If you prefer to install Cookiebot through Google Tag Manager (GTM) rather than using the Shopify app directly, this is possible but requires a specific setup to work correctly with Shopify's architecture.
Important
The Cookiebot for Shopify app is the recommended method for most users. The manual GTM installation is intended for users who already have a direct Cookiebot account and wish to continue using it on Shopify. If you are starting fresh, install the app instead.
The critical requirement: GTM must be in theme.liquid
GTM must be installed directly in your Shopify theme.liquid file. Do not add GTM through a Shopify Custom Pixel or a third-party Shopify app.
Shopify Custom Pixels run inside a sandboxed iframe. Scripts inside this sandbox cannot communicate consent state to the main page, which means Google Consent Mode will not work and your tracking data will be unreliable.
Correct installation order in theme.liquid
The order of scripts in your <head> tag matters. Use this sequence:
- Google Tag Manager container snippet
- Cookiebot CMP script (with your CBID)
- Shopify Customer Privacy API sync code
Note
Cookiebot must load after GTM so that it can communicate consent state to GTM tags. Do not reverse this order.
Enabling the Shopify Customer Privacy API
Without the Customer Privacy API sync, Shopify will not receive consent decisions from Cookiebot. Add the sync code to your theme.liquid after the Cookiebot script. Verify it is working by running in your browser console:
window.Shopify && window.Shopify.customerPrivacy— should return an object, not undefined.window.Shopify.customerPrivacy.currentVisitorConsent()— should return consent values matching the user's choices.
Using the Cookiebot GTM tag template
In GTM, use the official Cookiebot Consent Mode tag template (available in the GTM Community Template Gallery) to fire consent updates. Do not add a manual gtag('consent', 'default', {...}) snippet to your theme if you are using this template — the template handles the default state automatically. Having both will cause duplicate consent declarations and may result in incorrect consent signals.
Comments
0 comments
Please sign in to leave a comment.