A store that sells into Europe has to treat visitors differently by region. A visitor from Germany may need to be asked before analytics and advertising services load, while your home market may follow other rules. Which rules apply to your business in which country is a question for your legal counsel. Our part is to make the store capable of following them.
Technically that means three things. The banner appears where it is required and in the language of the market. The default state for each region is set before any tag loads. Every script and pixel follows the state the visitor chose.
Shopify supports regional settings for this, and we align them with the markets you run in Shopify Markets. The market setup itself is described on the Shopify internationalisation page.
We do not give legal advice and we do not promise legal compliance. We deliver a setup that does what your counsel specifies, and the evidence that it does.
Measurement across markets works when each market passes its own consent state with every event and the tracking is built the same way everywhere. The reports then differ because the markets differ, and not because the setup does.
The operator of the official CR7 online stores launched two markets at once, the EU with mycr7.eu and Switzerland with mycr7.ch. Switzerland sits outside the EU, with its own tax logic, price lists and a checkout in CHF. As part of the project we built the complete tracking setup with Meta Pixel, GA4 and server-side tracking. The MYCR7 case study reports go-live after 6 weeks and revenue 120% above the earlier level from retail and marketplaces.
How we build measurement is described on the tracking setups page.
Shopify holds the consent state in one central place, the customer privacy interface. The banner writes the visitor's decision there, and apps and pixels read it from there. That applies to Shopify's own banner and to a dedicated consent platform, provided it is connected to the interface.
Pixels for analytics and advertising run in a sandboxed environment that respects the state. In the checkout this is the only route, because no freely embedded scripts run there. Anyone who wants to measure purchases adds their services through this environment. The Shopify checkout page has the details.
The weak point is the theme. A script that was written into the code years ago loads regardless of any consent. We take such scripts out of the theme in Shopify development and bring them under control.
Consent removes part of the sessions from measurement. A second part is lost to browser restrictions and ad blockers, which has nothing to do with consent. The second part can be reduced.
Olakala shows how large it can be. The store's tracking had grown over years and was built largely in the browser. Browser restrictions, iOS updates and ad blockers caused data loss, and conversions reached Meta and Google incompletely. We rebuilt the setup with Google Tag Manager, GA4, Meta Conversions API and server-side tracking. The Olakala case study reports 30% more tracked sessions compared with the previous setup. The figure comes from rebuilding the measurement, not from a change to the banner.
Server-side tracking does not replace consent. The state travels with every event and decides what is passed to the ad channels.
Consent setups rarely fail at rollout. They fail in operation, when a new app brings its own scripts, a theme update restores an old snippet or a second banner becomes active. The documented state then no longer matches the store, and nobody notices.
That is why we test every state separately: refused, partly accepted and fully accepted, each with a network trace and cookie list, in the theme, in the checkout and on the thank-you page, and for each region. After theme and app updates we repeat the test as part of Shopify support.
NICCOS has been a Shopify Plus Partner since April 2022. Our entry in the Shopify Partner Directory shows 19 reviews with a rating of 5.0.
Google Consent Mode v2 is the route by which your store tells Google what a visitor consented to. Four signals control analytics, ad storage, user data and personalisation. Without the signals, Google limits audiences and conversion modelling for visitors from the European Economic Area.
Two things have to be right. The default state is set before any tag loads. After the visitor's decision the state is updated. If the update is missing, the ad accounts receive denied signals permanently although the visitor agreed. We verify the signals in the store and in GA4 and Google Ads.
We embed the consent platform in the theme and connect it to Shopify's customer privacy interface, so apps and pixels read the same state as the banner.
We set the four signals, define the default state per region and verify the update in tag manager, GA4 and the ad accounts.
We record which services run in the store, which data leaves it and to which recipient. This overview is the basis for your privacy policy.
If scripts load before consent or apps ignore the state, the banner changes nothing about the actual data processing.
Reviews, chat, personalisation and ad pixels set their own cookies. Shopify offers an interface apps can query. Whether they do shows in the trace.
No freely embedded scripts run in the checkout. Services are added through the pixel environment, which respects the state.
We build and document the technical side. The legal assessment of your setup lies with your legal counsel.
A setup has to work correctly on refusal too. What may load without consent loads, and nothing beyond it.
Hidden reject buttons and pre-ticked boxes raise the risk. We build banners in which both decisions are equally easy to reach.
Theme, apps, tag manager and checkout pixels use the same state. Two sources are the most common reason for data gaps.
What loads without consent only shows in a network trace. We test every state and document the result.
We record every script, pixel, app and cookie in the store, including the services loaded through apps that appear in no documentation.
Each service is assigned to a category. Your privacy function decides what may run without consent in which region. We implement the decision technically.
The banner is embedded, the categories are mapped, and the state is passed to Shopify's customer privacy interface and to the tag manager.
We define the default state, trigger the update after the decision and verify the signals in GA4 and Google Ads.
Refused, partly accepted and fully accepted, each with a network trace and cookie list. We test theme, checkout and thank-you page.
Services, purposes and recipients go into one overview that keeps privacy policy and processing records maintainable.
A script written directly into the theme ignores any consent.
The default state is set, the update is missing. The ad accounts receive denied signals although the visitor agreed.
Apps that never query the privacy interface set cookies regardless of the banner.
Shopify's banner and a second consent platform are active at the same time and hold contradictory states.
Several ad channels are running
Google, Meta and other channels draw data from the same store. The consent state decides what reaches the ad accounts.
The store has grown over years
Nobody on the team can say which scripts and apps are active. Taking stock then does more than a new banner.
Several countries, one storefront
Different requirements per country can only be met when categories, default state and banner are controlled centrally.
Data gaps without explanation
The figures in GA4 and in the ad accounts differ. The cause often lies in the consent state and not in the measurement code.
You need a legal review
Whether your setup holds up legally is assessed by your legal counsel or data protection officer. We supply the technical facts for it.
Talk to us about the technical sideThere is no measurement yet
Without GA4, a tag manager and defined events there is nothing a consent state would have to control. The measurement build comes first.
To tracking setupsOld scripts sit in the checkout
As long as the checkout has not moved to the pixel environment, any consent logic only reaches as far as the cart.
To Shopify checkoutThe format depends on whether you first want to know what happens in the store or the change is already decided.
For stores with a banner where nobody can prove what loads before and after consent.
Ends with a list of findings that your legal counsel can read without us.
For stores introducing a consent platform or moving from Shopify's banner to a dedicated solution.
Ends with a setup in which theme, apps and checkout read the same state, evidenced in a trace.
For stores in which apps, pixels and theme versions change regularly.
Every round ends with a service inventory that matches the store as it is.
Every figure appears in the case study, where you can verify it.
Groundies, MYCR7 and Gusti Leder are three of thirteen projects we have published with starting point, delivery and result.
We record scripts, apps and pixels and show you in a network trace what loads before and after consent. Afterwards you know what has to change.
NICCOS
The page could not be loaded.
Please reload the page. If an update has just gone live, this will load the latest version.
