Fix guide · Shopify · medium · about 30 min

OpenAI Pixel fires before cookie consent on Shopify

For the finding “OpenAI Pixel fires before cookie consent”. Also for: Any website, WordPress, Webflow, Framer.

What this means

Your store shows a cookie banner, but the OpenAI Pixel (OpenAI calls it the ChatGPT Ads Measurement Pixel; it loads oaiq.min.js from bzrcdn.openai.com) sent events to OpenAI while the banner was still waiting for an answer.

Two facts combine on Shopify:

  • The pixel assumes consent. OpenAI documents that it starts with consent set to true unless your code sets it to false, or it finds a denial stored from an earlier visit. A snippet pasted as it is measures from the first page load.
  • Shopify holds back only some code. Pixels under Settings > Customer events (app pixels and custom pixels) follow your customer privacy settings: where consent is required, they run only after the visitor has given the permissions the pixel needs. Code in your theme, Google Tag Manager (GTM) loaded from the theme, and scripts added by app embeds are not controlled by those settings; Shopify’s help says such pixels may need a third-party banner or custom logic to honor consent.

OpenAI does not make a Shopify app; the pixel arrives through a third-party ChatGPT Ads app, a custom pixel, theme code or GTM. An early-firing copy is usually in theme.liquid, a theme-loaded GTM container, an app embed, or a custom pixel set to not require permission.

Why it costs you money:

  • If you advertise to people in the EU, sending marketing data before consent is a legal risk you probably did not intend to take. We report the technical behaviour only; we cannot tell you whether your setup is compliant.
  • The banner and that copy of the pixel are not connected. When this is fixed in a hurry, the usual result is the opposite problem: the pixel stops sending anything and ChatGPT Ads lose their conversion data.

How to confirm it yourself

Our check runs from a browser in the EU. Shopify shows its cookie banner based on where the visitor is and on the regions set under Settings > Customer privacy (with automated settings, visitors in the EEA and the UK). If you are elsewhere, use a VPN with a European location or ask a colleague in the EU.

  1. Open your store in a private (incognito) window.
  2. Open developer tools (F12), go to the Network tab and type bzr.openai.com into the filter box.
  3. Reload the page. Do not click the cookie banner.
  4. Click each request and look at its payload: a list of events, each with a type. A page_viewed or shopping event (for example items_added) while the banner is open means the pixel measures before consent. Types starting with openai:: or oai::, and the configuration file from bzrcdn.openai.com, are the SDK’s housekeeping and do not count (OpenAI does not document these service messages).
  5. Find out where the copy runs. In the Console tab, type typeof oaiq. "function" means the pixel is loaded on the page itself: theme code, an app embed or GTM loaded by the theme. "undefined" while requests still leave means it runs in one of Shopify’s sandboxes, which are separate from the page: a custom pixel (a hidden frame) or an app pixel (a web worker).

Rely on the Network tab rather than cookies: a copy inside a custom pixel may not be able to write the pixel’s __obref cookie on your domain at all.

For custom pixels, Shopify’s Pixel Helper (click Test on the pixel under Settings > Customer events) shows “Pixel is awaiting consent” while the pixel waits.

How to fix

The goal: every copy of the OpenAI pixel either goes through Shopify’s customer privacy settings, or checks consent itself, or is removed.

  1. Find every copy. Check:

    • Settings > Customer events: app pixels from ChatGPT Ads apps (open the menu next to each one and choose View customer privacy) and custom pixels (open each one and look for oaiq or your Pixel ID in the code).
    • Theme code: go to Online Store, open the menu of your current theme and click Edit code. Open theme.liquid and search for oaiq.min.js, oaiq( and GTM-. Check the snippets it includes as well.
    • App embeds: Online Store > Edit theme > App embeds icon.
    • Apps: every ChatGPT Ads app you installed, including ones you only tried. Shopify lists an app under Customer events only if it uses Shopify’s Web Pixels API; other apps show up in the theme or under app embeds.
    • Your GTM container: OpenAI’s own GTM template, community templates such as Stape’s OpenAI Ads Pixel tag, and Custom HTML tags containing oaiq.

  2. Keep one copy that Shopify controls, normally an app pixel or a custom pixel. Delete the OpenAI snippet from theme.liquid and click Save, remove OpenAI tags from a theme-loaded GTM container, and turn off app embeds or app settings that add another copy. Theme code does not run on checkout pages anyway, so purchases need a Customer events pixel (or the Conversions API). A pasted OpenAI snippet in a custom pixel may never see oppref or may not keep the __oppref cookie, so test it as described in ChatGPT Ads click ID lost on Shopify.

  3. If you use an app pixel, View customer privacy should show that it requires Marketing. Shopify loads an app pixel only when the visitor has given every permission the app declares as required; if it requires no marketing permission, raise it with the app’s developer. Test any app with the steps above; we do not rank or recommend them.

  4. If you use a custom pixel, open it under Settings > Customer events. In the Customer privacy section, set Permission to Required and select Marketing. A custom pixel set to Not required runs whether or not the visitor has answered the banner. Save the pixel. You do not need oaiq("consent", false) inside it: Shopify does not start the pixel before consent. Adding it without a matching oaiq("consent", true) keeps the pixel silent.

  5. If you need GTM, Shopify recommends running it as a custom pixel rather than from theme.liquid; step 4 then applies to the whole container. If GTM stays in the theme, the OpenAI tag needs Advanced Settings > Consent Settings > Require additional consent for tag to fire with ad_storage, and something on the page must send Google consent updates to GTM. OpenAI’s GTM template does not call the pixel’s consent command, and its opt-out flag does not stop sending. Check it in GTM’s Preview mode.

  6. If you use a consent app instead of Shopify’s banner, check in its documentation that it is integrated with Shopify’s Customer Privacy API. Pixels under Customer events learn about the visitor’s choice only through that API.

  7. Check Settings > Customer privacy. If you chose banner regions yourself instead of automated settings, make sure every region where you need consent is selected.

  8. For code that must stay in the theme (a developer task), keep OpenAI’s loader but replace its init call with a consent check through Shopify’s Customer Privacy API. Visitors who accepted on an earlier visit start with consent true, so their stored click ID survives (OpenAI says oaiq("consent", false) removes the pixel’s cookies):

    var started = false, granted = false;

// Consent given on this page: switch it on and send the page view again,
// because OpenAI does not replay events blocked while consent was false.
function grant() {
  if (granted) return;
  granted = true;
  oaiq("consent", true);
  if (started) oaiq("measure", "page_viewed", { type: "contents" });
}

window.Shopify.loadFeatures(
  [{ name: "consent-tracking-api", version: "0.2" }],
  function (error) {
    if (error) return;
    var allowed = granted || window.Shopify.customerPrivacy.marketingAllowed();
    oaiq("consent", allowed);
    oaiq("init", { pixelId: "<YOUR-PIXEL-ID>" });
    started = true;
    if (allowed) {
      granted = true;
      oaiq("measure", "page_viewed", { type: "contents" });
    }
  }
);

document.addEventListener("visitorConsentCollected", function (event) {
  if (event.detail.marketingAllowed) grant();
});

    The two flags keep the order right if the visitor accepts before Shopify has loaded the consent API: init still comes first, and page_viewed is sent once. This example only handles granting consent. If a visitor withdraws consent later, your code also needs to call oaiq("consent", false).

Common causes

  • The installation snippet was pasted unchanged into theme.liquid. Without oaiq("consent", false) the pixel treats every visitor as consenting, and Shopify does not hold theme code back.
  • GTM is loaded from theme.liquid, and its OpenAI tag has no consent requirement.
  • A custom pixel has Permission set to Not required.
  • A ChatGPT Ads app adds the pixel through an app embed, or its app pixel does not require marketing permission.
  • An app you tried earlier still adds its pixel next to the one you use now.
  • A consent app is not connected to Shopify’s Customer Privacy API, or the banner regions leave out some countries.

How to verify the fix

  1. In a private window with a European location: no page_viewed or other measurement events before you answer the banner, a page_viewed event within a few seconds after you click “Accept” (on the same page), and none after “Reject” in a fresh private window.
  2. For a custom pixel, the Pixel Helper shows “Pixel is awaiting consent” until you accept.
  3. Re-run the check on IsPixelWorking. The issue should be gone, and “OpenAI Pixel does not fire after consent” should not appear in its place.

Questions people ask

Is there an official OpenAI app for Shopify?

Not at the time of writing. Several third-party apps in the Shopify App Store install the OpenAI pixel; none is made by OpenAI. For any of them, check that its pixel is listed under Settings > Customer events and requires marketing permission, then test it as described above.

Sources

Guides for your consent tool