accountcraft Install free
All articles

AccountCraft Journal

How to Design Consent UX in Shopify New Customer Accounts

Design consent UX in Shopify New Customer Accounts: where each prompt belongs, wording examples that are specific and reversible, and a test routine to run.

15 min read

Good consent UX in Shopify comes down to four things. Ask for one thing at a time, in plain words. Never pre-tick a box where opt-in is required. Let customers change their mind from their account in as few clicks as they needed to say yes. Shopify’s built-in tools cover the cookie banner and the checkout and sign-in checkbox. A block-based account page covers the rest: the place where customers review and change their choices later. Below is where each prompt belongs, wording you can adapt, and how to test it.

AccountCraft
apps.shopify.com
Make Consent Easier to Manage
AccountCraft lets customers review and edit their information on personalized Shopify account pages, with built-in consent management.
Explore AccountCraft

TL;DR

  • Separate three kinds of consent: cookies and tracking, marketing opt-in (email and SMS), and profile data customers share with you. Each needs its own prompt and its own wording.
  • Write each request with the purpose, the sender, and a withdrawal route. “Receive marketing” is too vague.
  • Set up the cookie banner and checkout checkbox in Shopify admin, then give customers a place in New Customer Accounts to review and change choices.
  • Test every market, language and checkbox state, then look at the customer profile to confirm the choice was recorded.
  • Compliance stays your responsibility, and we do not give legal advice. Check your setup with a privacy professional.

Table of Contents

Merchants often treat “consent” as one banner. In practice a customer meets several separate moments, and each one does a different job.

Moment What it covers Where you set it up
Cookie banner Tracking and analytics cookies, marketing cookies, data sale or sharing Settings > Customer privacy > Cookie banner
Sign-in and checkout checkbox Email and SMS marketing opt-in Settings > Checkout
Account page Reviewing, changing or withdrawing choices later; sharing profile data Customer accounts (a block builder such as AccountCraft, or code)

The cookie banner has a narrower scope than many merchants assume. Shopify’s Help Center explains that it governs Shopify-specific tools, including cookies and Shopify Pixels. If you installed third-party cookies or pixels manually, or through apps, you may need a third-party banner or custom logic so they honor customer consent.

The same page notes that in configured banner regions, non-essential data is collected only after consent. That is intended for regions that require opt-in, such as the EEA and the UK. It might reduce the data available for analytics, marketing and personalization, so plan your reporting with that in mind.

If your store sells to the US, regional rules differ. Some US states work on an opt-out model for the sale or sharing of data rather than opt-in. Our walkthrough of CCPA admin steps using the Customer Privacy API covers that side.

Before wording or layout, check the request against the basic tests. Legiscope lists five requirements for valid consent wording under GDPR Article 4(11) and Recital 32:

  1. Freely given: refusing carries no penalty.
  2. Specific: one purpose at a time.
  3. Informed: the controller’s identity, the purposes and retention are stated.
  4. Unambiguous: a clear affirmative action, with no pre-ticked boxes.
  5. Withdrawable: as easy to withdraw as to give.

The UK regulator says the same thing in its own terms. The ICO’s consent guidance says a request must name the controller, the purposes and the types of processing. It should be prominent, kept apart from other terms and conditions, concise and easy to understand. The Data Protection Network adds that consent should not be bundled across purposes or made conditional.

These are the design constraints. A single checkbox that says “I agree to the terms and to marketing” fails them. So does a banner where “Accept” is a bright button and refusing takes four clicks of small gray text.

Canada’s regulator makes a related point about language. The Office of the Privacy Commissioner of Canada says purposes should use meaningful language, separate what is integral to the service from what is not, and highlight purposes that are not obvious. That is a good editing rule for any store: if a purpose would surprise the customer, say it out loud.

The best wording names the purpose, the channel and the way out. Here are patterns for the situations Shopify merchants run into most. Adapt them to your brand, and have them reviewed for the regions you sell in.

Marketing email at sign-in or checkout

Power Commerce offers copy examples for marketing checkboxes in three styles. A minimal one: “Yes, send me exclusive offers and product updates by email.” A purpose-driven one: “Email me order updates and promotions from [Brand]; I can manage preferences anytime.” A segmented one: “Send me new arrivals and style tips based on my preferences.”

The same source says pre-ticked boxes are treated as invalid consent in many regimes. It also says to replace vague permission lines such as “Receive marketing” with specific content types: promotions, product updates, newsletters.

A version we would use as a starting point:

Email me new arrivals and offers from [Brand]. You can unsubscribe in any email or change this under Account > Privacy.

It states the channel, the sender and the withdrawal route in one sentence. That is the pattern to repeat.

SMS marketing

SMS needs its own checkbox. Do not fold it into the email line. Voyado’s Engage help center gives example consent text for combined SMS and email marketing that mentions withdrawal through unsubscribe links or a contact address. It also says the box must be optional and not pre-ticked. If you run both channels, a separate line keeps the request specific:

Text me delivery updates and offers from [Brand] at the number I entered. Message frequency varies. Reply STOP to opt out, or change this in my account.

Check your SMS provider’s own requirements for the exact disclosures it needs. They are not the same everywhere.

Profile data customers choose to share

New Customer Accounts let customers save information such as birthdays, sizes, pets or vehicles. This is data they hand over for a reason, so the reason belongs next to the field:

Your birthday: we use it to send you a birthday offer. You can remove it at any time.

Legiscope says valid wording should state the purpose in operational language, name recipients and describe a concrete withdrawal route. Its example of such a route is a path through account settings to a Privacy page, with the effect stated as taking place within a set time. Keep any promise like that realistic. Only write “within 24 hours” if your team can do it.

Analytics and tracking explanations

Matomo shows how plain a purpose statement can be: analytics used to understand and optimize a site, based on consent, with a pointer to where preferences can be changed. Write yours the same way. Name what you measure and why. If you also want to tie that measurement to business results, the case for analytics in marketing and ROI is a good reason to be precise about purposes rather than hiding behind “improve your experience.”

Wording to avoid

  • “By continuing you agree to everything.” It bundles purposes and has no affirmative action.
  • “Receive marketing.” It names no channel, content or sender.
  • “Don’t miss out! Opt in now.” Pressure language undermines the idea of freely given consent.
  • A decline button labeled “No, I don’t like savings.” Refusal should be neutral and equally easy.

Where each prompt belongs

In your Shopify admin, go to Settings > Customer privacy and open Cookie banner to activate the banner. According to Shopify’s customization guidance for upgrading, the banner can display in the online store and in customer accounts in selected regions. Choose regions deliberately, and check the banner text for plain language.

Marketing checkbox: Settings > Checkout

The same Help Center page says you can add a marketing consent checkbox on the sign-in page and at checkout, configured in Settings > Checkout. A separate page on collecting customer contact information explains that you can decide whether the box is preselected and in which regions. You can use automatic preselection based on local jurisdictions or pick regions manually. If you serve opt-in regions, leave the box unticked there. Where you do not need to think about preselection at all, an unticked box is still the simplest design.

Placement matters as much as wording. Power Commerce advises placing the checkbox next to the email field or sign-in button, keeping legal language to plain wording about the commercial purpose and expected frequency, and making the action reversible with a clear route to change preferences in the account profile.

The account page: where consent becomes a relationship

The checkbox is a one-time moment. The account page is where a customer comes back to check what they agreed to. Shopify’s own changelog says customers can change consent preferences at any time by reopening the cookie banner, and can opt out of data sale from their account and their browser. That covers the cookie side. For marketing and profile data, you decide what the account page offers.

A practical layout for the account page:

  1. A short heading, such as “Your privacy choices.”
  2. One line on what this page controls.
  3. Separate toggles or checkboxes for email and SMS, each with its own wording.
  4. A profile form for fields customers chose to share, each with a one-line purpose.
  5. A way to contact you for anything the page does not handle.

We cover a fuller version of this in our guide to building a preference center in New Customer Accounts, and the specific GDPR checkbox for New Customer Accounts is worth reading if your list includes EU customers.

Build the account-page layer without code

AccountCraft is a Shopify app for exactly this layer. It works through official Shopify Customer Account UI Extensions, so you do not edit your theme or write code. Customer data stays in Shopify, and there is no separate customer database.

A consent-focused account page uses a handful of the 14 block types:

  • Text and card blocks for headings and the purpose statement.
  • Privacy consent and SMS consent blocks for the choices themselves.
  • Update form and single field blocks, bound to customer metafields, for profile data customers share.
  • Record list for repeatable items such as pets or vehicles.
  • Divider and spacer blocks to separate purposes visually, so each request stands alone.

Conditional rendering lets you show a block by customer tag, metafield, market, B2B status or account age. One use: show the SMS block only in markets where you actually send texts. Another: show a region-specific note only to customers in that market. Translations let each customer read the wording in their own language. Our privacy consent block is designed to help collect, record and honor consent through Shopify’s customer privacy APIs. Compliance remains your responsibility.

A step-by-step setup:

  1. Install the app from the Shopify App Store.
  2. Open the block builder and create a new account page.
  3. Add a text block with your one-line explanation of what the page controls.
  4. Add a privacy consent block for each separate purpose, and write the wording from the patterns above.
  5. Add an SMS consent block only if you send texts.
  6. Add an update form for profile fields, each with its purpose in the label or help text.
  7. Set conditional rules by market or tag where wording or channels differ.
  8. Add translations for each language you sell in.
  9. Publish, then run the tests below.

For the no-code testing side, see our guide to testing pixels and adding account consent.

Keep it light and accessible

Shopify’s footer documentation for customer account extensions says the footer renders on every customer account page. It advises keeping content lightweight, respecting the shouldShowBanner flag, and giving overlays accessibility labels and keyboard navigation. It also says to use shopify.customerPrivacy and shopify.applyTrackingConsentChange rather than custom consent tracking. Developers building by hand should follow that. If you use an app, ask whether it works through those official routes.

Understand the three states

The Customer Privacy API reports analytics and marketing consent as true (granted), false (denied) or undefined (no decision made). Design for all three. “No decision” is not “no” and not “yes,” and your reporting should not treat it as either.

Granted, denied, and undecided consent states

The ICO states that withdrawing consent must be as easy as giving it, and that privacy information should explain how to do so. If a customer ticks a box in one click at checkout, do not make them email support to undo it. A toggle on the account page does the job.

Consider double opt-in where list quality matters

Double opt-in adds a confirmation email after sign-up. We cover the trade-offs in our double opt-in guide.

Test that choices are recorded and respected

A clear prompt means little if the choice is not stored or honored. Neat Digital recommends testing checkout across every active market and language, with email-only, phone-only and both contact fields, checked and unchecked states, completed and abandoned checkouts, and new and returning customers. Then look at the resulting customer profile and campaign segment, and check that signups and unsubscribes from connected tools show up everywhere that can send.

A short routine:

  1. Create test customers, one per market and language you sell in.
  2. For each, complete sign-up and checkout with the box ticked, then again unticked.
  3. Open Customers in your Shopify admin and check the consent state on each profile.
  4. Change the preference from the account page, and confirm the profile updates.
  5. Check your email and SMS tools to confirm they received the same state.
  6. Repeat for the cookie banner: accept, decline, then reopen and change.

The same Neat Digital article notes that Shopify’s consent fields behind the customer profile, such as marketing state, opt-in level and when consent was updated, answer “may this channel send now?” better than “what exactly did this person see?” That is a reason to save a copy of your consent wording and the date you changed it. Our guide to exporting consent records from Shopify shows what you can pull out.

Perspective: why the account page is the missing layer

Most consent work stops at the moment of collection: a banner, a checkbox. Customers, though, judge your privacy practices by what happens next. Can they find their choices? Can they change them without writing to support?

We built AccountCraft because New Customer Accounts gave merchants a good official foundation but little room to present consent and profile data in their own words. A block builder lets you write each purpose in plain language, place it beside the field it explains, and keep everything in Shopify, with no separate database to maintain.

Our view is that clear, specific consent requests tend to build the kind of trust that supports retention, because customers who control their data have less reason to feel uneasy about sharing it. The tool helps you collect, record and honor choices through Shopify’s customer privacy APIs. The judgment about what your wording must say stays with you and your advisers.

Ivan Signorile

Install AccountCraft free

If you want a consent and preferences page in New Customer Accounts without touching code, AccountCraft has a free plan. Paid plans (Pro and Plus) are billed through Shopify, and the Shopify App Store listing shows current pricing. You can see the plans on our site or go straight to the Shopify App Store listing.

AccountCraft

If you are still planning your move to New Customer Accounts, our start page explains what to expect.

Responsibility stays with you

Shopify’s own Help Center says its automated privacy settings are not a substitute for legal advice. Merchants are responsible for an accurate privacy policy and for following the laws that apply to them. If you use Shopify’s automated privacy policy with customers in the UK, EEA or Switzerland, Shopify notes you may need to add the legal basis for each purpose, DPO contact details if you have appointed one, and a representative’s details if you have no establishment there. Talk to a privacy lawyer or data protection adviser about the markets you serve, and treat the wording in this article as a starting point.

Global selling adds another layer. Reform’s comparison of regional rules, from GDPR to CCPA, LGPD and PIPEDA, shows that opt-in and opt-out models differ by region. That is why conditional rendering by market is useful: it lets one account experience show the right wording to the right customer.

FAQ

Cookie consent covers tracking technologies such as analytics and marketing cookies, and Shopify’s banner handles it for Shopify’s own tools. Account consent covers choices customers make about marketing messages and the profile data they share with you. Treat them as separate prompts with separate wording.

Can I pre-tick the marketing checkbox?

Shopify lets you configure preselection by region, but many regimes treat pre-ticked boxes as invalid consent. Where you sell into opt-in regions, leave the box unticked. Confirm the rules for your markets with a privacy professional.

Give them a control on their account page that is as easy to use as the original checkbox, and include an unsubscribe link in every email. State the route in the original wording, for example “change this anytime under Account > Privacy.” Then test that the change reaches your email and SMS tools.

Does AccountCraft make my store GDPR compliant?

No app can do that. AccountCraft helps you collect, record and honor customer consent through Shopify’s customer privacy APIs, and customer data stays in Shopify. Compliance remains your responsibility, and we do not give legal advice.

Sources