about the signal. A vendor in both A and B, with a similar request spread, did not use the signal. A cleaner B file is partial wiring. Some tags waited, and some did not. If A is already full of marketing requests before any choice, send it to the Shopify pre-consent checklist and the general pre-consent checklist.

Save the cookie table and the request list for each label. Strip query values and session tokens before you share a HAR. Mark a comparison sheet illustrative when it is not a capture from this shop.

Shopify failure modes to look for

These are configuration patterns on a storefront. They are not a claim that Shopify as a platform ignores the signal. Check the live theme and the installed apps, then confirm current Shopify docs, because install paths move.

• Theme Liquid or a snippet injects a pixel on every page, with no read of Sec-GPC.
• App embeds and customer events wait on a CMP click, and they do not read the GPC signal.
• The Customer Privacy API state changes somewhere in the stack while Network still shows the sale or share style load. See the API limits guide.
• The CMP shows a GPC-detected message after the pixels have already fired. That mismatch pattern is on the GPC versus CMP claims guide.
• Hard-coded Meta, Google, TikTok, or similar scripts sit outside the CMP and never see the header.

What to put in the evidence pack

Label every file GPC-off or GPC-on. Include the cookie table, the pixel hostnames you want engineering to review, screenshots of the banner and of the network panel, the timestamp, the shop URL, and how GPC was enabled. If the document request carried Sec-GPC: 1, keep a screenshot or a redacted HAR line that shows the header.

ConsentProbe maps a finding to a request, a cookie, or a screenshot under the scenario name. The evidence pack guide lists the hand-built fields. A banner crop without the request list does not show whether the signal changed the page.

DIY on Shopify or a ConsentProbe pack

Both columns are technical records. ConsentProbe compares GPC off with GPC on on a storefront URL and attaches findings to requests, cookies, and screenshots. The CMP still collects the click choice.

FAQ

Limits of this page

This page explains a Shopify storefront protocol for GPC off versus GPC on. It is not legal advice, not a CPRA guarantee, and not a certificate that any shop honors Global Privacy Control under California law. ConsentProbe reports stay tied to requests, cookies, and screenshots. A free US-baseline scan remains a format pass, not a GPC conclusion.

Related guides

Open the GPC test guide for the signal itself, the API limits guide before you treat Customer Privacy as a firewall, and the Reject All guide when the question is the banner click.

• GPC vs CMP Claims: How to Spot a Mismatch
• What is Global Privacy Control, and how do you test it on a storefront?
• Shopify Customer Privacy API does not block scripts
• How do you test a Shopify cookie banner's Reject All button?
• Shopify pre-consent checklist: what to check before Accept
• Pre-consent audit checklist: what to verify before Accept
• What does a free US-baseline cookie audit prove vs paid EU or California scans?
• What belongs in a cookie consent audit evidence pack?
• Which cookie consent test should you run first?
• ConsentProbe methodology
• Pricing and listed regional products