Cookie banner in a Shopify store: what GDPR requires

Updated: 11 November 2026

Almost every store uses analytics and ad pixels, which means cookies that need visitors' consent. Here is what a cookie banner in a Polish Shopify store must have, and the most common mistakes.

When you need consent

Cookies needed for the store to work, e.g. the cart and login, need no consent. Analytics cookies (Google Analytics) and marketing cookies (Meta pixel, Google Ads, TikTok) need consent before they are used. This follows from the GDPR and Polish electronic communications law.

What the banner must have

A Reject button as visible as Accept all.
A choice of categories: statistics, marketing, preferences.
No pre-ticked boxes.
A link to the privacy policy.
An easy way to change the decision later, e.g. a small icon at the bottom of the page.
Analytics and ad cookies only start after consent.

Common mistakes

A banner with only an OK or Got it button.
Reject hidden in the settings, while Accept is big and colourful.
A Meta pixel that loads before the visitor clicks anything.
No record of consents, so you can't show who agreed.

Connect the banner to Shopify

Shopify has a Customer Privacy API that Google, Meta and other apps use. A banner that passes the visitor's choice to it makes analytics and pixels respect the consent by themselves. Without it the banner is only decoration.