A cookie banner in the EU answers to two laws and one judgment. The ePrivacy Directive says nothing non-essential may be stored on or read from a shopper's device without consent. The GDPR says what consent is: freely given, specific, informed and unambiguous, by a clear affirmative action. And in Planet49 the Court of Justice ruled that a pre-ticked box is none of those. National regulators have turned this into banner rules: refuse as easy as accept, no consent by scrolling, no cookie wall. This page explains the rule and what a Shopify store does about it. Complimus does not handle cookies or consent; this is the rule explained, not a product page.
In short
- The law: Directive 2002/58/EC, Article 5(3), as amended by 2009/136/EC, applied through national law; Regulation (EU) 2016/679, Articles 4(11) and 7.
- The rule: consent before any cookie or similar storage that is not strictly necessary, after clear and comprehensive information including the purposes.
- Exempt: storage needed to transmit a communication or strictly necessary for a service the user asked for: cart, login, checkout, load balancing, the consent choice itself.
- Valid consent: no pre-ticked boxes (Planet49, C-673/17), no scrolling, refuse on the first layer, withdrawal as easy as consent, and a record of it.
- On Shopify: Customer privacy settings and the built-in banner cover Shopify's own tools; other pixels need a consent app or custom logic.
- No new regulation: the Commission withdrew the ePrivacy Regulation proposal in February 2025, so the directive and national laws stay in force.
1. The rule: consent before storage
Article 5(3) of the ePrivacy Directive allows storing information, or gaining access to information already stored, in a user's terminal equipment only if the user has given consent after clear and comprehensive information, including about the purposes. Two cases are exempt: technical storage or access for the sole purpose of carrying out the transmission of a communication, and storage or access strictly necessary to provide a service the user explicitly requested. The rule turns on the device, not on personal data, so it covers analytics and marketing pixels whether or not they identify anyone.
2. What consent means
The GDPR defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes by a statement or a clear affirmative action (Article 4(11)). Article 7 adds that the controller must be able to demonstrate it, that a request bundled with other matters must be clearly distinguishable and in plain language, that consent may be withdrawn at any time and withdrawal must be as easy as giving it, and that consent is not freely given where a service is made conditional on consent the contract does not need.
In Planet49 (C-673/17, judgment of 1 October 2019) the Court of Justice held that consent to cookies is not valid when given by a pre-ticked checkbox the user must deselect to refuse, whether or not the stored information is personal data; that clicking to join a lottery is not consent to cookies; and that the information due includes the duration of the cookies and whether third parties can access them.
3. Strictly necessary, and everything else
The exemption covers what the service cannot work without: the cart, the login session, checkout, load balancing and the storage of the consent choice itself. Analytics, A/B testing, advertising and social media pixels are not strictly necessary and may fire only after consent. A banner that loads them first and asks later breaks the rule however it is worded.
4. National rules in the main markets
| Country | Law or guidance | What it adds |
|---|---|---|
| France | CNIL guidelines of 4 July 2019 | No consent by scrolling; nothing read or written on the device before consent; the service stays accessible on refusal; consent must be provable and easy to withdraw. In January 2022 the CNIL fined Google and Facebook because refusing cookies took several clicks while accepting took one. |
| Germany | § 25 TDDDG | Storing or accessing information on a device needs consent after clear and comprehensive information, under the GDPR standard; exempt where the sole purpose is transmitting a message or where strictly necessary for a service the user explicitly requested. |
| Italy | Garante guidelines of 10 June 2021 | Technical cookies need information only; scrolling is not consent; closing the banner with the X means no non-technical cookies; cookie walls are unlawful save for an equivalent service without consent; no re-prompt for six months after a refusal; analytics count as technical only with IP masking, aggregation and single-site use. |
| Spain | Article 22.2 LSSI; AEPD cookie guide, May 2024 | Consent after clear and complete information; browser settings may carry it where feasible. The AEPD guide asks for a reject option in the first layer and granular accept or reject at least by purpose. |
| Austria | § 165(3) TKG 2021 | Providers state which personal data they process, the legal basis, purposes and storage period; collection only with active consent after clear and comprehensive information; transmission and strictly necessary storage are exempt. |
The other member states transpose the same Article 5(3); their regulators publish guidance along the same lines. The Commission withdrew its 2017 proposal for an ePrivacy Regulation in February 2025, so the directive and the national laws above remain the rules.
5. What a Shopify store does in practice
Shopify's Customer privacy settings (Settings, then Customer privacy) set data collection per region; in the regions configured, the UK and the EEA by default, non-essential data is collected only after consent. The built-in cookie banner is on by default for UK and EEA markets and governs Shopify's own tools, including Shopify Pixels. A third-party consent app can replace it, as long as the regions match in both places. Pixels installed by hand or by apps may need that app or custom logic that reads the Customer Privacy API, which records the shopper's choice and exposes the analytics, marketing, preferences and sale-of-data flags.
- Load nothing non-essential before the choice, and keep strictly necessary cookies out of the banner.
- Offer accept and reject on the first layer with equal weight; no pre-ticked boxes, no consent by scrolling.
- Describe the purposes, the cookie lifetimes and the third parties that can read them.
- Make withdrawal as easy as consent, for example a footer link that reopens the banner, and keep a record of each choice.
- Check every pixel added by an app or a tag manager against the consent flags. Our free cookie banner checklist turns these points into a list to tick for the live store.
For the four EU rules a product page carries, see the EU compliance apps overview.
Frequently asked questions
Do I need a cookie banner for my Shopify store in the EU?
Can the banner have pre-ticked boxes?
Does refusing have to be as easy as accepting?
Does Shopify provide a cookie banner?
Does Complimus handle cookie consent?