Shopify custom pixel vs app pixel: what is the difference?

By the HonestTag team · Published October 26, 2026

App pixel vs custom pixel at a glance

	App pixel	Custom pixel
How it gets there	Installed with a marketing and data collection app, or a sales channel	A developer adds the code in Customer events
Who writes it	The app owner	You or your developer
Sandbox	Strict	Lax
Permissions and privacy settings	"determined by the third-party app partner, and can't be changed"	Yours: "Compliance with applicable laws, consents, code security, troubleshooting, and updates are your responsibility"

Sources: Shopify's App pixels and Custom pixels pages. Shopify adds: "Adding and using custom pixels is unsupported by Shopify." It recommends an app pixel for "higher security" and "automatic updates," and a custom pixel "If there isn't an app pixel available that meets your requirements" (Shopify Help Center).

What the sandbox takes away

Shopify says a sandboxed pixel "is restricted to the data made available within the sandbox" (Shopify Help Center). In practice:

• No reading the page. Pixels can't automatically detect events, metadata, email and phone, outbound link clicks, or heatmap clicks and mouse movement "from DOM scraping," and can't automatically detect page scrolling. For events, metadata, user information and outbound links, Shopify points to publishing custom events instead, and says that "might not be supported by all app pixels" (Shopify Help Center).
• No drawing on the page. Pixels "can't render user interface elements, such as buttons, forms, banners, or modals" (same page).
• Strict sandbox (app pixels). "Traditional JavaScript pixels that use browser APIs such as window.document won't work in this environment" (shopify.dev).
• Lax sandbox (custom pixels). It is an iframe, and "Traditional Javascript pixels that are placed in the lax sandbox cannot access the top frame" (shopify.dev).

Cookies still work, through Shopify. Sandboxed pixels are not cookie-free. Shopify's Web Pixels API gives them browser methods that "asynchronously execute in the top frame (cookie, localStorage, sessionStorage)" (shopify.dev), and its cookie object "provides a setter/getter to set cookies on the top frame" (shopify.dev).

What changed, and when

• February 2025: Meta pixels and Google Universal Analytics tags not set up through their apps "have been removed from the Preferences page," Shopify says (Shopify Help Center).
• August 28, 2025: "checkout.liquid and additional scripts were sunset for the Thank you and Order status pages" (shopify.dev).
• Script tags on those pages: sunset August 28, 2025 for Plus stores, and "for non-Plus stores on August 26, 2026" (same page).

Pixels still run there: Shopify says they "automatically load on the Storefront, Checkout, Thank you page, and Order status page" (Shopify Help Center).

Where any browser pixel falls short

App or custom, a web pixel lives in the shopper's browser. Shopify says web pixels "rely on browser cookies to identify users and attribute conversions back to ad clicks" (Shopify Help Center), and:

• Intelligent tracking prevention "shortens or limits cookies, which reduces attribution accuracy even though the pixel still runs and sends events."
• Ad blockers "can block the web pixel entirely, which prevents its events from being sent to that destination."
• Consent: in markets configured to require consent, "usually the European Economic Area (EEA) and the United Kingdom," web pixels run "only when visitors have provided the permissions required in the pixel configuration," and new pixels require Marketing and Analytics permissions by default (Shopify Help Center).
• A purchase page that never loads: Shopify's checkout_completed event is triggered once per checkout, "typically on the Thank you page," and "If the page where the event is supposed to be triggered fails to load, then the checkout_completed event isn't triggered at all" (shopify.dev). A purchase tag that only listens for that event misses that order.

For tracking prevention and ad blockers, Shopify adds: "your Shopify reports and order records aren't affected, because Shopify records order and analytics data when the order is processed" (Shopify Help Center). What can be lost is the link from the order back to the ad.

What you can do

1. List what you have. Every app pixel and custom pixel is in the Customer events section of your Shopify admin.
2. Prefer an app pixel when possible, as Shopify advises. Use a custom pixel when no app pixel meets your requirements.
3. Pick your migration order. If you want to minimize missing customer events, Shopify says to connect your new custom pixel before you remove the old one. If you want to avoid duplicating customer event tracking, connect it after removing the old one (Shopify Help Center).
4. Test it. Shopify's Pixel Helper shows whether an app pixel "is receiving data correctly when events occur on your site" (Shopify Help Center).
5. Know that GTM stays sandboxed. Google Tag Manager can run as a custom pixel, but "pixels that Google Tag Manager loads still run within the Shopify sandbox, so the same tracking capabilities and limitations apply" (Shopify Help Center). Server-side GTM vs a Shopify app covers the server side.
6. Keep one purchase source per platform. Two pixels sending the same purchase can count it twice. Duplicate purchase events explains why.

What HonestTag does

• An app pixel in the strict sandbox. HonestTag's pixel is a web pixel app extension. Opening HonestTag in your Shopify admin adds it, so there is no code to paste into your theme and none to remove later (setup docs).
• It works from Shopify's events. It subscribes to six of Shopify's standard events (page viewed, collection viewed, added to cart, checkout started, payment info submitted and checkout completed) and records which ad brought the shopper against a random visitor ID, saved through Shopify's cookie API.
• Purchases come from the order, not the pixel. When a shopper orders, Shopify sends HonestTag the order webhook, and HonestTag joins that order to the visitor record (server-side delivery docs).
• The limits above still apply. If a blocker or a refusal stops the pixel, HonestTag still gets the order, but has no ad click to tie it to. On a paid plan, outside the EU, EEA, UK and Switzerland, that order can still go out on what it carries, such as a hashed email. An EU, EEA, UK or Swiss order with no visitor record is not sent, unless you asked HonestTag in writing to turn that gate off because you collect consent somewhere else; it cannot be switched off from the app. An explicit refusal through Shopify's Customer Privacy API stops the pixel at the source.

Frequently asked questions