Auto-block cookies FAQ

Answers to the questions merchants ask most often about holding trackers until visitors give consent.

General

Why is tracking still loading before consent?

Work through these in order:

Check the Script blocker app embed badge on Settings → Auto-block cookies. If it shows Off, nothing is blocked yet.
Confirm the vendor shows the Blocked badge on the Auto-block integrations card. Unblocked means either the integration is off, or its ID field is empty.
For a custom rule, confirm the domain and the target type match what the browser actually requests. Check the Network tab for the real host.
Check your banner's regions. Blocking follows the banner, so a visitor outside your selected countries is never asked and never blocked. Tick EU & UK countries GDPR, or turn on Smart Geo-Compliance.
If the script is written directly in theme.liquid with a normal src, it needs the blocked markup. See How to block each kind of tracker.
If it is still getting through, the tag may be running before the app embed loads. See How to add the early blocker snippet.

Why does an integration I turned on show Unblocked?

Usually because its ID field is empty. An integration turned on with no ID means the official Shopify sales channel app runs your tag: Cookie Bar sends the consent signal and keeps out of the way, so the Unblocked badge is reporting that correctly. Fill the ID in only when Cookie Bar is the one that should run that tag.

The other way to land on Unblocked is the toggle itself. It is a separate setting, so an ID saved without switching the integration on still reads Unblocked. Check both. See How to block each kind of tracker.

I entered the ID and now I have duplicate events. Why?

The tag is loading twice: once from Cookie Bar and once from the sales channel app or your theme. Pick one owner per tracker - clear the ID in Cookie Bar, or remove the other copy.

Do I need to do anything after saving a rule?

No. Cookie Bar pushes the block list to your storefront automatically each time you add, edit or delete a rule.

Is Cookies management the same as Auto-block?

No. Adding or editing a cookie in Cookies management describes it in your cookie declaration, and it does not add the cookie to the block list. Auto-block follows your enabled integrations and your custom rules only.

Will blocking a domain break normal links?

No. Auto-block only holds scripts, iframes and pixels that match your rules. Regular page links, images and your theme's own code are untouched.

What cannot be blocked

Does Cookie Bar delete tracking cookies when a visitor declines?

No. Cookie Bar prevents tracking cookies by stopping the script that would set them. Cookies already on the device stay there, so one set before your banner appeared is still there after a decline.

Can Cookie Bar block a pixel I added under Customer events?

No. Pixels under Customer events, whether you wrote them or another app installed them, run inside a sandbox Shopify creates and controls, which Cookie Bar cannot reach into. Govern them where Shopify governs them:

Turn on the Shopify Customer Privacy integration in Cookie Bar, so your banner's consent is reported to Shopify.
In Settings → Customer events, set the consent your pixel requires.

Can Cookie Bar block another app's app embed?

Not the embed itself. App embeds usually start from inline code, which has no domain for Cookie Bar to match. If the embed then loads a file from its own domain, add that domain as a custom rule and the file is held.

What about a tracker that uses fetch or sendBeacon instead of a script tag?

Not blocked. Cookie Bar works on <script>, <iframe> and <img> tags, so a tracker that reports through fetch, XMLHttpRequest or navigator.sendBeacon has no tag to hold.

Does Auto-block cover checkout and the thank-you page?

No. Auto-block runs through a theme app embed, and Shopify loads theme app embeds on your online store pages only.

What about server-side tracking, such as a Conversions API?

Nothing runs in the visitor's browser, so there is nothing on the page for Cookie Bar to hold. Consent for server-side tracking has to be handled where the events are sent from.

Custom rules

How many custom rules can I add?

Up to 50 per store. When you reach the limit, delete a rule you no longer need before adding another.

Can I block a specific file instead of the whole domain?

No. Cookie Bar matches by domain, including subdomains. You can paste a full URL, but only the domain is kept.

Can I add the same domain twice?

Yes, as long as the target type is different, for example one Script rule and one Pixel (img) rule on the same vendor. Two rules with the same domain and the same target are rejected as a duplicate.

Why can't I block certain domains?

Some hosts are required by your store, so blocking them would break your storefront. Cookie Bar protects Shopify's own domains, jQuery, jsDelivr, Cloudflare and Google's static and API hosts, and shows This domain is required by your store and cannot be blocked.

Do the built-in integration lists cover iframes and pixels too?

No. The built-in domain lists are matched against <script src> only. A doubleclick.net iframe or a facebook.com/tr tracking pixel is not covered by turning the integration on - add a custom rule with the target set to Iframe or Pixel (img).

Theme scripts

My tracker stopped working after I removed Cookie Bar. Why?

Because the blocked markup has no src left, and Cookie Bar is the only thing that can put it back. Turning Auto-block off, disabling the app embed or uninstalling the app leaves those tags inert forever, silently and with no error. Restore the original <script src="…"> tags in your theme before removing the app.

A script I blocked in my theme now throws an error after consent. Why?

A script restored after Accept is rebuilt as a fresh async tag in the page head, so type="module", defer, nonce and integrity are not carried over and the order between two restored scripts is not preserved. If a library tag is followed by an inline tag that calls into it, move the initialising code inside the library's own callback.

Can I put the early blocker snippet in my theme's .js file instead?

No. It has to be snippets/avada-early-script-blocker.liquid, because it reads your Cookie Bar settings through Liquid and Shopify only processes Liquid in .liquid files. In a plain .js file it does nothing at all.

Regions

Trackers are blocked in one country but not another. Is that a bug?

No. Blocking follows your banner. A visitor outside your selected countries is never asked for consent, so their trackers are not held back. Widen your banner's regions if you want blocking everywhere.

One exception works the other way: if Shopify considers a visitor subject to a privacy regulation, their trackers are held back even outside your banner's countries. Those visitors then get no tracking at all until you widen the regions so they can consent.

Plans

Which plan do I need?

The Script Blocker app embed, the blocked markup for theme scripts and the early blocker snippet work on every plan. Auto-blocking a known integration needs Pro or higher, and custom rules need Advanced or higher. TCF and headless commerce integrations need Enterprise.

What happens to my rules if I change plan?

Your custom rules stay saved in the app. They stop being sent to the storefront until the feature is available on your plan again, so nothing is lost and blocking resumes as soon as it is.

Can't find your answer? Contact our support team, we're here to help!

Add the early blocker snippet Translation