Consent in Shopify Checkout — What You Need to Know

Shopify's Checkout Extensibility framework restricts what third-party scripts can do inside the checkout. This affects how consent banners and tracking work during the purchase flow.

Why the consent banner does not appear in checkout

Shopify prevents third-party scripts — including consent banners — from injecting visual elements into the checkout page. This is a security and PCI compliance measure enforced by Shopify, not a limitation of Cookiebot.

The Cookiebot for Shopify app is aware of this restriction and does not attempt to display the banner in checkout. This is intentional and correct behavior.

How consent is enforced in checkout

Even though the banner does not appear in checkout, consent is still enforced through Shopify's Customer Privacy API:

• When a visitor gives or declines consent on your storefront (before entering checkout), that decision is synced to Shopify's Customer Privacy API.
• Shopify then uses this stored consent state to govern tracking behavior throughout the checkout — including which pixels and analytics scripts fire.
• You do not need the banner to appear in checkout for this consent enforcement to work.

Manual installation and checkout

If you have installed Cookiebot manually (not via the app) and are experiencing issues with tracking in checkout, the most likely cause is that the Customer Privacy API sync has not been configured.

Note that Shopify completely blocks custom code injection in checkout pages for third-party developers. The Customer Privacy API sync approach (applied on standard store pages) is the supported solution.

Third-party apps interfering with checkout

If a third-party booking or checkout app is reporting errors related to fetch requests being cancelled, this may be caused by Cookiebot's tracking blocker running before consent is given. This is a known 'race condition'.

If you are using the Cookiebot for Shopify app, the app uses a deferred loading approach that is designed to minimise this type of conflict. If you are using a manual installation, ensure the Cookiebot script uses the deferred configuration.