Shopify Meta Pixel GDPR: why a default install often fires before consent

Shopify Meta Pixel GDPR compliance comes down to one toggle. The Shopify Meta channel app, which is the recommended way to install Meta Pixel on a Shopify storefront, injects the pixel script via Shopify's web pixel manager. That manager respects the Customer Privacy API. In theory, the pixel waits for marketing consent before firing.

In practice, most stores never enable the Customer Privacy API in the first place. The toggle lives under Settings, Customer privacy, Cookie banner. If it is off, the entire consent model is off, and the web pixel manager treats every visitor as having consented.

What does a fresh-install Shopify Meta Pixel actually do?

On a new Shopify Plus store with the Meta channel installed and the cookie banner toggle off, here is what happens on the first pageview.

• Theme loads and renders the page.
• Shopify's pixel infrastructure initialises with consent = granted (because the API is off).
• Meta Pixel fires a PageView event to facebook.com/tr immediately.
• Google Analytics 4 (if installed via Google Sales channel) fires a page_view event immediately.

The visitor has had no opportunity to refuse. There is no banner. The first GDPR Article 6 lawful basis check has already been bypassed.

Stores that do have a banner often still leak

Stores running a third-party CMP (Klaviyo Reviews, Cookiebot, Consentmo) frequently leave the Shopify native cookie banner off and rely on the CMP. The CMP gates the scripts the merchant manually configured but cannot gate the Shopify-managed web pixels unless the merchant explicitly wired the CMP to the Customer Privacy API.

What does a correctly gated Shopify install look like?

Two configurations work. Either enable Shopify's native cookie banner (Settings, Customer privacy, Cookie banner), which automatically calls the Customer Privacy API on consent grant. Or run a third-party CMP and explicitly call window.Shopify.customerPrivacy.setTrackingConsent on its accept handler. Both gate the Meta and Google web pixels through the same managed infrastructure.

The wrong configurations are the common ones. A third-party CMP that does not call setTrackingConsent will not gate Shopify-managed pixels. Manually injecting the pixel through theme.liquid bypasses the manager entirely.

Five minute audit

Open your store in a fresh private window. Open DevTools to the Network tab. Filter by facebook. Reload. If you see a request to facebook.com/tr before you interact with any banner, your Customer Privacy API gating is either off or misconfigured. Fix it before the next CNIL or Garante decision lands on a brand like yours.