> For the complete documentation index, see [llms.txt](https://docs.chord.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.chord.co/collect-data/shopify/browser-events/consent.md).

# Consent

Chord uses Shopify's [Customer Privacy API](https://shopify.dev/docs/api/customer-privacy) to respect each shopper's consent choices. Events only reach the destinations a shopper has consented to, which helps you comply with privacy laws such as GDPR and CCPA. Beyond the settings on this page, the only consent setup is the `consent: 'shopify'` option in your analytics package configuration, which the [browser events](/collect-data/shopify/browser-events.md) snippet already includes. Headless stores should set it too.

## How it works

1. Shopify asks the shopper for consent through your cookie banner.
2. Shopify only loads the Chord web pixel once the shopper allows both analytics and marketing. Until then, the pixel sends nothing. Events your theme sends through the analytics package itself still go to Chord, stamped with the shopper's choices, and your consent categories decide which destinations get them.
3. Once loaded, the pixel attaches a `consent` object to every event, recording the shopper's choice for each consent category.
4. Chord uses your consent category mappings to decide which destinations receive each event.

## Step 1: Set the pixel's privacy settings

In Shopify admin, go to **Settings > Customer events**, open the Chord pixel, and set **Customer privacy** as follows:

* **Permission:** select **Required**, and check **Marketing** and **Analytics**. This makes Shopify fill in the consent values the pixel reads. Without these boxes checked, the consent values may not reflect the shopper's real choices.
* **Data sale:** select **Data collected qualifies as data sale**. This makes Shopify report when a shopper opts out of the sale of their data, for example under CCPA. With "does not qualify", Shopify reports the sale of data as allowed even after a shopper opts out.

![Customer privacy settings for the Chord pixel](https://2938842758-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5Oy2IAsu7IvAGAlWgC36%2Fuploads%2Fgit-blob-bd83a60e526b8ce5d84cf1c43f3f55d7d9bdac23%2Fshopify-pixel-privacy-settings.png?alt=media)

## Step 2: Turn on Shopify's customer privacy features

In Shopify admin, go to **Settings > Customer privacy**.

**Cookie banner (required).** Chord's consent handling needs a cookie banner. Without one, the Customer Privacy API isn't available and Chord sends no events at all.

* To use Shopify's banner: select **Cookie banner > Activate cookie banner**, choose the regions where it should appear, and click **Activate**.
* To use a banner app from the Shopify App Store: select **Cookie banner > More actions > Use custom cookie banner**, choose regions, and click **Activate**.

**Data sales opt-out page (recommended).** This lets shoppers control whether their data is shared with third parties. Select **Data-sales opt-out page**, choose regions, and click **Activate**.

See Shopify's guide to [customer privacy settings](https://help.shopify.com/en/manual/privacy-and-security/privacy/customer-privacy-settings) for more.

## Step 3: Create consent categories in Chord

Shopify's Customer Privacy API has four consent categories. Create a matching consent category in Chord for each, then choose which destinations belong to it. A destination in a category only receives an event if the shopper consented to that category.

In Chord, go to **CDP > Consent Categories > Create Your First Consent Category** and add these four. You can name them however you like, but the category ID must match exactly:

* **Performance cookies**, ID `analytics`: how shoppers use and interact with your storefront.
* **Marketing cookies**, ID `marketing`: marketing, attribution and targeted advertising.
* **Preference cookies**, ID `preferences`: shopper preferences such as language, currency and size.
* **Sale of data**, ID `sale_of_data`: sharing data with third parties, usually for behavioral advertising. Collected by Shopify's data sales opt-out page.

When all four are created and enabled, the list looks like this:

![Consent categories in Chord](https://2938842758-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5Oy2IAsu7IvAGAlWgC36%2Fuploads%2Fgit-blob-cc17bbfb23276fa81294a4f55d79d4e6035fed80%2Fconsent-categories-shopify.png?alt=media)

## The consent object

The pixel builds the `consent` object on every event from Shopify's Customer Privacy API:

```json
{
  "analytics": true,
  "marketing": true,
  "preferences": true,
  "sale_of_data": false
}
```

Each value comes from one Shopify method:

* `analytics`: `customerPrivacy.analyticsProcessingAllowed()`
* `marketing`: `customerPrivacy.marketingAllowed()`
* `preferences`: `customerPrivacy.preferencesProcessingAllowed()`
* `sale_of_data`: `customerPrivacy.saleOfDataAllowed()`

## Server events

Consent only applies to browser events. Server events from the Chord Webhook Events app, such as Order Completed, Order Refunded and fulfillments, carry no consent information, because consent is only known in the shopper's browser. Chord treats them as consented and sends them to every connected destination, even one with consent requirements. That keeps your transactional data complete in every tool.

## Global Privacy Control

Chord treats the [Global Privacy Control](https://globalprivacycontrol.org/) signal as an opt-out of the sale of data. If a shopper has GPC turned on in their browser and is in a region where opting out is supported, `sale_of_data` is `false`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.chord.co/collect-data/shopify/browser-events/consent.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.