shopatch
DE Start a project
← Blog

·

Is your Shopify cookie banner legal in Germany? A 2026 checklist

Short answer: A Shopify cookie banner is legal in Germany when no non-essential cookies or tracking pixels load before the visitor actively agrees (§25 TDDDG), the first banner layer offers a “reject all” button equal in size, colour and position to “accept all” (Verwaltungsgericht Hannover, 19 March 2025), there are no pre-ticked boxes, every tracking service is named in your privacy policy, and consent can be withdrawn at any time. Shopify’s native banner handles the basics — but apps and theme-injected pixels are where most stores quietly break the law.

Almost every German Shopify store we audit has the same problem, and almost none of the owners know about it: the tracking starts before anyone clicks the banner. The banner is asking permission the page has already taken. Here is what the law actually requires in 2026, why most stores miss it, and how to fix it on Shopify specifically.

German cookie rules come from two layers: the GDPR (DSGVO) and §25 of the TDDDG — the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, which replaced the TTDSG on 13 May 2024. Only the name changed; the cookie rules stayed the same. Together they require four things:

  • Consent before loading. Any cookie or script that is not strictly necessary — analytics, Meta or TikTok pixels, marketing tags — may only load after the visitor actively agrees. Under §25(2) TDDDG, only technically essential cookies (session, cart, security) are consent-free.
  • An equal “reject all”. In line with the German data-protection authorities’ guidance (the DSK Orientierungshilfe), the Verwaltungsgericht Hannover confirmed on 19 March 2025 that if the first layer has an “accept all” button, it must also carry an equally prominent “reject all” — same size, colour and position. A banner that nudges toward acceptance makes the consent invalid.
  • No dark patterns. No pre-ticked boxes, no “continue browsing = consent”, no hiding the reject option one layer down.
  • Named services and a withdrawal option. Every tool must be named in your privacy policy (Art. 13 GDPR), and consent must be withdrawable at any time.

Getting this wrong is not theoretical: fines reach €300,000 under §28 TDDDG, on top of GDPR exposure and the very real risk of an Abmahnung from competitors or consumer associations. (Germany’s new consent-management ordinance, the EinwV, has been in force since 1 April 2025, but it does not remove any of the duties above.)

Why do most Shopify stores break the rule without knowing?

Most stores are non-compliant not because of the “accept” button, but because tracking fires before anyone clicks anything. The usual culprits on Shopify:

  • Marketing pixels hard-coded in the theme or checkout scripts — Meta Pixel, TikTok, Pinterest, Google Ads — that load on page view regardless of consent.
  • A Google Tag Manager container that fires its tags immediately on load.
  • Apps (email, analytics, reviews) that drop cookies the moment the page opens.

The cookie banner sits on top and politely asks for permission the page already took. That gap — tracking before consent — is exactly what the courts and data-protection authorities act on.

How do you check your own store in two minutes?

You can verify this yourself, no tool required:

  1. Open your store in a private/incognito window.
  2. Open your browser’s DevTools → Network tab, and filter for tracking hosts: facebook, tiktok, google-analytics, doubleclick, clarity.
  3. Reload the page — and do not click anything in the cookie banner.
  4. If you see requests to any of those hosts, tracking is firing before consent. That is the violation.

Then look at the banner itself: does the first layer show a “reject all” as visible as “accept all”? If the only first-layer choices are “accept” and “settings”, that is the second problem.

How do you fix it on Shopify specifically?

Shopify gives you the tools; compliance is wiring them correctly:

  • Use the Customer Privacy API. Shopify exposes a consent signal you can gate every non-essential script behind, so pixels only load after the shopper agrees. Check the current consent on load and listen for changes — the change event does not fire for a visitor who consented on an earlier visit:
// Load the Meta Pixel only after the shopper allows marketing cookies.
// Shopify Customer Privacy API — never load a marketing pixel before consent.
function loadMarketingIfAllowed() {
  if (window.Shopify.customerPrivacy.marketingAllowed()) {
    loadMetaPixel();
  }
}

// Returning visitor who already consented on an earlier visit:
loadMarketingIfAllowed();
// ...and the moment they accept (or change) their choice this visit:
document.addEventListener('visitorConsentCollected', loadMarketingIfAllowed);
  • Turn on the native cookie banner. Under Settings → Customer privacy, set up the cookie banner and the region (EU/Germany). It presents an accept/decline choice and records the consent signal the API above reads.
  • Move custom pixels into the Web Pixels sandbox. Shopify’s Web Pixels API respects the consent signal automatically — far safer than a pixel hard-coded in theme.liquid. For Google, enable Consent Mode v2.
  • Audit your theme and checkout scripts. Any tag sitting in the theme or in checkout “Additional Scripts” that ignores consent has to be removed or moved behind the consent check.
  • Name every service in your privacy policy. Klaviyo, Google Tag Manager, Meta, TikTok, Analytics — each must be listed by name. A generic “we use cookies” does not satisfy Art. 13.

Shopify’s built-in banner is a solid foundation, not automatic compliance. It presents the banner and records the consent signal correctly — but it only protects you if your tracking actually listens to that signal. Apps and theme pixels that fire regardless of consent still break §25 TDDDG even with the native banner switched on. Compliance is the banner plus every tracking service honouring it.

The short version

  • Nothing non-essential loads before consent
  • The first layer has a "reject all" equal to "accept all"
  • No pre-ticked boxes or dark patterns
  • Every service named in the privacy policy
  • Consent can be withdrawn at any time
  • Verified yourself in the DevTools Network tab

One honest caveat: this is technical guidance, not legal advice — for a binding assessment, talk to a lawyer specialising in IT law. But most of the actual risk here is technical, and that is the part we fix. At Shopatch we run cookie and consent audits and implement the fix directly on your store, as part of our care packages. Want to know whether your store is exposed? Start a project.