Cookie consent banners for online stores: do you need one?

A cookie consent mechanism asks visitors to accept or refuse tracking cookies before analytics and advertising tags run. Stores that sell to people in the European Union, the United Kingdom and a growing list of other places usually need one. This check looks for it.

Why it matters

Analytics and advertising pixels set cookies and collect personal data. Regulators in several regions require consent before that happens, and fines have been issued against stores that ignored it. A banner that appears but does not actually block tags protects nobody.

The check is a prompt to confirm your position, not legal advice. Which rules apply depends on where your customers are.

What the audit looks at

The audit looks for a cookie consent tool or banner on your store.

What usually causes it

• No consent tool installed because the store started with one local market
• A banner that is only cosmetic, with tags still firing before a choice
• A consent app installed for one theme and lost when the theme changed
• A cookie policy page with no way for visitors to change their choice

How to fix it

Add a consent banner that actually gates the tracking scripts. The effort is medium, a theme or template edit that takes an afternoon.

1. Pick a consent platform that supports Google Consent Mode v2 -- without it, Google ads and analytics lose modelled conversions in the EU and UK.
2. Configure it to block analytics and marketing scripts until consent is given, rather than only displaying a notice.
3. Make rejecting as easy as accepting: one click, same prominence. A banner with no visible reject option is not compliant.
4. Test with a VPN set to an EU country and confirm no analytics requests fire before you accept.

On Shopify

1. Shopify ships a privacy banner: Settings > Customer privacy > Cookie banner. Enable it and set the regions it applies to.
2. Under Settings > Customer privacy, set the regions the banner applies to and review the data-sharing settings for each. Then check each tracking app states that it supports Shopify's Customer Privacy API -- an app that does not integrate with it fires regardless of the banner.
3. Verify with the network tab that no marketing requests fire before you accept.

On WooCommerce

1. Install a consent plugin that supports Consent Mode v2 -- a banner that only sets a cookie and shows a message blocks nothing.
2. Map each script to a category (necessary, analytics, marketing) so the plugin can actually hold them back.
3. Verify with the network tab that no marketing requests fire before you accept.

How to check it yourself

1. Open your store in a private window from a region covered by the rules and see whether a banner appears.
2. Before you accept anything, open DevTools, go to Network and check whether analytics and ad requests are already going out.
3. Confirm that choosing "reject" really stops them.

Frequently asked questions

Does every store need a cookie banner?

It depends on where your visitors are and what you track. If you sell to people in the EU or UK and use analytics or ad pixels, you generally need consent first. Ask a lawyer for your case.

What is the difference between a banner and consent mode?

A banner collects the visitor's choice. Consent mode, used by Google tags, adjusts what the tags do according to that choice. A compliant setup usually needs both.

Related checks

• Meta Pixel not firing PageView: how to find out and fix it
• Google Analytics 4 not collecting data: how to check and fix it
• Duplicate Google Analytics 4 tracking: how to find double counting

Further reading

• Google: about consent mode