CNIL & Shopify: Avoid Cookie Fines Without Consent

Audit & Compliance : CNIL & Shopify (EN)

The Regulatory Framework and CNIL Sanctions

The e-commerce ecosystem, especially platforms like Shopify, is under increased scrutiny from the French National Commission for Information Technology and Civil Liberties (CNIL). Non-compliance with the requirements of the General Data Protection Regulation (GDPR) and the ePrivacy directive ↗, particularly concerning the management of cookies and other trackers, exposes businesses to colossal financial penalties and irreversible damage to their reputation. For Shopify merchants, often reliant on third-party applications and external scripts, the complexity of compliance is exponential.

GDPR, ePrivacy, and CNIL Doctrine

The GDPR (Regulation (EU) 2016/679) mandates 'free, specific, informed, and unambiguous' consent for the processing of personal data. The ePrivacy directive (2002/58/CE, known as the 'cookie directive'), transposed into French law, specifies that any access to or storage of information on a user's device is subject to their prior consent, except for strict exceptions (cookies strictly necessary for the service). The CNIL, through its guidelines and formal notices, has clarified that merely continuing to browse does not constitute valid consent. Consent must be active, granular, and revocable at any time. Consent banners that do not offer a refusal option as simple as acceptance, or that pre-check options, are illegal.

Case Law and Famous Fine Cases

The CNIL has demonstrated its determination to enforce these principles by imposing record fines on digital giants. These cases serve as case law and a warning for all businesses, including Shopify e-merchants, who must understand that company size is not a shield against penalties.

Official sources: CNIL decisions · SAN-2023-009 (Criteo, €40M) · SAN-2022-027 (TikTok, €5M) · DPC (LinkedIn, €310M)

These examples highlight the crucial importance of impeccable consent management. For a Shopify merchant, this means that every script, every pixel, every third-party application that places a cookie or accesses information on the user's device must be conditioned by explicit consent.

In-Depth Technical Audit of Your Shopify Store

A rigorous technical audit is the essential first step to identify and map all trackers present on your Shopify store. Without this visibility, any attempt at compliance is doomed to fail.

Tracker Identification (First-party, Third-party)

Trackers can be first-party (placed by your domain) or third-party (placed by external services like Google Analytics, Facebook Pixel, Shopify apps, etc.). It is imperative to list them exhaustively. This includes HTTP cookies, local storage objects (localStorage, sessionStorage), IndexedDB, invisible pixels, and scripts that collect data without placing a persistent tracker.

Methodology:

• Source code analysis: Look for <script>, <iframe>, <img> tags with src attributes pointing to third-party domains.
• Shopify Apps: Each installed app can potentially place cookies or trackers. Check their documentation and practices.
• Shopify Theme: Themes may include embedded scripts.
• Google Tag Manager (GTM): If you use GTM, audit each tag, variable, and trigger to understand their behavior.

Audit Methodology with DevTools

Browser-integrated developer tools (Chrome DevTools, Firefox Developer Tools) are your best allies for a real-time audit.

1. Accessing DevTools: Open your Shopify store in a browser, then press F12 (Windows/Linux) or Cmd+Option+I (macOS).
2. Network Tab:
   • Refresh the page (Ctrl+R or Cmd+R) with DevTools open.
   • Filter by resource type (JS, XHR, Img) and by domain to identify requests to third-party services.
   • Examine response headers (Set-Cookie) and request headers (Cookie) to detect cookies being set or sent.
   • Before consent: Browse your site without interacting with the consent banner. No non-essential cookies should be placed.
3. Application Tab:
   • Storage > Cookies: Lists all cookies by domain. Check their name, value, domain, path, expiration, and attributes (HttpOnly, Secure, SameSite).
   • Storage > Local Storage / Session Storage: Identify locally stored data.
   • Storage > IndexedDB: Check client-side databases.
   • Cache Storage: Examine service worker caches.
4. Console Tab: Monitor errors and warnings, which can sometimes indicate issues with script loading or data management.
5. Scenario testing: Repeat the audit after accepting all cookies, then after refusing all cookies, and finally after choosing granular preferences. Ensure that tracker behavior aligns with user choices.

Implementing a Compliant CMP and Prior Blocking

A Consent Management Platform (CMP) is essential for managing consent. However, its mere deployment does not guarantee compliance. Prior blocking of trackers is the cornerstone of compliance.

Choosing and Configuring a CMP (Shopify Apps)

Several CMPs are available on the Shopify App Store (e.g., OneTrust, Cookiebot, Didomi, Axeptio). When choosing, consider the following criteria:

• CNIL/GDPR Compliance: The CMP must be explicitly designed for European compliance.
• Automatic Blocking: The CMP must be able to block scripts and cookies before consent.
• Granularity: Allow users to choose by cookie category (analytical, marketing, preferences).
• Proof of Consent: Record and store proof of consent.
• Shopify Integration: Ease of integration with the theme and apps.
• Customization: Ability to adapt the banner's appearance.

Once chosen, the CMP configuration must be meticulous. Each third-party script must be correctly identified and categorized within the CMP for the blocking mechanism to function.

Cookie Blocking Strategies (GTM, JS DOM)

Prior blocking means that no non-essential cookies should be placed before the user has given explicit consent. This requires code-level blocking techniques.

1. Blocking via Google Tag Manager (GTM):

If you use GTM, you can condition the triggering of your tags on the consent status. Most modern CMPs integrate GTM tag templates or data layer (dataLayer) variables that reflect consent status.

// GTM trigger example based on consent
// Assuming your CMP pushes a 'consent_update' event with the status

// Data Layer variable for consent status
function() {
  return window.dataLayer.find(item => item.event === 'consent_update')?.consentStatus || 'unknown';
}

// Trigger for Google Analytics (if 'analytics' consent is given)
// Type: Custom Event
// Event Name: consent_update
// Conditions: {{Consent Status}} contains 'analytics_granted'

For custom HTML tags, you will need to wrap the script in a condition:

<script>
  if (window.myCmpApi && window.myCmpApi.hasConsent('analytics')) {
    // Your Google Analytics code or other analytical script here
    (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
    })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
    ga('create', 'UA-XXXXX-Y', 'auto');
    ga('send', 'pageview');
  }
</script>

2. JavaScript Blocking (DOM Manipulation):

For scripts directly integrated into the Shopify theme or applications not managed by GTM, you will need to modify their loading. A common technique is to change the script's MIME type or add a data-cmp-category attribute, then let the CMP reactivate it.

<!-- Before: <script src="https://example.com/marketing.js"></script> -->
<!-- After (for CMP blocking): -->
<script type="text/plain" data-cmp-category="marketing" src="https://example.com/marketing.js"></script>

<!-- Or manual blocking via JS -->
<script>
  document.addEventListener('DOMContentLoaded', function() {
    if (!window.myCmpApi || !window.myCmpApi.hasConsent('marketing')) {
      const scriptToBlock = document.querySelector('script[src="https://example.com/marketing.js"]');
      if (scriptToBlock) {
        scriptToBlock.remove(); // Or change its type to prevent execution
      }
    } else {
      // If consent is given, dynamically load the script
      const script = document.createElement('script');
      script.src = 'https://example.com/marketing.js';
      document.head.appendChild(script);
    }
  });
</script>

This approach requires in-depth knowledge of your Shopify theme's code and scripts injected by applications.

Consent Management and Proof of Compliance

Beyond technical blocking, consent management involves the ability to prove that consent was validly collected and that user choices have been respected.

The "Consent Receipt" and its Evidential Value

A "Consent Receipt" (or proof of consent) is a timestamped record of a user's consent preferences. It must include:

• The user's unique identifier (anonymized if possible).
• The date and time of consent.
• The version of the privacy policy and consent banner.
• The categories of cookies or purposes accepted/refused.
• The user's IP address at the time of consent (for evidentiary purposes, but not to be retained indefinitely).

This receipt is crucial in the event of a CNIL audit. Most professional CMPs offer this functionality.

{
  "consentId": "uuid-v4-example-12345",
  "userId": "hashed-user-id-abcde",
  "timestamp": "2026-08-09T14:30:00Z",
  "consentVersion": "1.2",
  "policyVersion": "2.1",
  "ipAddress": "192.168.1.1",
  "consents": {
    "analytics": "granted",
    "marketing": "denied",
    "preferences": "granted",
    "functional": "granted"
  },
  "source": "web-shopify-store"
}

Optimizing Consent Rate and UX

A compliant consent banner should not harm the user experience or the consent rate. Optimization practices include:

• Clarity and simplicity: Clear, non-legalistic language.
• Non-intrusive design: The banner must be visible but should not block access to content before interaction.
• Balanced choices: "Accept All" and "Refuse All" (or "Manage My Choices") buttons should be similar in size and color.
• Customization: Allow users to easily manage their preferences via a persistent link (e.g., in the footer).
• A/B Testing: Test different wordings and designs to find the balance between compliance and performance.

GDPR compliance is not merely an obstacle, but an opportunity to strengthen customer trust. Transparent and respectful management of personal data can become a competitive advantage for your Shopify store.