What Cookies Require Consent Before They Load on an Ecommerce Store?
The Dividing Line Is Function, Not Ownership
Merchants usually ask whether a cookie is first-party or third-party. That is the wrong first question. The test regulators apply is whether the cookie is strictly necessary to deliver a service the shopper explicitly asked for.
A shopper asks for a working cart. They do not ask to be added to a retargeting audience. So the cart cookie is exempt and the advertising cookie is not, even if you set both from your own domain.
This trips people up because a first-party cookie feels safer. It is not automatically exempt. Google Analytics sets a first-party cookie and still needs consent, because measuring your funnel is your business goal and not the shopper's request. Meanwhile a third-party cookie from a payment processor performing a fraud check during checkout can be exempt, because that check is part of the transaction the shopper initiated.
The second half of the test is timing. Consent has to come first. A store on OpoShop that loads five tracking scripts and then removes their cookies when someone clicks reject has already read and written to that device. The obligation was on the load, not the cleanup.
Cookies That Always Require Consent
These are the categories that need an affirmative opt-in on essentially every ecommerce store. If any of them exist on your storefront, you need a working consent layer.
- Analytics and measurement: Google Analytics 4, and anything else that assigns a visitor identifier so you can count sessions, sources and funnels.
- Advertising and retargeting: Meta Pixel, TikTok Pixel, Google Ads conversion and remarketing tags, Pinterest Tag, Snap Pixel, and any partner or affiliate tracking cookie.
- Tag managers: Google Tag Manager itself is a loader, and it needs consent gating because of everything it can inject downstream.
- Session recording and heatmaps: Hotjar, Microsoft Clarity, and similar tools that replay how a shopper moved through your pages.
- A/B testing and personalisation: Any tool that assigns a shopper to a variant and remembers that assignment across visits.
- Social and video embeds: A YouTube player, a Vimeo embed or a social feed widget that sets cookies from its own domain the moment the page renders.
- Live chat and support widgets: Many set persistent identifiers well before a shopper opens the chat window.
The last two catch people out most often. A merchant blocks their pixels carefully, then leaves a product-page video embed that sets advertising cookies from the first render. That embed is doing exactly what the pixel does, from a different address.
Chat widgets deserve their own note. If the widget only sets a cookie once a shopper opens it and starts a conversation, that is much closer to a service the shopper asked for. If it fingerprints every visitor on arrival to build a profile, it is a tracker with a chat bubble attached.
The practical rule for a store on OpoShop is to judge each script by what it does at page load, not by the category the vendor markets it under. A tool sold as "customer experience" that assigns a persistent visitor ID on arrival belongs in the consent bucket alongside your pixels.
Cookies That Do Not Require Consent
The exempt list is shorter than merchants expect, and it is the list you should keep tight. Every item on it should be defensible in one sentence.
- Cart and checkout state: Holding what the shopper added and carrying it to checkout.
- Authentication and session: Keeping a logged-in customer logged in for the duration of their visit.
- Security and fraud prevention: Load balancing, bot protection, and payment fraud checks tied to the transaction.
- User-set preferences: Currency, language or region the shopper actively chose.
- The consent record itself: The cookie storing what the shopper decided, which is exempt because without it you would ask on every page.
Notice what is missing. There is no exemption for "we only use it internally", no exemption for aggregated reporting, and no exemption for cookies you consider low risk. Intent does not move a cookie between categories. Function does.
One practical consequence for a store on OpoShop: your essential list should stay stable for months at a time. If it grows every time you install an app, something has been misclassified.
The Grey Zone, and How to Handle It Safely
A few cases genuinely sit between the two lists, and merchants waste hours arguing about them. There is a simple way to resolve each one.
First-party analytics is the biggest grey area. Some regulators have signalled tolerance for narrowly scoped, first-party, aggregate-only audience measurement that never leaves your control and is never used for advertising. Standard Google Analytics does not meet that description, because the data goes to a third party and feeds advertising products.
Fraud and bot protection can drift. A cookie that scores a checkout attempt is defensible. The same vendor's cookie used to build a cross-site device graph is not, even though it comes from the same script.
Affiliate attribution is the one merchants most want to keep. It looks operational, since it decides who gets paid. It still tracks an individual across sites, so it sits on the consent side of the line.
The safe method is to default to consent when a case is genuinely arguable. The cost of gating one borderline cookie is a slightly thinner dataset. The cost of misclassifying a tracker as essential is that your entire consent setup can be called cosmetic.
Write the reasoning down as you go. A short note next to each grey-zone cookie explaining why you placed it where you did is the difference between a defensible decision and a guess. Most OpoShop merchants end up with three or four of these notes, and they take about ten minutes to produce.
How to Audit Which Cookies Your Store Actually Sets
Do not work from a vendor list or your own memory. Open the store and look, because themes and apps set things nobody documented.
The three parts worth doing carefully are below.
1. Look before you click, not after
The whole audit hinges on the pre-consent snapshot. Load the page, touch nothing, then screenshot the storage panel and the network log filtered to third-party domains.
Anything in that snapshot beyond your essential list is loading without permission right now. That list is your work queue, and it is usually longer than the merchant guessed by three or four entries.
2. Trace each cookie back to the app that set it
A cookie name on its own means nothing. Match it to a script source, and match that script to a specific app or theme feature you can turn off.
This is also how you find orphans. Uninstalled apps regularly leave a script tag behind in the theme, which keeps setting cookies for a tool you stopped paying for. In an OpoShop store, cleaning those out shrinks both your compliance surface and your page weight in the same pass.
3. Prove the block with a declined session
The final check is the one most stores skip. Reload with everything declined and read the network log again.
If a request to an advertising domain still appears, blocking is not working, no matter what the banner says on screen. Present-then-deleted is a fail. Absent is a pass.
Strictly Necessary vs Analytics vs Marketing Cookies
Three categories cover almost every cookie on a store, and each has a different consent posture. Getting the split right makes the banner simple to write.
| Category | Typical examples | Consent needed | If the shopper declines |
|---|---|---|---|
| Strictly necessary | Cart, session, fraud checks, consent record | No, exempt by function | Nothing changes, store works normally |
| Analytics | Google Analytics, Clarity, Hotjar | Yes, before the tag loads | Visit is unmeasured in your reports |
| Marketing | Meta Pixel, TikTok Pixel, Google Ads tags | Yes, before the tag loads | No retargeting or platform conversion signal |
Strictly necessary should be shown as always on in your banner, with a plain explanation rather than a toggle, since there is nothing to decide.
Analytics is the category with the highest opt-in rate, because shoppers broadly accept being counted. Explaining it in one honest sentence ("helps us see which pages are useful") does more for opt-in than any design trick.
Marketing is where most declines happen, and that is fine. A store on OpoShop with a smaller but consented retargeting audience is on much firmer ground than one with a large audience it cannot show permission for.
What We Recommend for [OpoShop](https://oposhop.io) Merchants
Build the list from observation, keep the essential category small, and put everything else behind a real block.
Three moves cover most stores. Run the pre-consent snapshot and write down every cookie you find. Classify each one by function with a one-line justification you would be comfortable sending to a regulator. Then configure the consent layer so declining removes the request entirely rather than cleaning up afterwards.
Two habits keep it accurate over time. Re-run the audit whenever you install or uninstall an app, since that is when new cookies appear. And review the essential list quarterly, because it is the list most likely to accumulate things that do not belong.
If you sell mostly to the EU or UK, treat the pre-consent snapshot as the compliance artefact worth keeping. If you sell mostly to California, the same inventory feeds your "do not sell or share" disclosures.
Best answer: Any cookie that is not strictly required to run the cart, the session, security or a preference the shopper set needs consent before it loads. That means analytics, advertising, session recording, testing tools and most embeds stay blocked until opt-in in your OpoShop store, while cart, login, fraud and the consent record itself run freely.
Audit what loads today, then make the block real rather than cosmetic.
FAQs
Do first-party cookies need consent?
Often yes. Being set from your own domain does not make a cookie exempt. Google Analytics uses a first-party cookie and still needs consent, because the test is whether the cookie is strictly necessary for the shopper, not who set it.
Does a shopping cart cookie need consent?
No. A cart cookie delivers the service the shopper explicitly asked for, so it is strictly necessary and exempt. You should still list it in your cookie disclosure so shoppers can see it exists.
What about cookies my theme sets that I did not add?
They count the same as any other. Themes and installed apps set cookies on your behalf, and the obligation sits with you as the store owner, so include every one of them in your OpoShop audit and classify them like anything you added yourself.
Is it enough to delete cookies after someone declines?
No. The regulated act is reading or writing to the device, so a cookie that was set and then deleted was still set without permission. The script has to be prevented from running in the first place.
Do session recording tools like Hotjar need consent?
Yes. Session recording captures detailed behaviour and often incidental personal data on forms, so it is squarely non-essential and needs an affirmative opt-in before the script loads.
How often should I re-audit my cookies?
Re-check whenever you add or remove an app or change your theme, and do a full pass every quarter. New cookies almost always arrive with new apps, and orphaned scripts from removed apps are the most common surprise.
Want to know exactly what your storefront sets before a shopper clicks? Start with the store platform itself.
