--- title: Shopify Customer Privacy API slug: shopify-customer-privacy-api docTags: createdAt: 2024-03-27T15:03:08.364Z --- Shopify's [Customer Privacy API](https://shopify.dev/docs/api/customer-privacy) is available as a Javascript API on Shopify themes. If you have enabled Shopify's default cookie banner or data sales opt-out page, or you have installed a cookie banner or consent management Shopify app, you're likely capturing customer data preferences with the Customer Privacy API. Chord offers a consent management wrapper that retrieves customer data preferences from the Customer Privacy API and adds them to Chord CDP events as the [consent object](https://docs.chord.co/installation). Within Chord CDP, you can map how data preferences should be applied to Chord CDP destinations. Follow these steps to configure consent management with Shopify's Customer Privacy API and Chord CDP: 1. Configure customer privacy in Shopify. 2. Configure consent categories in Chord CDP and map to destinations. 3. Implement Chord's Web Pixel which integrates native consent management features from Shopify and the CDP. ## Configuring Shopify To implement consent management on a Shopify site using the Customer Privacy API, navigate to **Settings > Customer privacy** in your Shopify store admin. You’ll see three available privacy settings. The cookie banner privacy setting **must** be enabled if you’re using Chord's Web Pixel. If it isn’t, the Customer Privacy API is unavailable, and Chord will never send events to Chord CDP for any visitor. Learn more about [Shopify’s customer privacy settings](https://help.shopify.com/en/manual/privacy-and-security/privacy/customer-privacy-settings). The following two privacy settings are recommended by Shopify and should be configured: ### Cookie banner Add a banner to ask visitors for permission to manage their data. You can either enable Shopify’s default cookie banner, or add a custom cookie banner from the Shopify app store. To enable Shopify’s cookie banner, select **Cookie banner** > **Activate cookie banner**, choose regions, and select **Activate**. To use a custom cookie banner, select **Cookie banner** > **More actions** > **Use custom cookie banner**, choose regions, and select **Activate**. ### Data sales opt-out page Allow visitors to define how their data can be shared. To enable Shopify’s data sales opt-out page, select **Data-sales opt-out page**, choose regions, and select **Activate.** ## Configuring Chord CDP Shopify’s Customer Privacy API supports four categories of consent from users: - `analytics`: Customer analytics about how the storefront was used and interactions made on the storefront. By default, this preference is collected by Shopify’s cookie banner as “performance cookies.” - `marketing`: Marketing, attribution and targeted advertising from the merchant. By default, this preference is collected by Shopify’s cookie banner as “marketing cookies.” - `preferences`: Customer preferences such as language, currency, size, and more. By default, this preference is collected by Shopify’s cookie banner as “preference cookies.” - `sale_of_data`: Sharing data with third parties, usually for behavioral advertising. By default, this preference is collected by Shopify’s data sales opt-out page. You can decide how these four categories map to your Chord CDP destinations. Add the four categories below as category mappings in the Chord CDP by navigating to **CDP** > **Consent Categories** > **Create Your First Consent Category**. You can customize the “Category name” for these category mappings, but the “Category ID” must be exactly the values listed below to connect preferences from Shopify to Chord CDP: | Category Name (can be customized) | Category ID | | --------------------------------- | ----------------- | | Performance cookies
| `analytics` | | Marketing cookies | `marketing`
| | Preference cookies | `preferences` | | Sale of data | `sale_of_data` | For each category, choose the mapped destinations. Mapping a destination to a category means that the destination will only receive the Chord CDP event if Shopify’s Customer Privacy API reports that processing is allowed for that category. Once you’ve created and enabled the four categories, you should see this in Chord CDP: ![](https://api.archbee.com/api/optimize/TmutqdeXiIw-V3gBZXVjd/rjNjq-Bb3Rotg4XiHKf2R_image.png) ## Installing on your site The [Chord web pixel integrates](https://docs.chord.co/dbKz-consent-management) native consent management features from Shopify and the CDP so you can accurately comply with your customer's privacy preferences. Before the Chord Web Pixel is loaded is loaded, Chord's checks to see if user tracking is allowed at all. The Chord Web Pixel will load and send events to the Chord CDP only if `window.Shopify.customerPrivacy.marketingAllowed()` and `window.Shopify.customerPrivacy.analyticsProcessingAllowed()` both return `true`. This typically means the customer is: - Browsing from a region that does not require a cookie banner, or; - In a region that does require a cookie banner, but has consented to both analytics and marketing cookies. If the Customer Privacy API doesn't allow user tracking, Chord will silently fail and events will not be sent. Next, if the Chord Web Pixel is loaded, a `consent` object is added describing the customer’s consent preferences to each Chord CDP event. Chord CDP will use the consent category mapping we configured earlier in the Chord CDP consent categories configuration along with the destination-level configuration to determine which destinations will receive events based on this `consent` object. The pixel uses the `Allowed` methods of Shopify’s Customer Privacy API to construct the `consent`object and [obtain the values for each category](https://shopify.dev/docs/api/customer-privacy#check-data-processing-permissions): ```jsx { analytics: window.Shopify.customerPrivacy.analyticsProcessingAllowed(), marketing: window.Shopify.customerPrivacy.marketingAllowed(), preferences: window.Shopify.customerPrivacy.preferencesProcessingAllowed(), sale_of_data: window.Shopify.customerPrivacy.saleOfDataAllowed() } ``` ## FAQs **Is Global Privacy Control (GPC) supported?** Chord CDP recognizes the [Global Privacy Control signal](https://globalprivacycontrol.org/) as an opt-out of data sales in regions where opting out is supported. The `sale_of_data` category in the `consent` object will be `false` if the customer has activated the Global Privacy Control signal in their browser and is browsing from a region where opting out of data sales is an option.