Shopify's own cookie banner and Google Consent Mode: what does it take to connect them without a paid CMP?

It is possible, but it is not automatic, and the mistakes are in the details: the defaults must be set before any Google tag fires, the banner's choice must be passed to Google's consent signals, and checkout must be tested. If you cannot test those three, a paid CMP that handles them may be cheaper than the mistake.

What Shopify provides. Shopify has a customer privacy setting and a banner you can show in chosen regions, and a Customer Privacy API that apps and scripts can read and listen to. It records the visitor's choice. It does not, on its own, tell Google's tags.

What you need to do. First, set Consent Mode defaults before Google tags load: for regions that require opt-in, set the four signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) to denied by default. Elsewhere you may default differently, depending on your own advice.

Second, listen for the visitor's choice and update the signals. When the visitor accepts or declines, a script reads the Shopify consent state and calls the Google consent update with the matching values. In Tag Manager this is usually done with a consent initialisation trigger for the defaults and a custom event or listener for the update.

Third, make your tags respect consent. Google tags with built-in consent checks follow the signals. Other tags need to be configured to require the right consent type before they fire. Do not assume they follow it.

Fourth, test it end to end. Decline everything on a clean browser and check what loads. Accept and check that signals change and tags fire. Do this with a real checkout, because Shopify's checkout runs tracking in its own environment, and your theme code may not reach it.

Fifth, check the server side. If you use a server container, make sure the consent state travels with the event, or the server reads the same choice, so it does not forward events for visitors who declined.

Be honest about the limits. This is an engineering job with legal consequences, and the right regional setup depends on advice you should take yourself. If you do not have someone to build and test it, use a tool that does.

DataCops includes a TCF 2.2 banner from your own domain with Google Consent Mode v2 on by default and checks the saved choice on the server before every send, including the Shopify paid order, logging skips. It does not make you compliant, and if you keep Shopify's banner you set Consent Mode up there.

Do you currently load Google tags through Tag Manager, Shopify's Google app, or both?