Essential vs non-essential cookies: what’s the difference?
Only trackers strictly necessary for the service explicitly requested by the user are exempt from prior consent. Everything else isn’t.
The legal test
The exemption doesn't depend on the site's intent or how important the tracker feels — it's a strict test: the cookie must be indispensable to provide a service explicitly requested by the user. Shopping cart, session authentication, or technical load balancing fall in this bucket. Audience measurement, even “anonymised”, or personalisation are generally not covered by this exemption.
Typical Shopify examples
Essential: Shopify session cookie (`_shopify_s`), cart (`cart`), anti-bot protection. Non-essential: Meta Pixel, Google Analytics, Klaviyo, TikTok Pixel, most review or upsell apps that drop a tracking identifier. The EDPB publishes EU-level guidance on this distinction, but the qualification stays case-by-case based on the cookie’s actual use.
Common trap
The same tool (Google Analytics, for instance) can be configured to be more or less intrusive. A setup that anonymises the IP and disables advertising data sharing can, under strict conditions, get closer to an exemption — but the default configuration of most Shopify apps doesn’t meet those conditions.
Does your store follow these rules?
Our free scanner technically checks what fires before consent on your Shopify store, in ~30 seconds.
Scan my store for freeSources
Independent informational content, not affiliated with Shopify. Not legal advice; for an assessment of your situation, consult a lawyer or your DPO.