Conversions dropped after we added a cookie banner

By the HonestTag team · Published October 27, 2026

You added a cookie banner and conversions dropped. Your sales didn't.

What a cookie banner changes for tracking

A cookie banner asks the shopper a question and records the answer as a consent state. In regions where the store requires consent, a pixel is supposed to read that state before it stores a cookie or sends anything. On Shopify, the answer is held by Shopify's Customer Privacy API, which Shopify says "is used to apply consent decisions to Shopify-managed surfaces, like pixels, audiences, and checkout" (Customer Privacy API).

For tracking, three kinds of visitor behave differently:

• A visitor who declined. Shopify records this, per purpose, as "the current visitor has actively denied consent."
• A visitor who never answered. Shopify records "the current visitor has not yet granted or denied consent." In a region the store set to require consent, Shopify says "non-essential purposes are not allowed by default until consent is given," so those purposes stay not allowed until consent is given. Shopify still records this visitor as not having granted or denied consent, which is a different state from an active denial.
• A visitor outside a region where the store requires consent. Shopify says "For other regions, the default behavior is to allow all processing purposes." For this visitor, tracking is allowed without any answer.

Which regions require consent is a store setting. Shopify's methods that report what is allowed "combine the following factors to determine what processing is allowed": "The current merchant settings," "User location" and "User consent given." Shopify defines several purposes, among them marketing ("Marketing, attribution and targeted advertising from the merchant") and analytics ("customer analytics about how the storefront was used and interactions made on the storefront"). Shopify also notes that collecting data without consent "might not comply with applicable laws" and tells merchants to consult legal counsel; this article is not legal advice. For what Google's own tags do with the same choice, read Google Consent Mode v2.

What a web pixel can and cannot read

A Shopify app pixel runs in a sandbox and gets consent handed to it: Shopify says web pixel app extensions "honor the consent signals chosen by the customer" and that "You can't call the Customer Privacy API from a web pixel app extension" (About web pixels). It gets a yes or no per purpose when the page loads, with no field for whether the visitor answered, and a notice when the visitor answers a banner. "In regions where customers must consent to tracking, app extension callbacks are executed only after consent is given," so for a shopper there who never gives it, the pixel never runs. Shopify custom pixel vs app pixel covers what else the sandbox allows and blocks.

A month before and after, in counts

The numbers below are made up to show the arithmetic. They are not from a real store and not an estimate of what any store will see. Assume the store's pixel waits for consent where the store requires it, and every visitor the pixel is allowed to see is recorded.

The month before the banner: the store takes 200 orders. The pixel saw 190 of those buyers, so 190 orders have a visitor record, which is what lets an order be tied to the visit and to any ad click on it. The other 10 came from buyers whose visit the pixel missed for unrelated reasons.

The month after: the store takes 200 orders again.

• 80 come from buyers outside the regions where the store requires consent. The pixel sees them as before, less the same kind of misses: say 76 have a visitor record. (To keep the example short, it puts all 4 ordinary misses here.)
• 120 come from buyers inside those regions. 50 accepted, 30 declined and 40 never answered.
• The pixel sees the 50 who accepted. It sees neither the 30 who declined nor the 40 who never answered.

So 126 orders (76 + 50) have a visitor record, down from 190. 74 orders have none: 4 ordinary misses, 30 declined and 40 never answered. All 200 orders still happened, and all 200 are in the store's own order list.

Orders with a visitor record fall from 190 to 126, and only those orders can be tied to an ad click. These figures do not say how many visits came from an ad, so the orders tied to a click are some share of 190 before and some share of 126 after. The same goes for visits: the pixel also stops seeing the visits of everyone who declined, and of everyone in those regions who never answered, whether or not they bought. A conversion rate built from tracked orders and tracked visits is computed over a smaller, different set than the month before, so it moves for reasons that have nothing to do with how many people bought. The count that does not move is 200.

Why counts drop after a banner

Two of these reasons are the banner working. The other two make the drop bigger than it needs to be.

• The banner working: a shopper who never answers. In a region that requires consent, an app pixel never runs for a shopper who never gives it, so it records no visit and no click, and a later order from them has no click to attribute. Another merchant wrote that "our Shopify conversion rate has dropped dramatically" while orders were up (Shopify Community, January 2025).
• The banner working: a declined visitor who still buys. The 30 in the example. The order is real and the store has it, but no visit and no ad click are tied to the shopper. No setting fixes this one; it is what declining means.
• Bigger than needed: consent recorded on the storefront that does not reach checkout. A merchant described losing "marketing consent between the storefront and the checkout" (Shopify Community, September 2026). Shopify's doc says the Customer Privacy API "is used to apply consent decisions to Shopify-managed surfaces, like pixels, audiences, and checkout," says to "always use this API to manage customer privacy settings," and says Shopify's own banner "automatically passes consent to this API." For a custom storefront it lists extra settings to pass when recording consent, including "Your checkout domain," and it points such a storefront to Hydrogen analytics and consent, which it says "manages the Shopify session server-side, so consent persists across page loads and is honored by checkout" (Customer Privacy API). Headless storefront tracking covers that setup.
• Bigger than needed: a banner that blocks tracking in every region. Shopify says its own banner "displays in the configured regions," and for a banner from an app, Shopify says to "contact the app's developer to understand where the consent banner is rendered." A banner or setup that blocks the pixel everywhere turns the 80 buyers from regions without a consent requirement in the example into more missing records, without any setting that asked for it. Check which regions your banner covers against which regions your Shopify privacy settings require consent in.

The trade-offs

• Respecting a decline can mean not sending a real order. If a store does not send a declined shopper's order to the ad platform, a sale that happened is not reported to it. That is the cost of honoring the decline.
• Sending those orders anyway is a choice. A setup can still send an order from a shopper who declined, built from the order itself rather than from a tracked visit. Whether to send it is the store's decision, and a store that does it is choosing to. HonestTag's default is described below, including where it does this.
• Two conversion rates are two different numbers. Tracked orders divided by tracked visits is one number. All orders divided by all visits is another. After a banner they can move apart.
• Your own order count is the number that does not move. When a platform count or a tracked conversion rate drops after a banner goes in, compare it with the orders in Shopify for the same days before deciding sales fell.

What HonestTag does

• The pixel follows Shopify's Customer Privacy API. It reads the consent state Shopify hands it on load (init.customerPrivacy) and subscribes to visitorConsentCollected. Of Shopify's purposes, it reads two: marketing and analytics.
• An explicit refusal stops tracking. If marketing or analytics is not allowed, the pixel sets no visitor cookie and sends nothing. That covers a shopper who refused either purpose, and a shopper in a region set to require consent who has not answered, because Shopify leaves those purposes not allowed until consent is given. If the shopper later allows both in the same visit, the pixel starts then.
• In the EU, EEA, UK and Switzerland, nothing is kept until the shopper answers. This holds even where your Shopify privacy settings do not ask for consent there. Until Shopify reports that the shopper agreed, the pixel sets no cookie and HonestTag keeps nothing it sends. We place the shopper by the country of the request, and a request we cannot place is treated the same way.
• Elsewhere, allowed without an answer is not a grant. When both purposes read allowed and the pixel has seen no answer, or the store exposes no Customer Privacy state at all, the pixel runs and may set its visitor cookie, but never records consent as given. If your store needs consent before any tracking cookie in those regions, set your banner and Shopify's privacy settings to ask there.
• EU, EEA, UK and Swiss orders need a visitor record. For an order whose shipping address, else billing address, else customer default address is in one of those countries, a conversion with no visitor record is sent to no platform, and the order's record shows it was blocked. This gate is on by default. It is turned off only when the store asks HonestTag in writing because it collects consent somewhere else; it cannot be switched off from the app.
• Elsewhere, on a paid plan, an order can still be sent. An order from a shopper who declined has no ad click tied to the shopper, but outside those countries it can still go out on what it carries, such as a hashed email. That is the choice described above.
• Global Privacy Control and Do Not Track drop the pixel beacon. A beacon from a browser sending either signal is dropped at our endpoint, so no visitor record is made. They do not by themselves block an order from being delivered; an EU, EEA, UK or Swiss order with no visitor record is still blocked by the gate above.

The server-side delivery docs list the consent rules, and section B4 of the privacy policy describes the pixel. For why sending from a server does not bring back declined shoppers, read server-side tracking; for what first-party tracking does and does not change about consent, read first-party tracking.

Frequently asked questions