Vafer

vafer.app / blog

Shopify's Customer Privacy API: what it actually controls

September 17, 2026 · The Vafer team · not legal advice

Shopify ships a native consent system — window.Shopify.customerPrivacy — and it is the only correct way to control Shopify's own analytics cookies and sandboxed Web Pixels. A consent app that ignores it leaves _shopify_y and _shopify_s running whatever the shopper chose.

What it controls

  • Shopify's analytics cookies — _shopify_y, _shopify_s and the marketing attribution cookies
  • Web Pixels — pixels installed through Shopify's sandboxed framework only fire for consented purposes
  • Checkout tracking — the consent state carries into checkout, where apps cannot inject scripts at all

The call that does the work

window.Shopify.customerPrivacy.setTrackingConsent({
  analytics:    false,
  marketing:    false,
  preferences:  false,
  sale_of_data: false
}, callback);

Four keys, matching the categories a banner offers. sale_of_data exists for US-style laws — it is what the “Do Not Sell or Share” link should flip, and it is also the correct response to a Global Privacy Control signal.

What it does not control

Scripts injected directly into the page — a Meta pixel added by an app's script tag, a TikTok snippet pasted into the theme — are invisible to it. Shopify gates what runs inside its own framework; everything outside needs a consent tool doing genuine script blocking. The two mechanisms are complements, not alternatives: write the API for Shopify's side, block scripts for everything else.

Quick check: run Shopify.customerPrivacy.currentVisitorConsent() in the console before and after a consent choice. If it never changes, your banner isn't talking to Shopify.

Frequently asked

Does the Customer Privacy API block third-party apps?

It gates Shopify's own analytics cookies and pixels running in Shopify's sandboxed Web Pixels framework. A third-party script injected directly into the page is outside its reach — that is what a consent app's script blocking is for.

What are the four consent keys?

analytics, marketing, preferences and sale_of_data. A consent tool maps the shopper's category choices onto these keys and calls setTrackingConsent, and Shopify handles its own cookies accordingly.

Why did my _shopify_y cookie disappear after rejecting?

That is the API working: when analytics consent is withdrawn, Shopify stops setting and stops honouring its analytics identifiers.

When a shopper says no, it means no.

Vafer is a cookie consent app for Shopify that holds known trackers until consent, deletes cookies on reject, and shows you proof it's working. Free in early access.

Join the waitlist

Keep reading