01Steps
- In Shopify admin: Online Store → Themes → Edit code, open theme.liquid.
- Paste the snippet inside
<head>, above any app or pixel scripts, and save. (The CMPStack app embed, once listed, prints both blocks for you.) - Verify the domain in the panel, then publish a banner. Decisions are forwarded to Shopify’s own consent API automatically.
“The Site ID” is your domain’s identifier, shown under Domains → Install tag in the panel.
02Snippet
<script>
window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}
gtag('consent','default',{ad_storage:'denied',ad_user_data:'denied',ad_personalization:'denied',analytics_storage:'denied',wait_for_update:500});
</script>
<script async src="https://cdn.cmpstack.io/cmpstack.js" data-site="YOUR-SITE-ID" data-api="https://api.cmpstack.io"></script>Replace YOUR-SITE-ID with your Site ID, or copy the snippet from the panel, where it is already filled in.
03Two blocks, in this order
The first block sets Google Consent Mode to denied before anything loads — so if our tag ever cannot be fetched, your Google tags stay off rather than firing as if no banner existed.
Paste both blocks at the top of <head> in theme.liquid, above {{ content_for_header }}. The CMPStack app embed, once listed, prints both itself in the consent slot Shopify loads before other app embeds.
Where it cannot reach. Checkout pages load no theme or app-embed code, so nothing can be placed there. Shopify's own pixels and customer events do not read Consent Mode — the tag sets Shopify's Customer Privacy API from every decision, and those follow it.
It protects Google tags only. Meta, TikTok and other tags read no Consent Mode signal; our tag blocks those itself.