Shopify’s banner and a fingerprinting script that ignored it
A script that sends a browser fingerprint ran before consent, after “Ablehnen” (Reject) and after withdrawal. Klaviyo also kept sending data after Reject.
C71/100
- Shop
- A German sports-nutrition shop on Shopify
- Consent tool
- Shopify Privacy (Customer Privacy API)
- Scanned
- Visited from
- United Kingdom
What we saw
- Before any choiceGoogle Analytics, Google Ads / DoubleClick and an unlisted tracking service were active 4.8 seconds after the page loaded.
- After “Ablehnen”Klaviyo and the unlisted service (a track.php call sending a fingerprint and the user agent) still sent requests.
- After withdrawingMicrosoft Clarity and the unlisted service still sent requests after “Alle ablehnen”.
Why it happened
Theme apps and pasted scripts run outside Shopify’s Customer Privacy API unless each one checks it.
How to fix it
- List every app and script in the theme, and remove the ones nobody uses.
- For the rest, use apps that read Shopify’s Customer Privacy API, or load them from Customer Events (pixels), which respects consent.
- Check Klaviyo’s onsite tracking settings so it waits for the visitor’s consent.
On Shopify, the banner only controls what asks it. Apps that don’t ask keep tracking.
Using Shopify Privacy too?
Check whether your tags actually listen to it. Free, about a minute.