accountcraft Install free
All articles

AccountCraft Journal

GDPR Checkbox for Shopify New Customer Accounts

How to add a GDPR consent checkbox to Shopify New Customer Accounts: native options, their limits, and a no-code way to let customers manage consent.

13 min read

To add a GDPR consent checkbox to a Shopify account, you have two layers to work with. Shopify’s own settings cover the sign-in page and checkout. For a consent control inside the account area, where customers can see and change their choices later, you need a customer account UI extension. You can add one without code through an app such as AccountCraft. Either way, the checkbox has to be unticked by default, say clearly what the customer agrees to, and be as easy to switch off as it was to switch on.

This guide is for Shopify merchants and agencies. It walks through the native settings first, then the gaps, then how to fill them. It does not give legal advice. Whether your consent flow meets GDPR is your responsibility as the data controller, so check the details with your own counsel or data protection adviser.

AccountCraft
Make Consent Easier to Manage
Add privacy consent blocks to Shopify New Customer Accounts, so customers can view and change their choices without theme edits.
Install AccountCraft

TL;DR

  • Shopify can show a marketing consent checkbox on the New Customer Accounts sign-in page and at checkout. You switch it on under the checkout settings in your admin.
  • GDPR consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes do not qualify, and withdrawing must be as easy as giving.
  • For a consent block inside the account area, use a customer account UI extension. AccountCraft offers privacy consent and SMS consent blocks built on Shopify’s official extensions, with no theme edits.
  • An app helps you collect, record and honor consent through Shopify’s customer privacy APIs. It does not make a store “compliant”. That stays with you.

Table of Contents

What a valid GDPR checkbox needs

The European Data Protection Board (EDPB) sets the bar in its guidelines on consent. Four elements matter for a checkbox:

  1. Freely given. The customer has a real choice. Consent bundled into non-negotiable terms is not free, as the EDPB’s consent summary explains. Do not make newsletter consent a condition of creating an account.
  2. Specific. One checkbox, one purpose. “Email me offers” and “share my data with partners” are separate choices.
  3. Informed. The customer sees who you are, what you will send or do, and that they can withdraw.
  4. Unambiguous. It takes a clear action from the customer. A pre-ticked box is not that.

Two more duties surface later. You must be able to show that consent was given, and the EDPB guidance places that burden on the controller. And under Article 7(3), withdrawing consent must be as easy as giving it. If a customer ticked a box in two seconds, they should not need to email support to undo it.

That last point is where most account setups fall short, and it is why a checkbox in the sign-in form is only half the job.

What Shopify gives you natively

Shopify covers several touchpoints without any app.

Shopify’s changelog says that if you have enabled marketing consent at checkout, the same checkbox now appears on the New Customer Accounts sign-in page. It uses the region settings you already set, and customers can manage their marketing preferences from their account profile page.

To set it up:

  1. In your Shopify admin, go to Settings > Checkout.
  2. Find the Marketing opt-in section.
  3. Choose the email and SMS options you want to offer.
  4. Check the preselection setting for each region. For EU and UK customers, do not preselect the box.

Shopify’s help page on customization options for upgrading customer accounts lists the marketing consent checkbox on the sign-in page and at checkout as a built-in feature. It also covers the options that need an app or developer work.

You can change the wording next to the checkbox. Shopify’s guide to collecting customer contact information says the email and SMS opt-in text can be edited through your theme’s language editor. Use it to name your brand and say what people will receive.

Under Settings > Customer privacy, you can configure your privacy policy, cookie banner and data sales opt-out page, view installed privacy apps and manage some marketing settings. This is described in Shopify’s GDPR help page. Shopify also states there that using its tools helps with GDPR, but the legal obligations remain with you.

The privacy settings documentation adds the key technical point. If you use Shopify’s automated privacy settings, or third-party tools built on the Customer Privacy API, Shopify respects the consent choices on your site. Tools that do not report through that API are the risk: a customer can opt out in a custom form while your pixels carry on, because the signal never reached Shopify.

Customer privacy choice flowing to Shopify and pixels

Where the native checkbox stops

The sign-in checkbox captures a decision at one moment. After that, consider what a customer with an account can do.

  • They can change marketing preferences on the profile page, but you cannot put a clearly worded privacy block next to their order history or addresses.
  • You cannot add an SMS consent control with its own explanation inside the account area.
  • You cannot show a different consent block to EU customers than to US customers.
  • You cannot add your own fields, for example a communication-preference question stored on the customer record.

None of that is a flaw in the native settings. They are a sound baseline. But if you sell in the EU or UK, or you simply want customers to see and change consent in the same place they manage their details, you need a custom block.

Shopify’s route for that is a customer account UI extension. These are sandboxed and limited to specific UI components and APIs. Extensions that need customer data must go through Shopify’s protected customer data process.

A developer can build an extension, but most merchants should not have to. A block-based app does the same job through official extensions, and you assemble the page in the Shopify admin.

The technical side is worth knowing so you can judge any app, including ours. Shopify’s Customer Privacy API for account extensions lets an extension read and change consent. Applying a consent change requires the collect_buyer_consent capability, which Shopify explains under extension capabilities for customer accounts. Shopify’s Customer Privacy API reference warns against reading or writing cookies yourself. Use the API so consent is registered across Shopify-managed surfaces.

An app that follows these rules gives you three things:

  • Consent that Shopify knows about. The choice is written through the official API, not into a side database.
  • Consent the customer can revisit. The control sits in their account, so withdrawing takes a click.
  • No theme changes. Extensions render inside New Customer Accounts, so a theme update will not break them.

If you are comparing options, a roundup such as this overview of Shopify security plugins helps separate store security tools from consent tools. They solve different problems, and a security plugin will not give customers a place to manage consent.

Set it up with AccountCraft

AccountCraft is a Shopify app with a visual Block Builder for New Customer Accounts. Its 14 block types include a privacy consent block and an SMS consent block, alongside text, banner, button, card, update form, single field, record list, wishlist, image, video, spacer and divider. Here is a practical setup.

  1. Install the app. Open the AccountCraft listing on the Shopify App Store and install it. There is a free plan, and the paid Pro and Plus plans are billed through Shopify. Check the listing for current pricing.
  2. Confirm New Customer Accounts are on. In your Shopify admin, open Settings > Customer accounts and make sure New Customer Accounts is selected. If you are still on legacy customer accounts, you are migrating away from them, so do that first. Our start guide covers the move.
  3. Open the Block Builder and pick the account page where consent should live. A dedicated “Privacy” or “Communication preferences” page is easier for customers to find than a block buried on the profile page.
  4. Add a privacy consent block. Write the label in plain words: what you will send, how often, and that the customer can switch it off here at any time. Keep the default unticked.
  5. Add an SMS consent block if you send texts. Keep it separate from email, because it is a different purpose and often a different legal regime.
  6. Add a text block above them with a link to your privacy policy and your contact details.
  7. Add translations for each language you sell in. A consent notice the customer cannot read is not informed consent.
  8. Set conditional visibility if needed. AccountCraft can show or hide blocks by customer tag, metafield, market, B2B status and account age. For example, you can show a longer notice only to customers in your EU market.
  9. Test it. Sign in as a test customer, tick the box, untick it, and then check the customer record in Customers in your admin to see the marketing status change.

Customer data stays in Shopify. AccountCraft has no separate customer database, and its fields bind to customer metafields. For the full walkthrough, including how to test your pixels after a consent change, see our guide to customer consent in Shopify.

Wording that holds up

The checkbox is only as good as the sentence beside it. Compare these two:

Weak Better
“I agree to receive updates” “Email me about new products and offers from [Brand]. You can change this at any time in your account.”
“I accept marketing and partner offers” Two separate boxes: one for your own emails, one only if you truly share data, with the partner named
A ticked box at sign-up An unticked box the customer chooses to tick
“Unsubscribe by contacting support” A toggle in the account page, plus the unsubscribe link in every email

The examples above are our drafting suggestions, not legal templates. Have your counsel review the final text, especially if you process data for purposes beyond marketing.

The EDPB expects you to be able to demonstrate consent. A tick in an interface is not enough if you cannot show what the customer saw when they ticked it. Practical habits:

  • Save a dated copy of each version of your consent wording and privacy policy.
  • Note when you changed the checkbox text or the account page layout.
  • Keep consent in Shopify’s customer records rather than in a spreadsheet or a separate tool that can drift out of sync.
  • Consider confirmed opt-in for email. Our post on double opt-in in Shopify covers it.
  • Review old records. Our article on consent expiry for EU stores explains why no fixed GDPR deadline exists, and what you should still review.

Our perspective

We see the same pattern in New Customer Accounts migrations. Merchants spend a day on the cookie banner and checkout box, then treat consent as finished. The customer who signed up two years ago has no place to look at what they agreed to.

We built the privacy consent block and the SMS consent block because the account page is where people already go to manage their details. If someone can update an address and a phone number there, they should be able to change a marketing choice in the same spot. It is also the simplest way to meet the principle that withdrawing consent should be as easy as giving it.

Our perspective — overview diagram

We are also strict about what an app can claim. AccountCraft helps you collect, record and honor consent through Shopify’s customer privacy APIs, using official Customer Account UI Extensions. It does not and cannot make a store compliant. Compliance depends on your wording, your purposes, your processors and your records, and those belong to you. Be wary of any tool that says otherwise.

The practical advice we give agencies: keep consent in one system of record, which for Shopify stores means Shopify. Every extra copy is another place where an opt-out can fail to propagate.

— Ivan Signorile

Common mistakes to avoid

  • Preselected boxes for EU and UK customers. Check the region settings under checkout marketing opt-in.
  • One box for everything. Separate email, SMS and any third-party sharing.
  • Custom forms that bypass the API. If consent is stored in a metafield or a third-party tool that never tells Shopify, your pixels and email tools may not see the change.
  • No withdrawal path. Add a visible control in the account area, not only an unsubscribe link.
  • Copying wording without checking it. Templates from blog posts, including ours, need review for your actual processing.
  • Ignoring other regions. US readers should note that California rules differ from GDPR. We cover the admin steps in Shopify CCPA compliance.

Try it on your store

If your store is on New Customer Accounts and you want a privacy block inside the account area, you can install AccountCraft free from the Shopify App Store. You can also see the plans on the AccountCraft site. Build the consent page in the Block Builder, test it with a dummy customer, and have your adviser review the wording before you publish.

For related setups, see our guides on Shopify account custom fields and GDPR-ready B2B accounts.

FAQ

Does Shopify add a GDPR checkbox automatically?

Shopify offers a marketing consent checkbox at checkout and, per its changelog, on the New Customer Accounts sign-in page once you enable marketing opt-in in your checkout settings. You still choose the regions, the preselection behavior and the wording. Whether the result meets GDPR for your business is for you and your adviser to decide.

Can the checkbox be ticked by default?

For GDPR purposes, no. The EDPB guidance says consent needs a clear affirmative action from the customer, and pre-ticked boxes do not provide that. Check your region preselection settings so EU and UK customers see an empty box.

The simplest way is a consent control on a page inside New Customer Accounts, so withdrawing takes about as much effort as opting in. Shopify’s profile page lets customers manage marketing preferences, and an app block such as AccountCraft’s privacy consent block adds a dedicated, branded control. Keep the unsubscribe link in your emails as well.

Do I need an app for this?

Not always. If a sign-in and checkout checkbox plus the profile page meet your needs, the native settings may be enough. An app helps when you want a custom consent block, SMS consent, translations or conditional display inside the account area without writing an extension yourself.

Does AccountCraft make my store GDPR compliant?

No, and no app can. AccountCraft helps you collect, record and honor consent through Shopify’s customer privacy APIs, and customer data stays in Shopify. Compliance remains your responsibility as the data controller.

Sources