If you run an ecommerce store, there is a good chance your website is transmitting visitor data to dozens of third-party platforms the moment someone lands on your homepage before they even had a chance to read your privacy policy.
For most merchants, this is not intentional. It is just how tracking tools are configured by default. You install Google Analytics, connect your Meta Pixel, set up Klaviyo, add a few more tools through your tag manager — and without any deliberate decision, your site is quietly sending behavioral data to 40, 50, sometimes 80 different third-party domains on every single page load.
That default setup made sense in a world without meaningful privacy regulation. But that world is over. As US and global privacy laws tighten, enforcement activity increases, and a growing number of plaintiffs firms build businesses specifically around detecting non-compliant tracking, that default setup is becoming a real legal and financial liability.
This article breaks down what the law actually requires, where most Shopify stores fall short without realizing it, and what a proper fix looks like.
The Privacy Law Landscape
California Set the Standard
The California Consumer Privacy Act (CCPA), significantly strengthened by the California Privacy Rights Act (CPRA) in 2020, is the most consequential consumer privacy law in the United States. It applies to any business that collects personal data from California residents and meets at least one of the following thresholds: annual gross revenues over $25 million, data on 100,000 or more consumers or households per year, or deriving 50% or more of annual revenue from selling personal data.
For most ecommerce stores running paid media and analytics, the second threshold — 100,000 consumers — is the one that catches people off guard. If your store gets meaningful traffic, you almost certainly cross it.
Under CCPA/CPRA, businesses are required to:
• Clearly disclose what personal data they collect, how it is used, and who it is shared with
• Give consumers the right to opt out of the sale or sharing of their personal data for advertising purposes
• Honor opt-out signals automatically, including the Global Privacy Control (GPC) — a browser-level signal that users can enable to opt out across all sites at once
• Not use personal data for cross-context behavioral advertising without providing a meaningful opt-out mechanism
• Respond to consumer data access, deletion, and correction requests within defined timeframes
Other States Are Catching Up
California was first, but it is no longer alone. As of 2026, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and several other states have enacted comprehensive consumer privacy laws. The specifics vary — thresholds differ, opt-in versus opt-out requirements differ, and enforcement mechanisms differ — but the common thread running through all of them is consistent: users should have meaningful, actionable control over how their personal data is collected and shared for advertising purposes, and that control should exist before tracking begins.
There is no federal privacy law in the US yet, but the patchwork of state laws is effectively creating a de facto national standard. If you are selling to customers across the country — which most ecommerce stores are — you are subject to multiple overlapping frameworks simultaneously.
The practical implication is straightforward: building your compliance posture around California’s requirements will generally put you in a defensible position across the board. California’s law is the most stringent, and meeting it typically satisfies the requirements of other state laws as well.
Enforcement Is Not Theoretical
Privacy law violations used to feel like a distant risk — something that happened to large enterprises with newspaper-worthy data breaches, not to mid-market ecommerce brands. That has changed.
The California Privacy Protection Agency (CPPA) has expanded its enforcement capacity and has made pre-consent tracking and the failure to honor GPC signals a clear priority. But the more immediate risk for most ecommerce stores is private litigation. Plaintiffs’ firms have built efficient, scalable processes for identifying non-compliant sites, generating technical evidence (including HAR file analysis of pre-consent tracking), and sending demand letters. Many of these cases settle quickly and quietly. The economics favor volume.
Shopify merchants are a common target precisely because the platform’s default tracking architecture makes this particular gap easy to create and easy to miss.
The Standard Tracking Stack
A typical Shopify store running any meaningful level of paid media will have some combination of the following tools installed:
- Google Analytics 4 (GA4) for site analytics and audience building
- Google Ads conversion tracking and remarketing pixels
- Meta Pixel for Facebook and Instagram advertising attribution
- Email platform tracking, commonly Klaviyo
- Additional ad platform pixels — Bing, Pinterest, TikTok, Snapchat depending on the media mix
- Supplementary tools like CallRail for phone tracking, review platforms, or loyalty apps
- Google Tag Manager (GTM) to deploy and manage most of the above
- In more advanced setups, server-side tracking through a tool like Elevar
Each of these tools is designed to collect data. In a default configuration, every single one of them fires immediately when a page loads — automatically, in the background, without any user interaction or consent. A visitor who lands on your homepage and immediately closes the tab has still had their device metadata, IP address, and browsing behavior transmitted to potentially dozens of third parties.
The Shopify Native Consent Settings — And Their Limits
Shopify introduced Automated Privacy Settings as a built-in solution for consent management, and many merchants have turned it on believing it resolves their compliance exposure. It is a step in the right direction, but it has a fundamental limitation that Shopify does not make obvious.
If your store uses GTM — and most stores running any meaningful level of advertising do — enabling Shopify’s native privacy settings provides a false sense of compliance. Your GTM tags continue to fire on every page load regardless of what consent state Shopify thinks it has set.
This is the gap that catches most merchants off guard. You have a privacy policy. You’ve turned on Shopify’s consent settings. You have a cookie banner of some kind. You believe you’re covered. But the technical implementation — the actual network requests being made during a user session — tells a different story.
What the Evidence Actually Looks Like
Privacy researchers and plaintiffs’ firms identify this gap using a tool called a HAR file — an HTTP Archive, which is essentially a detailed log of every network request a browser makes during a session. Capturing a HAR file of a website visit is straightforward and requires no special access. Any modern browser can do it.
When a HAR file from a non-compliant Shopify store is analyzed, the pattern is consistent:
- 50 to 80 or more third-party domains receive data during a single session
- Google and Meta pixels fire within milliseconds of the page loading, transmitting device identifiers and page metadata
- Email platforms like Klaviyo assign user IDs and begin behavioral tracking before any consent interaction
- Advertising platforms receive unique identifiers — GCLIDs, FBCLIDs, click IDs — that enable persistent cross-site user profiles
- All of this happens before a consent banner has been seen, let alone engaged with
The data transmitted in these requests includes IP addresses, User-Agent strings (which reveal device type, browser, and operating system), referring URLs, page URLs, session identifiers, and in cases where
the user is known to a platform, hashed or sometimes unhashed email addresses and external IDs. Under California law, all of this is personal data. Transmitting it to third parties for advertising purposes without giving users a meaningful opportunity to opt out is precisely the compliance failure that enforcement and litigation targets.
What Proper Compliance Actually Requires
The good news is that this is a solvable problem. The technical fix exists, it is not prohibitively expensive, and for most Shopify stores it can be implemented within a week. What it requires is three components working together — none of them alone is sufficient.
Layer 1: A Real Consent Management Platform
A Consent Management Platform (CMP) is the foundation of the entire solution. It presents users with a consent banner, captures their opt-in or opt-out decision, stores that preference, and — most importantly — pushes the consent state to the browser’s data layer so that other tools can act on it.
This is not what Shopify’s built-in settings do, and it is not what a basic cookie notice does. A cookie notice that says ‘we use cookies’ and provides no actionable choice is not a CMP and does not satisfy the legal requirement. Users need to be able to actively opt out before tracking begins, and your technical infrastructure needs to actually respect that choice.
For Shopify stores, particularly those using GTM and Elevar, recommended CMP options include:
- Pandectes — built natively for Shopify with direct integrations for GTM and Elevar. Pushes consent state to the data layer automatically and is generally the fastest path to a complete solution for this stack.
- Cookiebot (now part of Usercentrics) — widely adopted across industries, strong Google Consent Mode v2 support, requires somewhat more manual GTM configuration but well-documented.
- OneTrust — enterprise-grade with more configuration overhead, better suited to large or complex operations with dedicated technical resources.
Layer 2: Google Consent Mode v2 in GTM
A CMP captures consent. Google Consent Mode v2 is how you make GTM respect it.
Consent Mode v2 is Google’s framework for telling your GTM tags — and through them, Google Analytics, Google Ads, and any other Google products — what they are and are not allowed to do based on the user’s consent decision. Without it configured in your container, your tags fire regardless of what the CMP captured.
Proper implementation involves four things:
- A Consent Initialization tag that sets default consent to ‘denied’ for analytics_storage, ad_storage, ad_user_data, and ad_personalization — this must fire before any other tag
- A consent update trigger that fires when the CMP pushes a consent_update event to the data layer, updating consent state based on the user’s actual choice
- A review of every tag in the container using GTM’s built-in Consent Overview panel to confirm that each tag has the appropriate consent type assigned
- QA testing in a clean browser session to verify that no tags fire before the user interacts with the consent banner
Layer 3: Server-Side Consent (Elevar and Similar Tools)
If your store uses Elevar or another server-side tracking solution, there is a third layer to address. Server-side tracking operates its own data pipeline, separate from what GTM manages client-side. Configuring Consent Mode v2 in GTM does not automatically extend to your server-side container.
Elevar has its own consent mode configuration that controls whether server-side events — the ones relayed to Google, Meta, and other downstream platforms through Elevar’s infrastructure — are fired based on the user’s consent state. This needs to be configured explicitly and mapped to the same consent signals your CMP is capturing. Without it, a user who declines tracking on the frontend may still have their server-side events transmitted to advertising platforms.
Availability of consent mode features varies by Elevar plan tier, so confirm what is available on your current subscription before assuming the option is there.
The Bottom Line
Privacy compliance for ecommerce has crossed a threshold. Having a privacy policy and a passive cookie notice is no longer sufficient — the legal and technical bar requires that tracking actually stops until a user has had a meaningful opportunity to consent or decline.
The gap that most Shopify stores have right now is not a policy gap. Most stores have reasonable privacy policies in place. The gap is between what the policy says and what the technical infrastructure actually does. A privacy policy that promises users control means nothing if your tag manager fires 60 pixels before the user finishes loading the page.
The three-layer fix — a real CMP, Consent Mode v2 in GTM, and server-side consent configuration — closes that gap. It is implementable within a week for most stores. It does not require ripping out your analytics stack or sacrificing meaningful tracking capability. Done correctly, you can run a full-scale advertising and analytics operation while giving users the control they are legally entitled to and protecting your business from the litigation risk that comes with the current default setup.
If you are unsure whether your store has this gap, the fastest way to find out is simple: open your site in a clean browser window with your network inspector open, and watch what fires before you interact with anything. If you see Google, Meta, Klaviyo, or any other platform receiving requests before you have touched a consent banner, you have the gap.
