accountcraft Install free
All articles

AccountCraft Journal

Shopify Consent Expiry for EU Stores: No GDPR Deadline

Learn when EU Shopify merchants should refresh consent, why GDPR sets no fixed expiry, and how Shopify’s Customer Privacy API records each choice.

12 min read

Set a consent refresh cadence that fits your store, and re-collect consent whenever your processing changes. GDPR sets no fixed expiry, so the interval is a good-practice choice, not a legal deadline. Shopify’s cookie banner and the Customer Privacy API record each visitor’s decision, but neither one renews it for you. You decide when to ask again.

TL;DR:

  • New pixels, undisclosed profiling, added data partners, retargeting, or a privacy notice that no longer matches actual practices should trigger a fresh consent request.
  • Check that third party banners use the Customer Privacy API and match Shopify’s configured regions, then test a fresh EEA browser session before launch.
  • Keep an audit log with each choice’s timestamp, consent categories, visitor region, notice version, and withdrawals, so you can explain each decision.
  • When visitors decline, analytics sessions fall and ad platforms may credit fewer orders than Shopify; record expected gaps before changing the refresh cadence.
  • Provide a persistent privacy management link and account controls, and stop affected processing promptly after withdrawal, with pixel rules updated on the next page load.
AccountCraft
Give Customers Control of Their Data
AccountCraft adds editable data fields and built-in consent management to Shopify New Customer Accounts, keeping customer data in Shopify.
Install AccountCraft

Table of Contents

Why GDPR and regulators don’t set a single expiry

The EDPB Guidelines 05/2020 state that the GDPR contains no specific time limit for consent. How long a choice stays valid depends on context, on the scope of the original consent and on what the person reasonably expects. If your processing activities change significantly, the earlier consent no longer covers them and you need to ask again.

A calendar rule alone is never enough. A merchant who makes no changes is in a different position from one who adds new ad pixels. Regulators lean on the same logic: they want consent that stays meaningful, not a box ticked once and forgotten. Choose a periodic review interval that fits your processing. This is a practical choice, not a fixed rule in the regulation.

Here is what the guidance asks of you in practice:

  • No fixed limit. Consent has no statutory shelf life, so document why you chose your interval.
  • Context decides validity. Scope, purpose and customer expectations all affect how long a choice holds.
  • Choose a practical review interval. The appropriate interval depends on your processing and the context of the consent.
  • Withdrawal must be easy. Regulatory guidance says people can withdraw consent at any time and that withdrawing must be as easy as giving it.
  • A reject option matters. The Cookie Banner Taskforce report says consent needs a positive action and a clear reject option, and that withdrawal mechanisms must be easy to reach.

None of this is legal advice. Check your specific situation with qualified counsel.

Shopify gives you a native cookie banner, and you configure it in the admin under Settings > Customer privacy. There you set the regions where the banner appears and adjust its look. When the banner is on, it records each visitor’s choice through the Customer Privacy API, and any third-party consent app you install must integrate with that same API so the choices are respected across the store.

The API lets your consent solution access and update consent status, and provides events that can signal when a visitor updates a choice. Shopify’s automated privacy settings add default behavior for new stores, including automated banners for EEA and UK markets, which means a fresh store may already be showing a banner you never configured.

Here is the part most merchants miss. The API records status, but it does not handle the expiration or timed renewal of consent. If you want a timed refresh, your consent solution has to trigger a new collection event. Nothing on the Shopify side will do it automatically.

To verify your setup, work through this order:

  1. Open Settings > Customer privacy in your Shopify admin and confirm the banner is enabled.
  2. Check that the regions listed match the markets you actually sell into.
  3. Review the automated privacy settings and note what your store does by default.
  4. Confirm that any third-party banner calls the Customer Privacy API instead of writing its own cookies.
  5. Decide who owns the refresh logic: your consent app, a developer, or a manual process.

Pro Tip: If you use a third-party banner, make sure its region configuration matches the regions in your Shopify admin. A mismatch can let non-essential data be processed before consent is collected.

A time window is only half the answer. The stronger test is whether what you do with customer data has changed since they last said yes. The EDPB guidance ties renewed consent to significant changes in processing, so treat each of the following as a reason to re-prompt, whatever the calendar says.

  • New or changed tracking pixels. Adding a Meta, TikTok or Google Ads pixel that visitors were never told about means their earlier consent did not cover it.
  • Profiling you did not disclose. Say you install a personalization engine that builds interest profiles from browsing behavior. That is a new purpose, and it needs fresh consent.
  • Expanded data sharing. If you start passing data to a new partner, or the way you define selling or sharing data changes, ask again.
  • New marketing uses. Moving from order confirmations to retargeting audiences is a change in scope, not a tweak.
  • A rewritten privacy notice. If the text customers agreed to no longer matches reality, the agreement no longer matches either.

A short decision flow helps your team stay consistent. First ask whether the scope changed. If yes, re-collect consent now. If no, fall back on your time-based refresh and re-prompt when the interval ends. Write the answer down each time you add an app or script, because the person installing a pixel is rarely the person thinking about consent.

One more habit pays off: keep a simple change log of every tracking tool added to the store, with the date. When a regulator or a customer asks why you re-prompted, or why you did not, that log is your explanation.

Step-by-step implementation: admin settings, third-party banners and renewal events

Start in the admin. Under Settings > Customer privacy, verify the cookie banner regions, make sure your privacy policy is published, and confirm what the automated settings are doing. Shopify’s privacy settings documentation explains how these settings mark visitors, and it is worth reading once before you change anything.

If you use a third-party consent manager, check three things. It must be integrated with the Customer Privacy API. Its regions must match your Shopify regions. Check that it records consent through the Customer Privacy API, so the app and Shopify can respect the visitor’s choice.

Then build the refresh itself:

  1. Pick the trigger. Choose a review interval from the date of the last recorded choice, along with the scope-change triggers from the previous section.
  2. Choose the re-prompt format. Options include re-showing the banner, an in-account notification inside New Customer Accounts, or an email with a link to manage preferences.
  3. Store the date. Save the timestamp of each decision so you can determine when to review the choice.
  4. Listen for consent events. Use the Pixel Privacy documentation to learn how pixels can receive consent updates and check which categories are allowed.
  5. Update your pixels. Load or suppress each tool according to the categories the visitor allowed.
  6. Test before launch. Simulate an EEA session, confirm that pixels stay quiet until consent is given, and check that declined visitors are excluded as expected.

For the testing step, our guide on testing pixels and adding account consent without code walks through a practical checklist. If you also sell to California, our walkthrough of admin steps using the Customer Privacy API covers the overlapping settings.

Pro Tip: Test with a fresh browser profile and again after clearing cookies. Many consent bugs only appear for a first-time visitor, and your own browser has already answered the banner.

Expect some analytics discrepancies during testing. Visitors who decline will not appear in the same way, so your session counts and your ad platform numbers will not match perfectly. Note the differences now so nobody mistakes them for a bug later.

Shopify’s settings mark visitors so that when they decline non-essential cookies, their device data is not used by Shopify Network Intelligence for advertising. Third-party cookies or pixels you added by hand may need a third-party banner or custom logic to honor the same choice, so do not assume the native banner covers everything on your site.

Refreshing consent changes what you can measure. Each time a visitor withdraws, or lets a choice lapse and then declines on re-prompt, you lose a slice of data you used to have. Plan for these effects:

  • Lower session counts. Declined visitors drop out of analytics, so reported traffic will fall below real traffic.
  • Conversion gaps. Ad platforms will credit fewer orders than your Shopify admin shows.
  • Google Consent Mode. Shopify’s documentation notes that Consent Mode v2 must be configured correctly so that event data from EEA customers is not used for personalized advertising without valid consent. A short primer on Google’s Consent Mode is a helpful companion if the setup is new to you.
  • Fallbacks. Consider cookieless measurement and server-side events, but only where your consent choices allow them.
  • Documentation. Write down the analytics changes you expect before you change your refresh cadence, so the drop has an explanation.

When you change your review interval, compare consent rates and reported conversions before and after, and keep notes. Shopify-focused tag and analytics management resources can help you think through the measurement trade-offs, though your own store data is the real test.

A refresh policy is only as good as the records behind it. Shopify records the basic consent state through the Customer Privacy API, but if you do any extra processing, keep your own audit log as well. For each decision, store what you would need to prove it later:

  • Timestamp. The date and time of the choice, which helps you determine when to review it.
  • Scope. Which categories the visitor allowed: analytics, marketing, preferences or sale of data.
  • Region. Where the visitor was when they chose, since banner rules differ by market.
  • Version. Which privacy notice or banner text they saw.
  • Withdrawal events. Every time a choice was changed or revoked, with its own timestamp.

Withdrawal needs its own design. A persistent “Manage privacy” link in the footer is the minimum. Logged-in customers should also find the same controls inside New Customer Accounts, so they can change a preference without hunting for a banner that has already disappeared. As you migrate away from legacy customer accounts, make sure customers can find the same controls in New Customer Accounts. Our post on moving to New Customer Accounts explains the transition.

When someone withdraws, the processing concerned must stop promptly, and your pixel logic must reflect it on the next page load. Do not let a revoked choice sit in a queue.

Withdrawal signal stopping pixel processing

Consider an account-level block or a floating icon that opens preferences. Keep the labels plain and make it keyboard accessible, so the control is easy for everyone to find and use.

Pro Tip: Make withdrawal as easy as giving consent. Rejecting or changing a choice should not require more effort than accepting.

I think merchants frame this the wrong way. Consent refresh feels like a legal chore, so it gets postponed until someone worries about an audit. I would rather treat it like clearing out an old stockroom: a routine you schedule, not a crisis you react to. Every refresh is also a reason to talk to customers, to tell them what has changed in how you use their data and why. People who are asked politely and clearly tend to trust a store more, not less. A refresh that explains itself is a small piece of customer communication, and the stores that do it quietly on a calendar usually have fewer surprises later.

— Ivan Signorile

Shopify’s banner handles the first decision, but customers also need a place to revisit it. We built AccountCraft to add that place inside New Customer Accounts, with no coding and no theme changes.

AccountCraft

Our Block Builder includes a privacy consent block and an SMS consent block, plus customer fields bound to customer metafields and repeatable record lists. You can show or hide blocks with conditional rendering by customer tag, metafield, market, B2B status or account age, and add translations. Customer data stays in Shopify, and there is no separate customer database. We help you collect, record and honor consent through Shopify’s customer privacy APIs, but compliance stays your responsibility.

There is a free plan, and paid plans (Pro, Plus) are billed through Shopify. For current pricing, see the Shopify App Store listing. Install AccountCraft free from the Shopify App Store to add a preference center for your logged-in customers.

FAQ

The GDPR sets no fixed expiry. The EDPB guidelines say validity depends on context and scope, so refresh when processing changes. Choose a practical interval based on your processing and the context of the consent.

No. The Customer Privacy API records a visitor’s consent status but does not handle timed renewal. Your consent solution has to trigger a new collection event when you want a refresh.

Declined visitors are excluded from Shopify Network Intelligence for advertising, and your session and conversion numbers will usually drop. Expect gaps between your Shopify admin and ad platforms, and test any changes to your refresh cadence before relying on the new numbers.

Go to Settings > Customer privacy in your Shopify admin. There you can set banner regions and appearance, and review the automated privacy settings for your markets.

Sources