What is the checkout_token cookie?
checkout_token is an HTTP cookie set by Shopify, the e-commerce platform powering the visited store. It appears in the browser when a visitor adds products to the cart and starts the checkout process.
It is not set directly by the site owner but by Shopify's infrastructure, which handles cart and payment functionality and is automatically integrated into any Shopify-based store.
What data it stores
The cookie stores a unique identifier (token) tied to the shopper's current checkout session, generated by Shopify. The exact value format is not publicly documented and may vary; it does not normally contain plaintext card data or passwords.
The value is exchanged between the shopper's browser and Shopify's servers to keep data consistent across the checkout steps (shipping, payment, confirmation).
What it is used for
The cookie's purpose is strictly functional: it lets Shopify correctly identify and maintain the state of an order being placed, so that the cart contents, shipping address, and payment method entered by the customer are not lost between checkout pages.
For the store owner, this cookie is essential for online sales to work; without it, the payment process cannot be completed correctly.
Does it require consent?
Under CookieFix's classification, checkout_token is a strictly necessary cookie. Under the ePrivacy Directive (2002/58/EC), as implemented in Romania by Law 506/2004, cookies strictly necessary to provide a service explicitly requested by the user (here, completing an order) do not require prior consent.
- The site owner must still declare it in the cookie policy, with purpose and duration.
- It should not be included among categories that can be toggled off in the banner.
- It should be periodically verified that it is used strictly for checkout, not for marketing purposes.
How to block or delete checkout_token
A visitor can delete or block this cookie from browser settings (Chrome, Firefox, Edge, Safari, per-site cookie management), but doing so will break the Shopify checkout process, and the order will not be completable.
Because it is strictly necessary, this cookie should not, and generally cannot, be blocked by a CMP before consent, as that would break the store's core functionality. A platform like CookieFix automatically classifies this type of cookie as necessary and excludes it from the blocking applied to statistics or marketing scripts, which remain disabled until the visitor gives consent.
Frequently asked questions
No, since it is strictly necessary to complete the order, it does not require prior consent under the ePrivacy rules, but it must be listed in the cookie policy.
The checkout session may be interrupted, and the shopper might need to restart the process from the cart.
It is a session cookie, so it expires automatically when the browser is closed or when checkout is completed or abandoned.
It should not be shown as a toggleable option, but the site owner must list it in the cookie policy under the strictly necessary category.