What is the _orig_referrer cookie?
_orig_referrer is a first-party cookie set automatically by the Shopify platform on any online store hosted on its infrastructure. Merchants don't need to install any extra script for it, as it's part of Shopify's core commerce engine.
The cookie is created on a visitor's first session on the store, regardless of whether they go on to browse products or make a purchase.
What data it stores
The value stored is the full URL of the page that referred the visitor to the store (for example, a Google search result, a social media link, or an ad), or an empty/"direct" value if there was no external referrer.
The data stays in the visitor's browser and is sent to Shopify's servers with requests to the store, where it's used internally for reporting and attribution.
What it is used for
The main purpose is traffic-source analysis: Shopify uses this information to determine where a customer originally came from, even if they browse multiple pages or return later within the same session.
Merchants benefit from more accurate reporting on which channels drive visitors and conversions (organic search, social media, paid campaigns), which supports marketing decisions.
Does it require consent?
CookieFix classifies _orig_referrer under statistics (analytics), since its purpose is traffic measurement and attribution rather than strictly necessary technical functions like the cart or checkout.
- Under GDPR and the ePrivacy rules (in Romania, Law 506/2004), analytics cookies require the visitor's prior consent before being placed.
- The Shopify store owner should enable a consent banner that blocks this cookie until acceptance and list it in the store's cookie policy.
- Declining consent should not affect the store's core functionality (browsing, cart, checkout).
How to block or delete _orig_referrer
A visitor can delete or block this cookie through browser settings (for example, clearing cookies for the store's domain or using private/incognito mode), without losing the ability to shop.
At the site level, the store owner should use a consent management platform (CMP) that intervenes before the associated script runs. CookieFix, for instance, can automatically block scripts in the statistics category, including those generating _orig_referrer, until the visitor gives consent.
Frequently asked questions
No, it serves traffic-analysis purposes rather than the technical functioning of the cart or checkout, so it doesn't qualify as strictly necessary.
It typically lasts about two weeks, after which it expires automatically.
Yes, since it's classified as an analytics cookie, it requires the visitor's prior consent before being set.
The store keeps working normally, but Shopify won't be able to correctly attribute the traffic source for that session in its analytics reports.