Shopify Cookie Policy: What to Include, Cookie List and Template

A Shopify cookie policy is a page on your store that explains which cookies and similar technologies your storefront uses, grouped by purpose, with who sets each one, what it does, how long it lasts and how visitors can change their choice. Shopify doesn't write one for you, and Settings > Policies has no cookie policy type, so you publish it as a page in Online Store > Pages and link it from your footer menu and privacy policy.

Shopify's own cookie policy lists the cookies Shopify places on merchant storefronts: nine, in three groups, as of its 9 October 2026 update. The cookies your apps, pixels and tags add are yours to list.

This guide is general information based on Shopify's documentation and regulator guidance, not legal advice. If you're unsure what applies to your business, ask a qualified professional.

Can you use Shopify's own cookie policy?

Not on its own. Shopify's policy covers Shopify's own websites and has a Merchant storefronts section listing the cookies Shopify places for visitors to stores on its platform. Link to it for those cookies. It knows nothing about your apps, the pixels in Settings > Customer events, tags in Google Tag Manager or theme code, or your consent app's own storage, so your page has to cover those.

Cookie policy vs privacy policy vs cookie banner

Shopify requires a published privacy policy before you can use its cookie banner (Configuring customer privacy settings). Our guides to the Shopify privacy policy and the Shopify cookie banner cover those two. This one covers the cookie list between them.

Does a Shopify store need a cookie policy?

If you have visitors in the EU or UK, you need to give them clear information about the cookies and similar technologies your store uses. Neither the ePrivacy Directive nor the ICO's guidance asks for a page with a particular title, but a separate cookie policy page is the usual way to provide it.

EU. Article 5(3) of the ePrivacy Directive, as amended in 2009, allows a site to store or read information on a visitor's device only with consent given after clear and comprehensive information, unless it is strictly necessary for a service the visitor asked for. The EDPB's guidelines on the technical scope of Article 5(3), adopted on 7 October 2024, say this applies whether or not the information is personal data, and they cover tracking pixels and local storage as well as cookies. The EDPB's consent guidelines list the minimum information for informed consent, including the controller's identity, the purpose of each processing operation, the type of data collected and the right to withdraw, and say other controllers relying on the consent should be named.

UK. The ICO's guidance on storage and access technologies, finalised on 29 April 2026, says to tell people which technologies you use, what for, whether third parties store or access information, and for how long (What are the PECR rules?). UK exceptions for some analytics and for adapting how a site looks or works to a visitor's preferences still need clear information and a simple, free way to object, and online advertising has no exception (What are the exceptions?).

Elsewhere. Shopify's cookie banner isn't active by default in regions such as the US, where opt-in consent for cookies isn't required, and Shopify offers a data sharing opt-out page for regions that need one (Configuring customer privacy settings). Rules vary, so check which apply to you. Our Shopify GDPR compliance guide puts the cookie policy in context with the rest of the EU and UK to-do list.

Separate page or privacy policy section?

Both can work. A separate page usually suits a Shopify store, because the cookie list changes whenever you add an app or pixel, it can mirror your banner's categories, and a long cookie table makes a privacy policy harder to read. A store running only Shopify's cookies and one analytics tool could fit everything into its privacy policy. Either way, make the link easy to find: the ICO's compliance guidance asks you to consider how page design affects whether people see the link, and notes that a footer link on a long, dense page is far less visible than one in the header.

What should a Shopify cookie policy include?

Which cookies does Shopify set? The Shopify cookies list for October 2026

Shopify's cookie policy, last updated 9 October 2026, lists these for merchant storefronts (descriptions paraphrased):

Things to know about this list:

• No preferences group. Shopify lists no storefront cookies under preferences; your apps may add some.
• Shop has its own list. Shop Pay, Login with Shop and shop.app use separate cookies, listed under Shop in the same policy.
• Party not stated. Shopify's list doesn't say whether these cookies are first or third party.
• Consent regions. In a February 2026 thread on Shopify's developer forum, Shopify staff said _shopify_analytics doesn't load by default in consent regions until the visitor consents, and that a third-party banner sending the wrong default can make such cookies load early.
• Use the English page. In the same thread, a user found that the Dutch version of the policy didn't mention _shopify_analytics, and staff said they'd asked Shopify's legal team to update it. Regional versions can also show an older "last updated" date.

Which Shopify cookies should you remove from an older policy?

Older templates and some scanners still list cookies Shopify has retired. Shopify's developer changelog announced each of these, and none appears in the October 2026 list:

If your policy still names them, the rest of it may be out of date too.

How do you find every cookie your store sets?

Record each item's name, provider, purpose, duration and category in a spreadsheet as you go:

1. Apps. In Settings > Apps, list every app, then check its listing, help docs or privacy policy for cookies or browser storage. Ask the developer if it doesn't say.
2. Pixels. In Settings > Customer events, list every app pixel and custom pixel. A custom pixel's Customer privacy section shows whether Permission is Required and for which purposes, such as marketing, analytics or preferences (Manage your custom pixels), which is a good first guess at its category. Our Shopify customer events guide covers moving theme scripts into custom pixels.
3. App embeds and theme code. Go to Online Store, click Edit theme, then the App embeds icon to see which apps run on the storefront (Extend your theme with apps). Some apps add code straight into theme files, and Shopify says that code isn't removed automatically when you uninstall (Uninstalling apps). Run your store through ShopOpsy's free Shopify app detector to see which apps' code loads on the storefront, including leftovers from apps you removed.
4. Tag manager. If you use Google Tag Manager, list every tag it fires. It's one script that can load many tools.
5. Browser check. In a private window, ideally from a region where your banner shows, visit your homepage, a product page, the cart and checkout. In Chrome DevTools, open Application > Storage > Cookies and select each origin to see each cookie's name, domain and expiry (View, add, edit, and delete cookies), then check Local storage in the same panel (View and edit local storage). Accept all on the banner, browse again and compare: anything that appears only after you accept belongs in an optional category.
6. Durations. Take them from the provider's documentation. For example, Google says GA4's _ga and _ga_<container-id> cookies last 2 years by default (GA4 cookie usage on websites).

Scanners help, but the EDPB's cookie banner taskforce report notes that the available tools only list cookies and can't check what they're for. It also records the taskforce's discussion of website owners' responsibility to maintain their cookie lists and show that cookies they call essential really are.

Which categories should your cookie policy use?

Use your banner's category names, in the same order. Visitors read your policy to understand what they're agreeing to on the banner. Shopify's Customer Privacy API records consent for preferences, analytics, marketing and data sale or sharing, and Shopify's pixels overview says new pixels require marketing and analytics permissions by default. Our Customer Privacy API guide explains how those choices reach your apps.

Don't file a marketing tool under necessary: the EDPB taskforce lists "inaccurately classified essential cookies" among the practices it examined.

ShopOpsy's consent app, Cookify, coming soon to the Shopify App Store, groups choices into necessary, analytics, marketing and preferences and passes each choice to the Customer Privacy API. It saves the visitor's choice in the browser's local storage, the kind of similar technology your policy should mention.

Shopify cookie policy template

Copy the text into a new page, delete what doesn't apply and replace every [bracketed placeholder]. The Shopify rows reflect Shopify's list of 9 October 2026; check them before you publish.

COOKIE POLICY
Last updated: [Date]

This policy explains how [Business name] uses cookies and similar
technologies on [store domain]. Questions? Email [contact email].

1. WHAT COOKIES ARE
Cookies are small text files a website saves in your browser. We
also use technologies that work in a similar way, such as local
storage in your browser, and pixels or tags that send information
about your visit to the companies that provide them. In this
policy, "cookies" covers all of these.

2. HOW WE ASK FOR YOUR CONSENT
When you visit from [regions where your banner shows], our cookie
banner asks which optional cookies you allow. Necessary cookies are
always on. [Preferences / Analytics / Marketing] cookies are used
only if you allow them. You can change or withdraw your choice at
any time with the [Cookie preferences] link in our footer.

3. COOKIES WE USE
Each line shows: name | provider | purpose | duration | first or
third party.

3.1 Necessary
These run the cart, checkout and security, and remember your
cookie choice.
- Shopify store cookies, including _shopify_essential, cart and
  localization | Shopify | Run the cart, checkout and store
  sessions | From 1 minute to 1 year | [First party].
  Full list: https://www.shopify.com/legal/cookies
- [Consent storage name] | [Banner app] | Remembers your cookie
  choice | [Duration] | [First party]

3.2 Preferences
These remember choices such as your country or language.
- [Name] | [Provider] | [Purpose] | [Duration] | [Party]

3.3 Analytics
These help us understand how visitors use the store.
- _shopify_analytics | Shopify | Analytics for the storefront and
  checkout | 1 year | [First party]
- [_ga, _ga_<ID>] | [Google Analytics 4, Google] | [Distinguishes
  visitors and keeps session state] | [2 years] | [First party]

3.4 Marketing
These measure our ads and help show you relevant ads elsewhere.
- _shopify_marketing | Shopify | Marketing data for the storefront
  and checkout | 1 year | [First party]
- [Name] | [Tool, company] | [Purpose] | [Duration] | [Party]

4. COMPANIES THAT SET OR READ COOKIES
Their privacy policies explain how they use the information:
- Shopify: [link]
- [Provider]: [link to its privacy policy]

5. CHANGING YOUR CHOICE AND BROWSER SETTINGS
Use the [Cookie preferences] link at any time to change your
choice. You can also delete or block cookies in your browser
settings. If you block necessary cookies, the cart and checkout may
not work.

6. [ONLY IF OPT-OUT RULES APPLY] SELLING OR SHARING DATA
Some of our marketing tools may count as selling or sharing
personal information under [state or country] law. To opt out,
use [link to your data sharing opt-out page].

7. CHANGES TO THIS POLICY
We update this policy when we add, change or remove tools. The
date at the top shows the current version.

8. MORE INFORMATION
For how we handle personal data, see our privacy policy:
[privacy policy URL].

Tips for filling it in:

• Name the cookies. Where a tool sets many, name the tool, list its main cookies and link to the provider's own list.
• Use real durations, from the provider's documentation or the expiry you saw in DevTools.
• Confirm first or third party. Shopify's list doesn't say, so check the domain each cookie is set on in DevTools before you fill in that column.
• Delete what you don't use, including section 6 if no opt-out rules apply.
• Test before you promise. Only say optional cookies wait for consent once you've checked that they do; our cookie banner guide shows how.

How do you add a cookie policy page in Shopify?

Settings > Policies offers seven written policies: return, privacy, terms of service, shipping, legal notice, contact information and subscription. None is a cookie policy (Adding store policies), so publish yours as a page.

Step 1: Create the page

Following Shopify's pages guide:

1. In your Shopify admin, go to Online Store > Pages.
2. Click Add page.
3. Enter a title, such as "Cookie policy", and paste your policy.
4. In Visibility, keep Visible selected.
5. Click Save.

To set a clean address, open Search engine listing preview and edit the URL handle, for example cookie-policy. If you change it later, Shopify redirects the old address by default.

Step 2: Add it to your footer menu

Following Shopify's menu guide:

1. Go to Content > Menus and click your footer menu.
2. Click Add menu item and enter "Cookie policy".
3. Click Search or paste a link, choose Pages and select your page.
4. Click Add, then Save menu.

Shopify advises selecting the page from the list rather than pasting a URL, which can break the link.

Step 3: Link it from your privacy policy and banner

• Privacy policy. In Settings > Policies (or Settings > Customer privacy > Privacy policy if it isn't listed there), open the privacy policy and link to your cookie policy. If Use automated policy is on, you have to turn it off to edit the text, and the policy then no longer updates automatically when you change your store settings (Adding store policies).
• Banner. Shopify's cookie banner guide doesn't describe a cookie policy link field. If your consent app has a field for policy links, add the page there.
• Translations. If you sell in several languages, translate the page too.

When should you update your cookie policy?

A cookie list is accurate only on the day you check it. Update the policy, and your banner categories if needed, when you:

• install or uninstall an app, including any code it left in your theme;
• add, remove or change a pixel or a tag manager tag;
• switch themes;
• start selling in a new region where your banner shows;
• see a new "Last updated" date on Shopify's cookie policy or a cookie change in Shopify's developer changelog.

The ICO's compliance guidance asks for regular reviews, more often if you make frequent changes, and suggests checking from a device separate from your own network, removing technologies you no longer need, and recording what you found and when you'll check next. Our suggestion: a full check every quarter and a quick one after each app or pixel change, updating the "Last updated" date and making sure your banner, cookie policy and privacy policy name the same tools.

Common Shopify cookie policy problems

Want it written for you?

ShopOpsy's Cookie Policy Setup is a one-time $59 drafting service. We write the policy from the cookies, pixels and tags your store loads, grouped into necessary, analytics, marketing and preferences, and email it as plain text ready to publish as a page. The Legal Page Bundle writes all five policy pages together, so your privacy and cookie policies describe the same tools. Both are drafts, not legal advice.

Frequently asked questions

Is a cookie policy enough without a cookie banner?

Not for visitors in the EU, and usually not in the UK. The policy informs people, but in the EU optional cookies such as analytics and marketing need consent before they're set, and collecting that choice is the banner's job. In the UK, marketing cookies still need consent, and the exceptions for some analytics and appearance cookies still require a simple, free way to object.

Sources

• Cookie Policy — Shopify, accessed 26 October 2026.
• Adding store policies — Shopify Help Center, accessed 26 October 2026.
• Configuring customer privacy settings — Shopify Help Center, accessed 26 October 2026.
• Creating and editing pages — Shopify Help Center, accessed 26 October 2026.
• Add, remove, or edit menu items in your online store — Shopify Help Center, accessed 26 October 2026.
• Pixels overview — Shopify Help Center, accessed 26 October 2026.
• Manage your custom pixels — Shopify Help Center, accessed 26 October 2026.
• Extend your theme with apps — Shopify Help Center, accessed 26 October 2026.
• Uninstalling apps — Shopify Help Center, accessed 26 October 2026.
• Customer Privacy API — Shopify developer documentation, accessed 26 October 2026.
• _shopify_y and _shopify_s cookies will no longer be set — Shopify developer changelog, accessed 26 October 2026.
• Hydrogen April 2026 release — Shopify developer changelog, accessed 28 October 2026.
• _tracking_consent, _landing_page and _orig_referrer cookies will no longer be set — Shopify developer changelog, accessed 26 October 2026.
• The _ab cookie will no longer be set — Shopify developer changelog, accessed 26 October 2026.
• The _shopify_country cookie will no longer be set — Shopify developer changelog, accessed 26 October 2026.
• _shopify_analytics and other cookies loaded; even without consent — Shopify developer community, accessed 26 October 2026.
• Directive 2002/58/EC (ePrivacy Directive), consolidated text of 19 December 2009 — EUR-Lex, accessed 26 October 2026.
• Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive — European Data Protection Board, accessed 26 October 2026.
• Guidelines 05/2020 on consent under Regulation 2016/679 — European Data Protection Board, accessed 26 October 2026.
• Report of the work undertaken by the Cookie Banner Taskforce — European Data Protection Board, accessed 26 October 2026.
• Guidance on the use of storage and access technologies — Information Commissioner's Office, accessed 26 October 2026.
• What are the PECR rules? — Information Commissioner's Office, accessed 26 October 2026.
• What are the exceptions? — Information Commissioner's Office, accessed 26 October 2026.
• How do we comply with the PECR rules? — Information Commissioner's Office, accessed 26 October 2026.
• View, add, edit, and delete cookies — Chrome for Developers, accessed 26 October 2026.
• View and edit local storage — Chrome for Developers, accessed 26 October 2026.
• GA4 cookie usage on websites — Google Analytics Help, accessed 26 October 2026.