Consent and Shopify Customer Privacy
Máximo sends a shopper’s events to a destination only when the shopper’s consent allows it. Consent is read automatically from Shopify’s Customer Privacy API, so you don’t configure a separate consent map inside Máximo.
How consent is read
Section titled “How consent is read”Shopify’s consent banner (or any banner that writes to Shopify’s Customer Privacy API) records the shopper’s choice. Máximo reads that choice from the storefront in two places:
- On page load, from the current visitor consent state
- Whenever the shopper updates their choice mid-session (
visitorConsentCollected)
The conversion pixel and the Máximo Pixels theme app embed read the same Shopify signals, so destination tags and server-side events follow the same choice. Shopify loads the conversion pixel, which captures cart and checkout events, only for shoppers who allow analytics, marketing, and the sale of their data.
In the browser, Máximo follows what Shopify reports as allowed. Shopify works out, from your store’s privacy settings and where the shopper is, whether a shopper who hasn’t answered your banner counts as allowed. When a shopper grants consent later in the session, the relevant tags load from that point on. If they withdraw marketing consent mid-session, Máximo tells the ad platform tags it loaded to stop and removes the ad identifiers it had saved on the cart.
Shopify consent signals
Section titled “Shopify consent signals”Shopify exposes four shopper-facing consent flags. Máximo normalizes them as:
| Shopify Customer Privacy flag | Máximo treats as |
|---|---|
| Marketing allowed | Marketing |
| Analytics processing allowed | Analytics |
| Sale of data allowed | Sale of data |
| Preferences processing allowed | Preferences |
Only marketing, analytics, and sale of data affect destination delivery today. Preferences is recorded from Shopify but does not gate a destination.
Which consent each destination needs
Section titled “Which consent each destination needs”- Máximo’s own event capture needs analytics consent.
- Every ad platform needs marketing consent, both for its browser tag and for the events Máximo sends it from the server. That includes all of Google: Google Ads and GA4 need marketing consent, not analytics.
A shopper who opts out of the sale of their data isn’t sent to ad platforms either. The exception is Meta, TikTok, and Pinterest while their Limited Data Use setting is on, which it is by default: Máximo can send them that shopper’s events flagged for the platform’s limited data processing mode instead.
Catalog sync is your product data, not shopper tracking, so it isn’t gated on storefront consent.
When there’s no consent on record
Section titled “When there’s no consent on record”Some events reach Máximo with no consent decision on record for the shopper, for example an order placed outside your online store by someone who has never answered your banner. For an undecided shopper:
- In the EU/EEA, the UK, and Switzerland, Máximo never sends their events to a destination.
- Everywhere else, Máximo sends their events to a destination only when that destination’s enhanced matching switch is on. For Google Ads that switch is Enhanced conversions; for GA4 it’s User-provided data.
When Máximo can’t tell where the shopper is, it applies the rule for everywhere else.
Google: two layers
Section titled “Google: two layers”For Google Ads and GA4, consent works in two layers. They do different jobs.
Layer 1: Máximo’s gate. Before Máximo sends Google Ads or GA4 an event from the server, the shopper must allow marketing and must not have opted out of the sale of their data. This is the same rule as every other ad platform, and it applies whether or not the Google tag is on.
Layer 2: Google Consent Mode. When the Google tag (gtag.js) is on, Máximo sets Google Consent Mode v2 to denied before the tag loads, then updates it from Shopify. Google then decides how its tag may use cookies, ads storage, and modeling for that visit:
| Shopify signal | Google Consent Mode signal |
|---|---|
| Analytics | analytics_storage |
| Marketing | ad_storage |
| Marketing and sale of data | ad_user_data and ad_personalization |
So Máximo chooses whether a server-side Google event is allowed to leave. Consent Mode chooses how Google’s own tag behaves once it is on the page.
Consent Mode is on automatically whenever the Google tag is on. You don’t paste Consent Mode snippets into the theme for Máximo-managed Google tags.
When the Google tag loads
Section titled “When the Google tag loads”Outside the EU/EEA, the UK, and Switzerland, the Google tag loads on every page and follows Consent Mode from there. Inside those regions, and when Shopify can’t tell where the shopper is, the tag runs in Consent Mode’s basic mode: it waits until the shopper allows analytics or marketing. The same applies to a Google Tag Manager container that Máximo’s embed loads for you.
To load the tag right away in those regions too, turn on Advanced mode in Europe under Settings → Google → Tag. With it on, Google receives cookieless pings it uses to model conversions. Turning it on is a legal decision, so check with your counsel. See Google Ads, GA4, and tag.
What this means in practice
Section titled “What this means in practice”- For a shopper who allows analytics but declines marketing, Máximo sends no events to any ad platform from the server, Google Ads and GA4 included, and loads no ad platform tag except the Google tag. If the Google tag is on, it runs with analytics storage granted and ads storage denied.
- A shopper who allows marketing but opts out of the sale of their data isn’t sent to Google Ads or GA4. If the Google tag is on, Consent Mode grants ads storage but denies ad user data and personalization.
- A destination receives nothing for a shopper whose consent doesn’t allow it. Missing events for those shoppers are expected, not a delivery failure. See Troubleshooting.