Shopify Compliance in Italy: Technical Privacy, Cookie and Data Checklist

Direct answer: no Shopify configuration can be declared universally “compliant”. Compliance depends on the business, products, markets, data processing, installed tools and documentation. My work is to verify and implement the technical layer; privacy, tax and legal positions must remain aligned with the guidance of the relevant professionals.

Privacy and cookies

I check which cookies and tracking tools load, what happens before and after consent, how choices can be withdrawn or changed and whether the banner matches the tools actually present.

The Italian Data Protection Authority guidelines require non-technical tracking tools not to activate without consent and state that the banner should not be presented indefinitely. One of the situations in which a new request may be shown is after at least six months have passed.

Iubenda on Shopify: how to integrate it without creating two consent systems

Shopify allows the use of a third-party cookie banner or consent management platform, but the setup must remain integrated with Shopify's Customer privacy settings. Shopify's native banner governs Shopify-specific tools, while third-party cookies, pixels or scripts installed manually or through apps may require additional handling so they respect the visitor's choices.

Iubenda's current Shopify guide uses Shopify's Customer Privacy API and recommends, for that setup, not using iubenda autoblocking as a parallel system. For this reason I do not consider simply pasting a script into the theme enough to close the work: I verify how the banner communicates consent to Shopify and how third-party tools actually behave.

Technical sources: Shopify Customer privacy settings, Customer Privacy API and iubenda's Shopify guide.

How I verify Iubenda and consent on the real store

I do not stop at checking whether the banner appears. I repeat the test in at least three relevant states: before a choice, after refusal and after consent. I inspect network requests, cookies and pixels that are actually active, then verify that changing or withdrawing preferences produces the expected behavior.

The test should be repeated when new pixels, app embeds or marketing tools are added. A configuration that worked before a new integration does not automatically prove that the new script respects the same consent state.

Pixels, analytics and apps

An app can introduce tracking even if the theme is configured correctly. For that reason the check must be performed on the real output of the site, not only on the CMP settings. I verify pixels, scripts, app embeds and marketing integrations.

Data collected at checkout

I do not rename address fields to automatically turn them into tax fields if the workflow produces ambiguous or hard-to-validate data. For tax codes, VAT numbers, certified email addresses or other data, I first verify the actual requirement, what Shopify supports on the plan being used and the integration with the system that will consume that data.

Business information and documentation

Company details, terms of sale, privacy, cookies, shipping and returns need to match the merchant's real operations. I do not generate “certified” policies or promise that a standard template automatically covers every obligation.

Performance and consent management

I measure the real cost of the banner and scripts; I do not claim that a specific CMP is lighter by a percentage without a verifiable source. If a solution introduces an LCP or INP issue, I work on the cause while preserving the required consent behavior.

Privacy source

For cookies and tracking, the reference is the Italian Data Protection Authority measure of June 10, 2021 and the related official documentation.

I’m Francesco Guiducci, a freelance Shopify expert and Shopify app developer. I work technically on Basic, Grow and Advanced; my implementation does not replace legal or tax advice.

Updated September 6, 2026.