Short answer
A Shopify consent audit must go beyond theme.liquid. Apps, Customer Events, web pixels, app embeds, custom Liquid, and marketing integrations can each add tracking independently of the storefront banner.
Start with a clean visitor session, test every consent choice, and compare network activity across key storefront routes. Then recheck after app installs, theme edits, pixels, or campaign changes.
What to check
- Active theme layout and custom Liquid snippets.
- App embeds and third-party marketing apps.
- Customer Events, web pixels, and ad-channel integrations.
- Product, collection, cart, landing, and account pages that can use different templates.
Practical steps
- Inventory Shopify apps, app embeds, Customer Events, pixels, and custom scripts.
- Test initial, Reject all, Analytics only, and Accept all in separate private sessions.
- Check requests and cookies on a product, cart, and active landing page.
- Map each optional provider to a consent category and disable duplicate loaders.
- Scan representative storefront URLs and schedule recurring monitoring after app changes.
Common mistakes
- Assuming the storefront banner governs every installed Shopify app.
- Testing only the homepage rather than campaign landing and cart pages.
- Removing a pixel from the theme while it remains configured in Customer Events.
- Treating policy copy as proof that a third-party script is correctly gated.
Important boundary
Know the scope
GDPRChecker monitors observable storefront behaviour and does not modify Shopify checkout or third-party app settings. Review Shopify and vendor configuration directly for full control.