What is the secure_customer_sig cookie?
secure_customer_sig is an HTTP cookie set by Shopify, the e-commerce platform powering the online store being visited. It is set by Shopify's infrastructure (checkout, customer accounts, authentication), not directly by the merchant's own code.
The cookie appears when a visitor logs into a Shopify customer account or interacts with features that require recognizing an authenticated customer session, such as returning to the store or completing an order.
What data it stores
The cookie stores a cryptographic signature tied to the authenticated customer's session, which Shopify uses to verify and validate the customer's identity on subsequent requests. The value is an encrypted/hashed string with no publicly documented format, and it does not directly contain readable data such as name or email.
The data is sent to Shopify's own servers (the infrastructure hosting the store), not to external marketing or analytics third parties.
What it is used for
Its main purpose is account security: the cookie lets Shopify confirm that requests coming from the visitor's browser belong to a legitimate authenticated session, helping prevent session hijacking or tampering.
For the merchant, this cookie ensures reliable operation of customer accounts, order history, and checkout flows that depend on securely identifying the shopper.
Does it require consent?
CookieFix classifies secure_customer_sig as strictly necessary (required for the site to function). Under the ePrivacy Directive 2002/58/EC and GDPR, cookies strictly necessary to provide a service explicitly requested by the user (here: account login) do not require prior consent.
Site administrators should still list it in their cookie policy, including its purpose and duration, to meet the transparency obligations under GDPR and ePrivacy.
How to block or delete secure_customer_sig
Visitors can delete or block this cookie via browser settings (Chrome, Firefox, Safari, Edge – cookies and site data management). Blocking it may prevent proper login to the customer account or completing checkout on the Shopify store.
- Because it is strictly necessary, this cookie should not be included among scripts blocked pending consent.
- A CMP such as CookieFix can still automatically discover this cookie through scanning and list it transparently in the cookie policy, without blocking it, since it doesn't depend on consent.
Frequently asked questions
It's a cookie set by Shopify to secure and validate the session of a customer who is logged into an online store built on the platform.
No, it's classified as strictly necessary because it supports account authentication, a feature explicitly requested by the user, so it falls outside the ePrivacy prior-consent requirement.
The typically reported duration is around 20 years, though Shopify may adjust this without public notice.
You may be logged out of your Shopify customer account and need to sign in again on your next visit.