This guide is not legal advice. It explains the rules and the tools in plain words. Your duties depend on your market, your apps and how you use the data. Ask a lawyer for your store.
Does Shopify analytics need a cookie banner?
For visitors in the EU and the UK, usually yes, unless every tool on the store fits an exemption. Shopify can set up its own banner for these regions.
Shopify's privacy settings can configure the cookie banner automatically for visitors in the UK and the EEA when you have active markets there. In those regions, Shopify says that "non-essential data is collected only after obtaining consent". Outside the configured regions, the banner is not active by default.
Shopify's own reports follow the banner. In the Shopify analytics fields, Sessions are "only counted when visitors consent to cookies through your cookie banner". So a store with a banner sees fewer sessions in Shopify than it gets. Shopify sets the _shopify_analytics cookie, which "contains analytics data for buyer surfaces such as the storefront or checkout", for one year.
What does EU law say about analytics cookies?
Article 5(3) of the ePrivacy Directive covers any storage of information on a visitor's device, and any access to it. Such storage or access needs consent, unless it is necessary for one of the purposes in that article.
The European Data Protection Board (EDPB) explains the scope in its Guidelines 2/2023. It says that storage and access are "only allowed on the basis of consent or necessity for specific purposes set out in that Article". It also says that Article 5(3) "does not exclusively apply to cookies". JavaScript that tells the browser to send information from the device to a server "clearly falls within the scope". Each EU country writes the directive into its own law, so the details differ.
Is there an exemption for audience measurement?
In France and the UK, yes, with conditions. The CNIL and the ICO each describe an exemption for simple analytics. A tool that also follows single people does not fit it.
The CNIL lists these conditions for audience measurement trackers that do not need consent:
- Tell users about the trackers, and let them object.
- Use the data only for audience measurement and A/B testing.
- Do not cross-check the data with other processing, such as customer files.
- Limit the tracker to a single site or app publisher.
- Truncate the last byte of the IP address.
- Limit the lifetime of the trackers to 13 months.
The ICO describes a "statistical purposes" exception, which it also calls the "analytics" exception. It needs "clear and comprehensive information about the purpose, and a 'simple and free' means to object". The ICO also says that it "does not allow you to monitor or track individual visitors to your service".
Ecommerce analytics often goes past counting. A report that joins an order to one customer's visits follows a single person. Check each feature that you use against the conditions, not only the cookie names.
Is cookieless analytics exempt from consent?
Not by default. No cookies makes the case simpler, but the EDPB guidelines are not only about cookies. Your lawyer has to look at what the script reads and sends.
A cookieless tool stores nothing on the device, so a big part of the question goes away. But the script still runs in the browser and sends a request for each page. The EDPB lists routing identifiers, such as the IP address, among the information that Article 5(3) can concern. Many site owners use cookieless analytics without a banner. That is a decision that you take for your store, not a feature that a vendor can give you.