UK Cookie Consent Website Guide: Shopify, WordPress, Next.js

What do the UK rules actually require?

Cookies in the UK are covered by the Privacy and Electronic Communications Regulations (PECR). The ICO's guide to cookies and similar technologies sums up the basic rule in regulation 6: tell people the cookies are there, explain what they do and why, and get the person's consent to store them on their device.

A few details from that guidance matter most when you build a site:

• Consent must be a clear positive action, such as ticking a box or clicking a button. Simply continuing to use the website does not count.
• Non-essential cookies cannot be set before consent. The ICO says plainly that you cannot set them on your homepage before the user has agreed.
• Users should be able to enable or disable non-essential cookies, and that should be easy to do.
• It is not only cookies. The same rule covers any technology that stores or reads information on a visitor's device.
• Anonymous data is still covered. PECR applies to all cookies, and if the cookie data is personal, UK GDPR applies as well.

The ICO also notes that this page is based on its previous detailed guidance and that it is consulting on a revised version, so check the page again before a launch rather than relying on an old checklist.

Which cookies need consent and which do not?

The ICO describes two exemptions: cookies used only to carry out the transmission of a communication, and cookies that are strictly necessary to provide a service the user has asked for. Its examples of cookies that are unlikely to need consent are basket and checkout cookies on a shop, security session cookies for a service the user requested, and load-balancing cookies.

Anything that is helpful or convenient but not essential still needs consent. In practice, on most small business and ecommerce sites that means:

Start every project with a cookie audit: list each cookie and script, who sets it, whether it is first or third party, and how long it lasts. The ICO's own checklist asks for exactly these points, and the list becomes the basis for your cookie policy and your banner categories.

How do you set up cookie consent on Shopify?

Shopify has consent built into the platform through its Customer Privacy API. The API applies consent decisions to Shopify-managed surfaces such as pixels, audiences and checkout. When the Shopify cookie banner is turned on, it shows in the regions you configure and passes the visitor's choice to the API automatically.

The steps we follow on a UK store:

1. Turn on the banner for the UK in your store's privacy settings, or use a consent app. If you use an app, ask its developer where the banner shows and confirm it passes consent to Shopify.
2. Use the consent purposes Shopify supports: preferences, analytics and marketing. Map every app and pixel to one of them.
3. Gate custom scripts in the theme. Shopify's docs list methods such as analyticsProcessingAllowed() and marketingAllowed(), plus a visitorConsentCollected event that fires when consent changes. Any tag you add by hand should check these before it loads.
4. Do not set consent automatically. Shopify warns that consent should only be recorded on a visitor interaction, never on the visitor's behalf, and that you should never read or edit Shopify's cookies directly.
5. Give people a way back in. The cookie banner API includes showPreferences(), which you can link from the footer as "Cookie settings".

Headless Shopify stores need extra work. Shopify says the checkout should sit on the same root domain as the storefront so it can read the consent cookie, and that Hydrogen stores should use Hydrogen's own analytics and consent features.

How do you set up cookie consent on WordPress?

On WordPress, consent usually comes from a consent management plugin. What we check on every WordPress or WooCommerce site:

• The plugin blocks scripts, not just displays a notice. Load the site in a private window, open the browser's developer tools and confirm that no analytics or advertising cookies appear before you click Accept.
• Accept and Reject are equally easy. The ICO asks that users can enable or disable non-essential cookies easily, so a hidden reject option works against you.
• Every plugin that adds tracking is covered. Each one has to wait for the right consent category.
• Tags added through a tag manager wait for consent too. Hard-coding an analytics snippet in the theme header bypasses the plugin entirely.
• The cookie policy matches reality. Re-run the audit after installing a new plugin, because the ICO notes you may need fresh consent if your use of cookies changes.

Our website security checklist covers how we review plugins on client sites.

How do you set up cookie consent on Next.js?

The pattern we use has three parts.

Load the consent manager early

The Next.js Script component docs list cookie consent managers as an example of a script suited to the beforeInteractive strategy, which injects the script into the initial HTML and must be placed in the root layout. If you use a third-party consent platform, this is where it goes.

Render tracking scripts only after consent

Analytics and tag managers are listed in the same docs as good candidates for afterInteractive. The key is to render those Script components conditionally, from a client component that reads the stored consent choice, so the tag is not in the page at all until the visitor agrees.

Store the choice and let people change it

Save the visitor's choice per category, read it on each page load, and add a "Cookie settings" link in the footer that reopens the preferences. The consent cookie itself is there to record a choice the user made, but list it in your cookie policy anyway, as the ICO recommends giving information even about cookies that do not need consent.

If you are still choosing a platform, our comparison of Next.js and WordPress for a business website covers the wider trade-offs.

Shopify, WordPress and Next.js compared

How do you test that consent really works?

Test on a clean browser profile for each case:

1. Open the site and do nothing. Check the cookies and network requests: only strictly necessary ones should appear.
2. Click Reject. Browse a few pages and add something to the basket. Analytics and advertising requests should still be absent.
3. Clear everything, then click Accept. The tags should now load.
4. Reopen "Cookie settings", withdraw consent and reload. The tags should stop.
5. Repeat on mobile, and after every new app, plugin or tag.

For a UK shop, consent is one item on a longer launch list that also covers payments, VAT and returns. Our guide to building an ecommerce website for the UK covers the rest.

Frequently asked questions

Do I need a cookie banner if I only use analytics?

Analytics cookies are not strictly necessary, so under the ICO guidance they need consent before they are set. The ICO also says PECR applies to all cookies, even when the data is anonymous. Check with a lawyer if you think an exemption applies to your setup.

Is "by continuing to browse you accept cookies" enough?

No. The ICO says consent must be a clear positive action and must be more than simply continuing to use the website. Visitors need a real choice, such as Accept and Reject buttons.

Do basket and checkout cookies need consent?

The ICO says you are unlikely to need consent for cookies that remember what a user wants to buy when they add goods to a basket or go to checkout. It is still good practice to explain them in your cookie policy.

How often should visitors be asked again?

The ICO says you do not have to repeat the request every time the same person visits, but you may want to repeat it at suitable intervals if a device is likely to be shared, and you may need fresh consent if your use of cookies changes.