VaferA cookie banner either enforces the choice or it decorates the page. You can find out which yours does in about five minutes, with nothing but your browser's developer tools. No tooling, no vendor claims — just watching what the browser actually sends.
The test, step by step
1. Open your store in a private window
A normal window remembers an earlier consent choice, so no banner appears and the test proves nothing. Private/incognito starts clean.
2. Open the Network tab before you touch anything
Right-click → Inspect → Network. Reload the page. In the filter box, type a tracker you use — google-analytics, facebook, tiktok, klaviyo.
3. Look BEFORE clicking the banner
You are in an opt-in region (or simulating one)? Then before you click anything, there should be no requests to those hosts. If collect calls to Google Analytics or tr calls to Facebook are already flowing, your banner is asking a question whose answer doesn't matter.
4. Accept, and watch them start
Click accept. The same filter should now fill with requests. If nothing changes, your banner isn't wired to anything at all.
5. Reject, and check the cookie jar
Reopen preferences, reject, then go to Application → Cookies (Chrome) or Storage → Cookies (Firefox). The tracking identifiers — _ga, _fbp, _ttp — should be gone. The cart and session cookies should survive; deleting those would break checkout, and no law asks for that.
Reading the results honestly
| You saw | It means |
|---|---|
| No tracker requests before consent, requests after accept | Blocking genuinely works |
| Tracker requests before any click (opt-in region) | The banner is cosmetic — the pattern EU regulators have fined |
| Cookies still present after reject | The choice is recorded but not enforced on the device |
_shopify_y present before consent in the EU | Shopify's own Customer Privacy API isn't being written correctly |
The one thing this test can't catch everywhere
Scripts pasted directly into your theme code execute while the page is still parsing — before any consent app has loaded. No tool can un-run them, whatever its marketing says. If step 3 shows a tracker firing instantly on a store with a working consent app, a hard-coded theme tag is the usual culprit, and the fix is moving that tag into the consent tool's tagging convention.