Black Friday is November 27, and a Shopify store that has been quiet all year is about to get its busiest California traffic. Shopify handles Global Privacy Control for you in some places. The question is whether “some places” covers every pixel your store loads.
What Shopify does natively
Shopify's Customer Privacy API documentation says the GPC signal is collected and honored automatically in regions configured for data sale opt-out, and that a developer can't override it through setTrackingConsent. In those regions, which are usually US states, GPC sets sale_of_data to false. Shopify applies that decision to the surfaces it manages, such as its own pixels, audiences and checkout.
The regions are a merchant setting. In the admin, it lives under Settings > Customer privacy, on the data sharing opt-out page. If California isn't selected there, the automatic handling doesn't apply to California visitors.
What native settings leave to you
Shopify's own help page is direct about the boundary: if you installed third-party cookies or pixels by hand, or through apps, you may need a third-party cookie banner, plus custom logic so they honor the visitor's choice. The API documentation likewise says nothing about how third-party apps and pixels must behave. A Meta pixel pasted into theme.liquid, a review app that loads its own analytics, a loyalty widget added last week: each one has to be checked on its own terms.
That's the compliance impact. Under § 7025, a business that sells or shares personal information must treat a GPC signal as a valid opt-out request, and the obligation covers everything on your site, not only the parts your platform controls. To see where yours stands, load the store in a fresh browser profile with GPC on, open the network panel, and look for advertising hosts that still fire. Our guide to honoring the signal covers the steps, and the e-commerce audit case study shows what a store's findings can look like.
Two cautions. Shopify warns that data sale opt-out is enforced separately from consent, so don't assume a cookie banner choice and a GPC signal produce the same result. And if you use a third-party banner, its regions should match your Shopify regions; Shopify notes that when they differ, non-essential data can be processed before a visitor consents.
Where Privisy fits
Privisy loads your storefront with the GPC signal and records which advertising and analytics requests still go out, whether they came from Shopify, an app or a snippet in your theme. It reports what the browser sends; what a vendor does with data afterward is between you and the vendor. The free GPC check is a quick way to test your homepage before the holiday traffic starts.
Check your store's GPC response
Check your storefront's GPC response and see which requests still fire with the signal on.
Check GPC on your site