Most stores treat the cookie banner as a legal formality: install an app, pick a template, move on. Since Google began requiring Consent Mode v2 signals for EEA traffic, that banner also decides whether your advertising measurement works — which makes it a revenue question rather than a compliance one.
The two are now the same problem, and treating them separately is what leaves stores with a banner that satisfies neither.
What Consent Mode v2 actually requires
It defines four signals your site sends to Google: whether advertising storage is allowed, whether ad user data may be sent, whether ad personalisation is allowed, and whether analytics storage is allowed. Each is either granted or denied.
The critical detail is ordering. The default state has to be declared before the tag manager loads, not after. A banner that sets consent only once the visitor clicks has already lost the first pageview, and in many implementations the tag has already fired.
This is why the consent defaults belong in an inline snippet in the page head, ahead of the container script. Loading them from an external file introduces a race the tag usually wins.
Denied by default is the defensible position
You can set defaults by region — denied in the EEA, granted elsewhere. Many stores do. The simpler and more defensible choice is denied everywhere until the visitor decides.
Two reasons. First, region detection is imperfect and a mistake in the permissive direction is the expensive kind. Second, if you sell into Turkey as well as the EU, KVKK expectations point the same way, so a single global default avoids maintaining two positions.
The cost is real: analytics numbers drop when consent is genuinely required rather than assumed. That drop is not lost data so much as previously overcounted data.
What a working banner has to do
Offer a genuine choice. A banner with only an accept button is not consent. Rejecting must be as easy as accepting — same prominence, same number of clicks.
Remember the decision, and apply it before the banner renders on the next visit. A returning visitor who already chose should not see the banner flash again.
Let the decision be changed. A link in your cookie policy that reopens the banner is the usual pattern and is expected under GDPR.
Not block the page. A banner that covers content until dismissed hurts both usability and, on mobile, layout stability scores.
Where Shopify stores get this wrong
Two tag managers. A store installs a consent app that injects its own tag manager while the theme already loads one. Consent signals go to one and the tracking runs through the other.
App scripts outside consent control. Many Shopify apps inject their own tracking pixels directly into the theme. Those do not respect Consent Mode unless they were built to, and a banner that governs only Google tags while five app pixels fire regardless is not doing what it claims.
Banners that report consent but never update. The signal is sent once at page load and never updated after the visitor clicks, so the granted state never reaches the tag in that session.
How to check yours
Open the site in a private window with developer tools recording network requests. Before clicking anything, look at what fired. Analytics and ad requests before a consent decision mean the defaults are not being applied in time.
Then reject, reload, and check again. Anything still firing is outside your consent control — usually an app pixel — and needs to be handled separately or removed.
Every app that sets cookies belongs in the consent banner; our free app finder shows which ones load on your storefront. We configure Consent Mode v2 as part of every Shopify store setup.