Shopify Consent Mode v2 setup: a practical guide

Most Shopify stores that sell into Europe now show a cookie banner. Far fewer have that banner connected to Google properly. The result is one of two problems: GA4 and Google Ads lose a large share of data for no good reason, or Google receives data without the consent signals it needs to use it.

This guide explains what Consent Mode v2 is, how consent works inside Shopify, the three ways to set it up, and how to check that the signals actually reach Google. It is a technical guide, not legal advice: what your banner should ask for is a question for your legal advisor.

What Consent Mode v2 is

Consent Mode is how Google tags learn what a visitor agreed to. Version 2 uses four signals, each granted or denied:

The last two were added in version 2. For visitors in the European Economic Area, Google does not use data for personalized advertising unless Consent Mode v2 is active and the visitor has consented. That's why so many stores saw remarketing audiences shrink when they had a banner but no v2 signals.

How consent works on Shopify

• Customer privacy settings. In Settings, Customer privacy, Shopify can show its own cookie banner, per region, based on your markets.
• The Customer Privacy API. Every banner, Shopify's own or a third-party app, should record the visitor's choice through this API. App pixels and custom pixels in Customer events then run or wait based on that choice.
• Third-party banner apps. Apps like Pandectes, Consentmo or Cookiebot must be integrated with the Customer Privacy API. If they aren't, Shopify's pixels never learn the visitor's choice.

So there are two separate questions: does Shopify know the visitor's choice, and does Google? Consent Mode answers the second one.

Three ways to set it up

If GA4 purchases come from a custom pixel, the pixel also needs consent handled. Shopify's help center notes that custom pixels need a code snippet to activate Consent Mode v2. See our guide to rebuilding the GA4 purchase event.

The GTM setup, step by step

1. Set defaults before any Google tag loads. Place this above your GTM or gtag snippet in theme.liquid:

<!-- In theme.liquid, before the GTM or gtag snippet -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }

  // Denied by default where consent is required (extend the region list for your markets)
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    region: ['AT', 'BE', 'DE', 'ES', 'FR', 'IE', 'IT', 'NL', 'PL', 'SE', 'GB', 'CH'],
    wait_for_update: 500,
  });

  // Everywhere else
  gtag('consent', 'default', {
    ad_storage: 'granted',
    ad_user_data: 'granted',
    ad_personalization: 'granted',
    analytics_storage: 'granted',
  });
</script>

2. Send an update when Shopify knows the choice. This reads the visitor's choice from the Customer Privacy API on page load and again whenever they answer the banner:

<script>
  function sendConsent() {
    const p = window.Shopify && window.Shopify.customerPrivacy;
    if (!p) return;
    const ads = p.marketingAllowed() ? 'granted' : 'denied';
    gtag('consent', 'update', {
      analytics_storage: p.analyticsProcessingAllowed() ? 'granted' : 'denied',
      ad_storage: ads,
      ad_user_data: ads,
      ad_personalization: ads,
    });
  }

  window.Shopify.loadFeatures([{ name: 'consent-tracking-api', version: '0.1' }], sendConsent);
  document.addEventListener('visitorConsentCollected', sendConsent);
</script>

3. Set consent requirements on other tags in GTM. Google tags check consent on their own. Non-Google tags in the same container, such as Meta or TikTok, need "Require additional consent" set in each tag's Consent Settings.

Check the signals are arriving

1. Network tab. Every GA4 request has a gcs parameter. G111 means ads and analytics storage are both granted, G100 means both denied, and G101 means ads denied but analytics granted.
2. Tag Assistant. Preview the container, open the Consent tab and check the default and update states on page load and after you answer the banner.
3. GA4. Admin, Data streams, your web stream, then Consent settings shows whether consent signals are active for EEA traffic.
4. Google Ads. Tools, Diagnostics shows Consent Mode status and coverage for your conversion actions.

What to expect in your numbers

A correct setup changes your reports, and it helps to know which changes are expected before someone asks why traffic dropped.

• Fewer observed users and sessions from consent regions. Visitors who decline analytics are no longer counted directly. How many decline depends on your banner design and audience.
• Some of the gap comes back as modeled data. With advanced Consent Mode and enough traffic, GA4 and Google Ads estimate part of what they can't observe. Smaller stores may not reach the thresholds needed for modeling.
• Remarketing audiences recover. Once ad_user_data and ad_personalization arrive correctly for visitors who consent, EEA users can be added to audiences again.
• Shopify still has every order. Consent affects tracking, not sales. Keep reporting revenue from Shopify and use GA4 for patterns, as covered in why GA4 and Shopify revenue don't match.

Common mistakes

• Defaults set after tags load. Tags fire before consent is known. Defaults must come first.
• Only two signals. Version 1 setups send ad_storage and analytics_storage only. Add ad_user_data and ad_personalization.
• Banner not connected to Shopify. Pixels in Customer events never fire, or always fire, regardless of the visitor's choice.
• Denied everywhere. Using EEA rules worldwide throws away data from markets where they are not required. Use region-specific defaults.
• Expecting GA4 to match Shopify. With consent required, GA4 will see fewer orders in those regions. That's expected, and our GA4 missing purchases guide shows how to separate it from real breakage.

Server-side tracking doesn't remove the need for consent either. A correct setup forwards only what the visitor allowed, as covered in our server-side tracking guide.

Common questions

Owais Alam

Freelance data and analytics engineer and founder of Good Numbers. Top Rated on Upwork. Specializes in GA4, Google Tag Manager, BigQuery, server-side tracking and Shopify attribution.

More about OwaisLinkedIn