Cookie banners are one of those things every store has and few get right. If you sell to customers in the UK and the EU, the rules are now slightly different in each, and a banner that looks fine can still be non-compliant if it loads tracking before the customer agrees.
This guide covers what changed in the UK in 2026, what still applies in the EU, and how to set up cookie consent properly on a Shopify store.
The Basic Rule
In both the UK and EU, you need a customer's consent before storing or reading non-essential cookies and similar technologies on their device. Essential cookies, such as the ones that keep items in the cart or keep checkout secure, don't need consent.
Marketing and advertising tags, like the Meta Pixel, Google Ads, TikTok Pixel and most retargeting tools, are not essential. They need consent first.
What Changed in the UK
The UK's Data (Use and Access) Act 2025 relaxed the rules for some low-risk cookies. Since 5 February 2026, two types no longer need prior consent in the UK, as long as you give clear information and a simple, free way to opt out:
- Analytics cookies used only to improve your own website or service.
- Functionality cookies that remember preferences such as language or display settings.
The catch: if analytics data is shared with a third party for their own purposes (for example, advertising), the exemption doesn't apply. And the fines went up sharply. Cookie breaches can now cost up to £17.5 million or 4% of worldwide turnover, whichever is higher, instead of the old £500,000 cap.
What Still Applies in the EU
The EU did not make the same change. Under the ePrivacy rules and GDPR, analytics cookies generally still need consent in most EU countries, with a few narrow national exceptions. So if you sell to both markets, the safest setup is consent-first for EU visitors and a clear opt-out option for UK visitors at minimum.
What a Compliant Banner Looks Like
- "Reject all" is as easy as "Accept all": same size, same prominence, on the first layer.
- No pre-ticked boxes for non-essential categories.
- Nothing non-essential fires before a choice. This is the one most stores fail.
- Clear categories: necessary, preferences, analytics, marketing.
- Easy to change your mind: a link in the footer to reopen cookie settings.
- A cookie policy that lists what you use and why.
How Cookie Consent Works on Shopify
Shopify has a built-in Customer Privacy setting and a Customer Privacy API. When set up correctly, Shopify's own tracking and apps that respect the API wait for consent. You can use Shopify's free cookie banner or a consent app that integrates with the API.
The problems usually come from tracking code added outside Shopify's system:
- Scripts pasted into theme.liquid years ago that fire on every page load, ignoring consent.
- Old Google Analytics or pixel snippets left over after switching to an app.
- Apps that don't respect the Customer Privacy API, such as some chat, review or popup apps.
- Google Consent Mode not set up, so Google tags either fire without consent or lose all data.
How to Check Your Store in 10 Minutes
- Open your store in a private browser window, from an EU location or VPN if possible.
- Before clicking anything on the banner, open your browser's developer tools and look at Network requests and Cookies.
- If you see requests to facebook.com, google-analytics.com, doubleclick.net or tiktok.com before consenting, tags are firing too early.
- Click "Reject all" and browse a few pages. Those requests should still not appear.
The Recommended Setup
- Use Shopify's Customer Privacy settings with regional rules for the EU, UK and other markets.
- Move all tracking into Shopify's Customer Events (web pixels) or apps that respect consent.
- Set up Google Consent Mode v2 so you keep modelled conversion data while respecting choices.
- Remove any hard-coded tracking from your theme files.
- Add a "Cookie settings" link in the footer.
Frequently Asked Questions
Do I still need a banner in the UK for Google Analytics?
If GA is only used to improve your own site and you offer a clear opt-out, the UK exemption may apply. But GA data is often linked to Google Ads, which can take it outside the exemption. If you also sell to the EU, keep consent-first for EU visitors.
Is Shopify's free banner enough?
For many small stores, yes, as long as all tracking goes through Shopify's system. Stores with lots of custom scripts often need cleanup first.
Does this apply to US customers?
US rules are different. Several US states require opt-outs for targeted advertising rather than opt-in consent. Regional banner settings let you handle each market correctly.
This article is general information, not legal advice.
Not sure if your tracking fires before consent? I audit Shopify stores, clean up tracking code and set up consent properly, including Google Consent Mode. Get a free quote.
Need a Shopify store built or improved?
Tell me what you need — I’ll respond within 24 hours with a realistic plan and quote.