Fix guide · Shopify · medium · about 30 min

Meta Pixel fires before cookie consent on Shopify

For the finding “Meta Pixel fires before cookie consent”. Also for: Any website, WordPress, Webflow, Framer.

What this means

Your store shows a cookie banner, but the Meta Pixel (still often called the Facebook Pixel) sent data to Meta while the banner was still waiting for an answer.

On Shopify, pixels under Settings > Customer events (the pixel of Meta’s Facebook & Instagram app, other app pixels and custom pixels) follow your customer privacy settings: where consent is required, they run only after the visitor has given the permissions the pixel needs. Code in your theme, Google Tag Manager (GTM) loaded from the theme, and scripts added by app embeds are not controlled by those settings automatically; Shopify’s help says such pixels may need a third-party banner or custom logic to honor consent. An early-firing pixel on Shopify is usually one of those, or a custom pixel set to not require permission.

Why it costs you money:

  • If you advertise to people in the EU, sending marketing data before consent is a legal risk you probably did not intend to take. We report the technical behaviour only; we cannot tell you whether your setup is compliant.
  • The banner and that copy of the pixel are not connected. When this is fixed in a hurry later, the usual result is the opposite problem: the pixel stops firing entirely and your ads optimize blind.

How to confirm it yourself

Our check runs from a browser in the EU. Shopify shows its cookie banner based on where the visitor is and on the regions set under Settings > Customer privacy (with automated settings, visitors in the EEA and the UK). If you are elsewhere, use a VPN with a European location or ask a colleague in the EU, otherwise you may not see the banner at all.

  1. Open your store in a private (incognito) window.
  2. Open developer tools (F12), go to the Network tab and type facebook.com/tr into the filter box.
  3. Reload the page. Do not click the cookie banner.
  4. If facebook.com/tr requests appear while the banner is still showing, the pixel fires before consent. In Chrome they may show the type ping (the pixel uses sendBeacon). In the request payload, id is your pixel ID and ev is the event name.
  5. Look at the dl field in the same payload: it is the page address the pixel reports. If it contains /web-pixels@ and /sandbox/, the request came from a custom pixel, which Shopify runs in a hidden sandbox frame. If it shows your normal page address, the request came from code on the page itself: your theme, an app embed, GTM loaded by the theme, or an app.

Meta Ads Data Advisor (Meta’s Chrome extension, formerly Meta Pixel Helper) and the Test events tool in Meta Events Manager (Data sources > your pixel > Test events, then enter your URL and click Open website) show the same from Meta’s side.

How to fix

The goal: every copy of the Meta Pixel either goes through Shopify’s customer privacy settings or is removed.

  1. Find every copy of the pixel. Check:
    • Sales channels > Facebook & Instagram: under Settings > Data sharing settings, whether customer data sharing is on and which pixel is connected.
    • Settings > Customer events: app pixels (open the menu next to each one and choose View customer privacy) and custom pixels (open each one and look for fbq or your pixel ID in the code).
    • Theme code: go to Online Store, open the menu of your current theme and click Edit code. Open theme.liquid and search for fbevents.js, fbq( and GTM-. Check the snippets your theme includes as well.
    • App embeds: go to Online Store, click Edit theme, then the App embeds icon. Tracking, review and pop-up apps often add code here.
    • Your GTM container, if the theme loads one: look for Meta Pixel tags and Custom HTML tags containing fbq.
  2. Keep one copy that follows Shopify’s privacy settings. For most stores this is the Facebook & Instagram app’s pixel. Delete the Meta pixel code from theme.liquid and click Save, remove the Meta tags from a theme-loaded GTM container, and turn off app embeds or app settings that add another Meta pixel.
  3. If you use a custom pixel instead, open it under Settings > Customer events. In the Customer privacy section, set Permission to Required and select Marketing. A custom pixel set to Not required runs whether or not the visitor has answered the banner. Save the pixel.
  4. If you need GTM, Shopify recommends running it as a custom pixel rather than from theme.liquid; step 3 then applies to the whole container. If GTM stays in the theme, the Meta tag needs Advanced Settings > Consent Settings > Require additional consent for tag to fire with ad_storage, and something on the page must send Google consent updates to GTM when the visitor answers. Check in GTM’s Preview mode that this happens.
  5. Check Settings > Customer privacy. With automated settings on, Shopify shows its banner to visitors in the EEA and the UK when those are among your markets. If you chose regions yourself, make sure every region where you need consent is selected.
  6. If you use a consent app instead of Shopify’s banner, check that it is integrated with Shopify’s Customer Privacy API (see the app’s documentation). Shopify’s pixels learn about the visitor’s choice only through that API. Without it, they follow Shopify’s own settings instead of the app’s banner, so they can run before the banner is answered (or never run at all).
  7. For code that must stay in the theme (a developer task), wrap it in a consent check. Shopify’s Customer Privacy API offers marketingAllowed() and publishes a visitorConsentCollected event when consent changes. Meta’s own commands fbq('consent', 'revoke') and fbq('consent', 'grant') pause and resume sending.

Common causes

  • Meta pixel base code is still in theme.liquid from before the Facebook & Instagram app was connected, or was added later by an agency.
  • GTM is loaded from theme.liquid, and its Meta tag has no consent requirement.
  • A custom pixel has Permission set to Not required.
  • An app adds its own Meta pixel through an app embed and does not wait for consent.
  • A consent app is not connected to Shopify’s Customer Privacy API, or the banner regions leave out some countries.

How to verify the fix

  1. In a private window with a European location: no facebook.com/tr requests before you answer the banner, requests right after you click “Accept” (on the same page), and none after “Reject” in a fresh private window.
  2. For a custom pixel, Shopify’s Pixel Helper (click Test on the pixel under Settings > Customer events) shows “Pixel is awaiting consent” until you accept.
  3. Re-run the check on IsPixelWorking. The issue should be gone, and “Meta Pixel does not fire after consent” should not appear in its place.

Sources