Cookiebot CMP

1Role / Purpose

This setup delivers:

• GDPR / ePrivacy compliance for EU visitors
• Consent Mode v2 with Denied defaults
• Granular control per category (analytics, marketing, preferences)
• Consent synchronised to every destination (GTM, Shopify Privacy API)
• No marketing tracking without explicit consent

2Consent Architecture

Full consent flow

Addingwell injects GTM
      ↓
GTM loads Cookiebot (Consent Initialization)
      ↓
Cookiebot shows the banner
      ↓
Visitor grants / declines consent
      ↓
Consent Mode v2 update (ad_storage, analytics_storage...)
      ↓
GTM tags fire according to consent
      ↓
Bridge → Shopify Privacy API (web/custom pixels)

Integration chain

1. 1Addingwell injects GTM on every page of the store
2. 2GTM loads the Cookiebot CMP tag on the Consent Initialization trigger (before any tracking)
3. 3Cookiebot shows the banner, collects consent, and enables Consent Mode v2
4. 4GTM allows or blocks the tags (GA4, Meta, Google Ads, …) according to consent

Core principles

• Cookiebot is the only CMP: no second banner
• Consent defaults to Denied for every category
• GTM tags wait for the consent update before firing
• The bridge syncs consent to Shopify for the pixels
• Shopify's native banner must be disabled
• Cookiebot is loaded through GTM (Addingwell): no script in the theme
• No need for the Cookiebot Shopify app, nor for the Shopify integration in the Cookiebot dashboard

3Dashboard Configuration

Create the Cookiebot account

1. 1Sign up on cookiebot.com
2. 2Add the store domain
3. 3Get the Domain Group ID (CBID): Cookiebot > Settings > Domain Group
4. 4Note the CBID: it goes into the GTM tag

Dashboard configuration (cookiebot.com)

Banner configuration (Cookiebot > Banner)

The consent banner shows on every page at first visit. GTM loads it through the Cookiebot CMP tag: no script in the theme.

Privacy Trigger

The Privacy Trigger is the small floating button that lets a visitor change their consent. Turn it OFF, since consent management is reachable through the /pages/cookie-policy page and the footer link.

Declaration

4Consent Bridge (Shopify Privacy API)

Why a bridge?

Cookiebot handles consent for GTM. But Shopify web pixels and custom pixels use the Shopify Customer Privacy API. The bridge keeps the two in sync.

How it works

Cookiebot consent update
      ↓
CookiebotOnConsentReady event
      ↓
Bridge reads Cookiebot.consent.marketing
      ↓
Shopify.customerPrivacy.setTrackingConsent({
marketing: true/false
})
      ↓
Shopify web pixels fire / blocked

Step 1 — create the snippet

Create a cookie-consent_boostecom.liquid snippet and paste the code below:

<script>
/**
 * Cookiebot → Shopify Customer Privacy Sync (EU/US, Prod)
 *
 * - Charge l'API Shopify "consent-tracking-api"
 * - Deny-by-default tant que Cookiebot n'a pas fourni le consentement
 * - Sync Cookiebot → Shopify sur chaque événement (ready/accept/decline)
 * - Retry loop pour gérer le chargement asynchrone
 */
(function () {
  "use strict";

  var CONSENT_PROFILE = "EU"; // "EU" or "US"

  var CFG = {
    defaultConsent: {
      analytics: false,
      marketing: false,
      preferences: false,
      sale_of_data: false
    },
    retry: { intervalMs: 1000, maxTries: 60 }
  };

  function hasCookiebot() {
    return !!(window.Cookiebot && Cookiebot.consent);
  }

  function safeSetShopifyConsent(consentObj) {
    try {
      if (!window.Shopify || !Shopify.customerPrivacy) return false;
      Shopify.customerPrivacy.setTrackingConsent(consentObj);
      return true;
    } catch (e) { return false; }
  }

  function mapCookiebotToShopify() {
    var C = Cookiebot.consent;
    return {
      analytics: !!C.statistics,
      marketing: !!C.marketing,
      preferences: !!C.preferences,
      sale_of_data: false
    };
  }

  function initShopifyConsentApi() {
    try {
      if (!window.Shopify || typeof Shopify.loadFeatures !== "function") return;
      Shopify.loadFeatures(
        [{ name: "consent-tracking-api", version: "0.1" }],
        function () { safeSetShopifyConsent(CFG.defaultConsent); }
      );
    } catch (e) {}
  }

  function syncFromCookiebot() {
    try {
      if (!hasCookiebot()) return false;
      if (!window.Shopify || !Shopify.customerPrivacy) return false;
      return safeSetShopifyConsent(mapCookiebotToShopify());
    } catch (e) { return false; }
  }

  function attachCookiebotListeners() {
    try {
      window.addEventListener("CookiebotOnConsentReady", syncFromCookiebot);
      window.addEventListener("CookiebotOnAccept", syncFromCookiebot);
      window.addEventListener("CookiebotOnDecline", syncFromCookiebot);
    } catch (e) {}
  }

  function startRetryLoop() {
    var tries = 0;
    var t = setInterval(function () {
      tries += 1;
      var ok = syncFromCookiebot();
      if (ok || tries >= CFG.retry.maxTries) clearInterval(t);
    }, CFG.retry.intervalMs);
  }

  initShopifyConsentApi();
  attachCookiebotListeners();
  startRetryLoop();

  void CONSENT_PROFILE;
})();
</script>

Step 2 — render it in theme.liquid

In theme.liquid, add this after {{ content_for_header }}:

{% render 'cookie-consent_boostecom' %}

Technical details

• Uses Shopify.loadFeatures([{ name: "consent-tracking-api", version: "0.1" }])
• Listens to CookiebotOnConsentReady, CookiebotOnAccept, CookiebotOnDecline
• Maps Cookiebot.consent.statistics → analytics, Cookiebot.consent.marketing → marketing
• sale_of_data always false (no data sale)
• Retry loop at 1000ms, up to 60 attempts, to cope with async loading
• Deny-by-default until Cookiebot has reported the consent state

5Cookie Declaration Page

The GDPR requires a dedicated "Cookie policy" page listing the cookies in use. This page is separate from the privacy policy, they are two distinct legal obligations (processing personal data vs storing trackers).

Step 1 — create the page in Shopify

• Content > Pages > Add page
• Title: Cookie policy
• URL handle: /pages/cookie-policy

Step 2 — paste the content (text + script)

In the Shopify editor, switch to HTML mode (</>) and paste the content below. The wording follows the French CNIL guidance, and the Cookiebot script at the bottom renders the cookie list automatically:

<p>This cookie policy explains how our website uses cookies and other trackers when you visit it.</p>

<h2>1. What is a cookie?</h2>
<p>A cookie is a small text file written and read while you browse a website, whatever device you use (computer, smartphone, tablet). Cookies keep the site working, improve your experience, measure audience, and, with your consent, allow us to show you personalised content and advertising.</p>

<h2>2. Which types of cookies do we use?</h2>

<h3>Strictly necessary cookies</h3>
<p>These cookies are essential for the site to work and cannot be switched off. They are what remembers the contents of your basket, for example, or keeps the site secure.</p>

<h3>Audience measurement cookies</h3>
<p>These cookies let us analyse traffic and how the site is used, so we can improve its performance.</p>

<h3>Marketing cookies</h3>
<p>These cookies may be used to show you advertising matched to your interests, on our site or on third-party sites.</p>

<h3>Personalisation cookies</h3>
<p>These cookies improve and personalise the features of the site.</p>

<h2>3. Legal basis</h2>
<p>Strictly necessary cookies are set on the basis of our legitimate interest in keeping the site working. Every other cookie (audience measurement, marketing, personalisation) is set only once you have given your consent.</p>

<h2>4. Managing your preferences</h2>
<p>On your first visit, a banner tells you that cookies are in use and lets you accept them, decline them, or choose which ones you allow.</p>

<p>You can change or withdraw your consent at any time, using the link provided for that purpose or by reopening your preferences in our cookie management tool.</p>

<h2>5. Retention period</h2>
<p>Cookies are kept for a maximum of 13 months, in line with the guidance of the French data protection authority (CNIL).</p>

<h2>6. Cookies set on this site</h2>
<p>The detailed, up-to-date list of the cookies used on our site appears below:</p>

<!-- Cookiebot Declaration -->
<script id="CookieDeclaration"
  src="https://consent.cookiebot.com/YOUR-CBID/cd.js"
  type="text/javascript"
  async></script>

Step 3 — link it from the footer

The page must be reachable from the footer (alongside the other legal policies) and from the link in the Cookiebot consent banner. No visible link means non-compliant.

6Consent Categories

Google consent categories

Cookiebot → Consent Mode mapping

Consent per destination

7Shopify Regions

Shopify ships a native cookie banner (Settings > Customer Privacy). It must be disabled, because consent is handled by Cookiebot through GTM.

Region configuration

The EEA + UK toggle in Cookiebot (Add Geo Regions) makes sure the banner only shows for European and British visitors. Visitors outside those areas see no banner (implied consent).

How to disable them

1. 1Shopify Admin → Settings → Customer Privacy
2. 2Under "Cookie banner" → uncheck every region, "Use automated settings" OFF
3. 3Under "Data sharing opt-out page" → uncheck every region, "Use automated settings" OFF
4. 4Save

Other Shopify settings

• Privacy policy — may stay "Automated". It is legal content, not tracking, and does not interfere with Cookiebot.
• Data hosting — check that "European Union" is selected (consistent with CDS Region .eu in Cookiebot).

Impact of disabling them

8Consent Mode v2

Consent Mode v2 (default denied) is configured on the Cookiebot CMP - Declaration tag in GTM. The CBID goes directly into the tag's Cookiebot ID field (not a separate variable). This tag already ships inside the imported BoostEcom container.

Cookiebot CMP tag configuration

Consent Mode settings

Default Consent State (all Denied)

Consent each tag requires

Every tag in the container declares the consent types it needs. GTM blocks the tag automatically until the visitor has consented:

9Configuration in GTM

Cookiebot CMP tag

• Official Cookiebot template from the GTM Community Gallery
• Trigger: Consent Initialization — All Pages
• Cookiebot Banner ID (CBID) set in the tag's Cookiebot ID field
• Mode: auto-blocking enabled

Load order

1. Consent Initialization (highest priority)
 └── Cookiebot CMP → Denied defaults

2. Consent Update (visitor accepts/declines)
 └── Cookiebot sends consent_update

3. Marketing tags (waiting for ad_storage = Granted)
 └── Meta, Google Ads, etc.

4. Analytics tags (waiting for analytics_storage = Granted)
 └── GA4 full tracking

Firing

The Consent Initialization - All Pages trigger runs before every other GTM trigger, which guarantees the Denied defaults are in place before any tracking.

10Verification

Verify Consent Mode v2

1. 1Open the browser console
2. 2Type dataLayer and look for consent_default
3. 3Check that every signal is "denied" by default
4. 4Accept consent in the Cookiebot banner
5. 5Check consent_update carries "granted" signals

Verify the Shopify bridge

1. 1Open the browser console
2. 2Type Shopify.customerPrivacy.getTrackingConsent()
3. 3Before consent: marketing must read "no_interaction"
4. 4After accepting: marketing must read "yes"
5. 5After declining: marketing must read "no"

Verify the GTM tags

• Use GTM Preview Mode
• Before consent: only Cookiebot and GA4 Config fire
• After marketing consent: Meta and Google Ads fire
• After analytics consent: GA4 full tracking fires

Pre-consent test (private window)

1. 1Open the site in a private window
2. 2Click "Deny all" in the Cookiebot banner
3. 3GTM Preview: check that only Necessary tags fire
4. 4Network: no request to GA4, Meta or Google Ads

Post-consent test

1. 1Open the site in a private window
2. 2Click "Accept all" in the banner
3. 3GTM Preview: analytics and marketing tags must fire
4. 4GA4 DebugView: events visible in real time

Phase 2 — GTM + consent foundations

• GTM Web container loaded through Addingwell (not a direct snippet)
• Cookiebot CMP tag active in GTM with Denied defaults
• Cookiebot CMP fires on Consent Initialization (before the other tags)
• A "Deny all" option is available in the banner
• Cookiebot → Shopify Privacy API bridge installed (cookie-consent_boostecom.liquid): mandatory
• DataLayer Monitor custom pixel active under Customer Events (?awdebug=1 to debug)
• Shopify regions: native banner OFF, custom banner regions EEA + UK

11Troubleshooting

12Consent Checklist

Check after every production release: