By platform

Cookie Policy Generator for Shopify

Written for Shopify checkout, Shopify Payments, the app ecosystem and the customer privacy API.

Generate your cookie policy Read the cookie policy guide

Shopify stores run more third-party cookies than their owners realise, because each app that touches the storefront brings its own. The cookie policy is where that gets written down honestly, and Shopify’s customer events page is where you find out what is actually running.

A Shopify store is not one data flow, it is about a dozen. Checkout collects name, address, phone and payment token; Shopify Payments runs fraud analysis; Shop Pay stores card details for reuse across merchants; the customer accounts system holds order history; and every app you install adds its own collection, usually with its own processor and its own cookies.

That app layer is what most Shopify privacy policies get wrong. Reviews, upsell, loyalty, subscription, back-in-stock and abandoned-cart apps all read customer data through the Shopify API, and several of them place third-party scripts on the storefront. A policy that names only Shopify is describing a fraction of the processing actually happening.

Shopify gives you real tooling for this. The customer privacy API carries consent state to apps and pixels, the Customer Privacy settings can block tracking until consent, and the built-in policy fields render at /policies/privacy-policy and are linked automatically from checkout. Using them properly is the difference between a policy that is published and one that is enforced.

What a cookie policy for a Shopify store has to cover

Shopify’s own cookies - _shopify_y, _shopify_s, cart, secure_customer_sig - split into strictly necessary and analytics
Channel-installed pixels from the Google & YouTube and Facebook channels
App-injected scripts: reviews, chat, loyalty, upsell, back-in-stock
How the customer privacy API gates collection, and what happens when consent is refused
Consent lifetime and the route back to change preferences

Shopify’s Customer events page lists every web pixel registered on your storefront, including ones added by apps you have forgotten. It is the fastest reliable inventory for building the cookie table.

How a Shopify store actually moves personal data

Checkout and order data

Name, email, shipping and billing address, phone and order contents, processed under contract. Shopify processes it on your behalf, and separately as a controller for fraud prevention and platform security.

Shop Pay and accelerated checkouts

Shop Pay, Apple Pay, Google Pay and PayPal Express each collect through their own interface and hand back a token. The customer’s payment details go to the provider, not to you, and the policy should say so rather than implying you store cards.

Storefront analytics and the Meta pixel

Shopify’s own analytics, Google Analytics 4 through the Google & YouTube channel, and the Meta pixel through the Facebook channel all set identifiers on the storefront. Under UK and EU rules these need consent before firing.

App-installed scripts and web pixels

Reviews widgets, loyalty programmes, live chat, upsell popups and back-in-stock alerts inject scripts that set their own cookies and send data to their own vendors. Each is a separate recipient.

Abandoned cart and email marketing

Capturing an email at checkout and then sending a recovery email is direct marketing. In the UK and EU it needs either consent or a correctly-applied soft opt-in, and the checkout marketing checkbox has to be unticked by default.

Customer accounts and Shopify’s new login

Passwordless customer accounts move identity handling to Shopify, which changes who holds the authentication data and belongs in the recipients section.

Fulfilment and shipping carriers

Address data goes to carriers and to any third-party logistics provider, plus customs data for cross-border orders - which is a transfer as well as a disclosure.

Third parties the draft will ask you about

Shopify Inc. · Shopify Payments (Stripe) · PayPal · Klarna · Shop Pay · Klaviyo · Judge.me or Loox · Gorgias · Google Analytics 4 · Meta · ShipStation

The rules that apply

Shopify Terms of Service

Merchants must publish a privacy policy that meets applicable law. Shopify provides the policy fields and links them from checkout, but the content is your responsibility.

Shopify Protect and fraud analysis

Fraud scoring means Shopify processes order data for its own purposes as well as yours, which is a disclosure and, in the EU and UK, potentially an automated-decision question.

Customer Privacy API and consent tracking

Shopify’s consent framework gates when apps and pixels may collect. If it is not configured, apps typically default to collecting immediately.

App Store data-access declarations

Every app you install declares the customer data it reads. That list is the starting point for your recipients disclosure.

Payment card industry obligations

Shopify Payments and third-party gateways handle card data so you do not store it - but your policy still has to describe the hand-off accurately.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

Publishing the document on Shopify

Paste it into Settings → Policies
Shopify hosts privacy policy, refund policy, terms of service, shipping policy and contact information as first-class fields. They render at /policies/<name> and are linked automatically from checkout.
Add the links to your footer menu
Checkout links are not enough for a crawler or a visitor who never reaches checkout. Add the policy pages to the footer menu under Content → Menus.
Wire consent into the customer privacy API
Use a consent app or the privacyBanner API so that Shopify passes consent state to pixels and apps instead of letting them collect immediately.
Audit installed apps and web pixels
Settings → Apps and Customer events list what is running. Reconcile that list against your recipients and cookie table.
Untick the checkout marketing consent box for EU and UK markets
Settings → Checkout → Marketing options. Pre-selection is a valid configuration in some markets and not in others.
Re-check after every theme or app change
A new app is a new recipient and usually a new cookie. The policy goes stale the moment the app list changes.

Where this usually goes wrong

Using the Shopify sample policy unedited

Shopify’s template is a scaffold with placeholder text. It does not know which apps you installed, which markets you sell to, or which payment providers you use - and merchants routinely publish it with the placeholders still in place.

Not listing the apps that read customer data

Every app with customer or order scope is a recipient. The app list in your admin is effectively a first draft of your sub-processor list.

Pixels firing before consent in the UK and EU

Installing the Facebook or Google channel drops a pixel on every storefront page. Without the customer privacy API wired into your banner, it fires on page one regardless of consent.

A pre-ticked marketing checkbox at checkout

Shopify lets you set the checkout marketing consent checkbox to pre-selected. In the UK and EU that is not valid consent, and it contaminates the whole list.

No cookie policy despite a dozen app cookies

The default Shopify policy set has no cookie policy, so most stores publish none - while running review widgets, chat and retargeting that each set their own.

Ignoring the storefront’s own cookies

Shopify sets _shopify_y, _shopify_s, cart and secure_customer_sig by default. Some are strictly necessary and some are analytics, and the distinction belongs in the table.

Frequently asked questions

Does Shopify provide a privacy policy?

It provides a template with placeholders and a hosting field, not a finished document. The template cannot know which apps you run, which payment providers you use or which jurisdictions you sell into - all of which change what the policy has to say.

Where does my Shopify privacy policy live?

At yourstore.com/policies/privacy-policy once you save it in Settings → Policies. Shopify links it from checkout automatically; you should also add it to the footer menu.

Do I need a cookie policy for a Shopify store?

If you sell to the UK or EU, in practice yes. Shopify sets its own cookies, and review, chat, loyalty and retargeting apps add more. A per-cookie table is the disclosure regulators ask for.

Does Shopify handle GDPR for me?

Shopify handles its own obligations as a processor and provides tooling - the customer privacy API, the GDPR webhook endpoints, data requests in the admin. The controller obligations, including the policy, the lawful basis and the consent banner, stay with you.

What about the apps I have installed?

Each one that reads customer or order data is a recipient you should be disclosing, and several place cookies on the storefront. The Apps page in your admin is the list to start from.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.