What is the _tracking_consent cookie?
_tracking_consent is a first-party cookie automatically set by Shopify on any online store built on the platform, regardless of the theme used. It typically appears on a visitor's first session, as soon as they interact with Shopify's built-in consent banner or a third-party banner connected to Shopify's consent API.
The cookie is part of Shopify's internal consent-management infrastructure (Shopify Customer Privacy API) and is independent of any apps or themes installed by the merchant.
What data it stores
The stored value is an encoded/encrypted string generated by Shopify that reflects the visitor's consent choices (for example, acceptance or refusal of analytics and marketing categories). The exact format of the value is not documented in detail publicly and may change over time as Shopify updates the platform.
The data generally stays on the visitor's browser and is read by Shopify's on-page scripts to decide whether other cookies (such as analytics or remarketing ones) can be activated.
What it is used for
The cookie's purpose is strictly technical and functional: it lets the Shopify platform know whether a visitor has already been asked for consent and what they answered, so the banner doesn't reappear on every page and non-essential cookies aren't activated without agreement.
For the merchant, this cookie is part of the mechanism that lets the store respect visitor choices and avoid loading analytics/marketing scripts before consent is obtained.
Does it require consent?
Since it is used exclusively to remember consent preferences, it is classified as strictly necessary and, under GDPR and the ePrivacy rules, does not require the visitor's prior consent to be set.
- The site owner still needs to list it in the cookie policy, with its purpose and duration.
- It should not be blocked pending consent, since without it the banner cannot function correctly.
- It's recommended to explicitly mark it as an exception in the CMP's auto-blocking configuration.
How to block or delete _tracking_consent
A visitor can delete or block this cookie manually from their browser settings (Chrome, Firefox, Safari, Edge, etc.), under cookies or site data. Deleting it will make the consent banner reappear on the next visit.
Because it is strictly necessary, a CMP like CookieFix should not auto-block it before consent — it needs to stay active so the visitor's preferences can be recorded and respected correctly across the rest of the site.
Frequently asked questions
It's a cookie set by Shopify on stores built with the platform, used to remember whether a visitor gave or refused consent for other cookie categories.
No, since it's strictly necessary for the consent system to function, it doesn't require prior consent, but it must be listed in the cookie policy.
Its typical duration is about 1 year, after which it expires automatically and the visitor is asked again on their next visit.
The Shopify consent banner will reappear on the next visit, because the platform no longer has a record of the user's previous choice.