Shopify

Overview

Shopify is the underlying e-commerce platform powering millions of online stores. Its JavaScript is ubiquitous on Shopify-hosted storefronts and handles everything from cart state and checkout to analytics and attribution. The Shopify script suite spans essential commerce infrastructure, first-party analytics, and the Shop Pay network — each with different consent implications.

What This Script Does

Core Storefront Scripts (Essential) Shopify loads core scripts from cdn.shopify.com that manage essential storefront functionality:

• shopify.js and theme JavaScript handle cart state, product variant selection, quantity updates, and add-to-cart interactions
• Checkout scripts at checkout.shopify.com manage the multi-step checkout flow including address entry, shipping selection, and order confirmation
• Payment processing scripts handle credit card tokenization via Shopify Payments (powered by Stripe under the hood)

These scripts set essential cookies:

• _session_id (first-party, session) — shopping session identifier for cart and checkout persistence
• cart (first-party, 2 weeks) — cart contents serialized to maintain shopping progress across sessions
• secure_customer_sig (first-party, 1 year) — encrypted customer login signature for account authentication
• storefront_digest (first-party, session) — storefront authentication for password-protected stores

Shopify Analytics and Attribution Shopify loads analytics.js from cdn.shopify.com that tracks the conversion funnel across all storefront pages:

• Fires page view events on every storefront page including product pages, collection pages, and search results
• Records product impression data: which products were viewed, in what order, at what prices
• Tracks add-to-cart, checkout initiation, and order completion events
• Attributes sales to referring traffic sources (UTM parameters, referrers, ad clicks)

Cookies set for analytics:

• _shopify_s (first-party, 30 minutes) — analytics session identifier
• _shopify_y (first-party, 1 year) — analytics visitor identifier
• _shopify_sa_p (first-party, 30 minutes) — page attribution data for last-click attribution
• _shopify_sa_t (first-party, 30 minutes) — traffic source attribution
• _shopify_fs (first-party, 1 year) — first session timestamp for new vs. returning visitor segmentation

Shop Pay and the Shopify Network Shop Pay allows customers to save payment and shipping information for one-click checkout across all Shopify stores. The Shop Pay button:

• Loads from pay.shopify.com and checks whether the visitor's email is enrolled in Shop Pay via a network lookup
• Sets cross-site identifiers that enable the one-click checkout experience across different Shopify merchants
• _shopify_m (third-party via pay.shopify.com, 1 year) — Shop Pay cross-merchant identity cookie

Script filenames loaded: shopify.js, analytics.js, checkout.js, theme bundle files

Domains contacted: cdn.shopify.com, checkout.shopify.com, pay.shopify.com, {merchant}.myshopify.com, monorail-edge.shopifysvc.com (analytics pipeline)

Consent & Compliance

GDPR/ePrivacy: Shopify's core cart and checkout cookies (_session_id, cart, secure_customer_sig) are strictly necessary for e-commerce functionality and exempt from consent requirements under ePrivacy. The analytics cookies (_shopify_s, _shopify_y, _shopify_sa_p, _shopify_sa_t, _shopify_fs) are non-essential and require explicit opt-in consent. The Shop Pay cross-merchant cookie (_shopify_m) is a third-party tracking cookie that requires consent.

CCPA/CPRA: Shopify analytics data collection and the Shop Pay network's cross-merchant tracking constitute personal information collection that must be disclosed.

EU-US Data Transfers: Shopify Inc. (Canadian entity) processes EU data subject to GDPR. Shopify participates in the EU-US Data Privacy Framework (DPF) for US processing.

Consent category: Essential (cart, checkout, payment) and Analytics (Shopify Analytics, attribution tracking).

Should You Block This Without Consent?

Conditional. Core Shopify e-commerce scripts — cart management, checkout processing, payment handling — are essential and must always load. Shopify Analytics cookies (_shopify_s, _shopify_y, _shopify_sa_p, _shopify_sa_t, _shopify_fs) and Shop Pay cross-merchant tracking require analytics consent before being set. Shopify's Customer Privacy API provides a built-in mechanism to gate analytics cookie setting on consent status — use it to ensure compliance.