This article explains why Shopify front-end (FE) events are sometimes tracked before cookie consent when using third-party consent management platforms such as Cookiebot or OneTrust with Hydrogen. It covers the most common causes, how Shopify's consent framework works, and the configuration checks needed to identify the root cause.
Issue
If your Shopify store uses a third-party cookie consent tool, such as Cookiebot or OneTrust, it may use a Hydrogen-based consent banner. In this setup, front-end events may be tracked through the Bloomreach LAIS connector before the visitor accepts cookies.
This is usually related to the store or consent tool configuration, rather than to a Bloomreach issue or a Shopify Customer Privacy API bug.
What to check
In Shopify, verify that consent is required for the correct regions under Settings > Customer privacy > Cookie banner.
Confirm that the regions configured for the third-party consent banner match Shopify's custom banner regions.
Confirm that the consent tool is properly integrated with Shopify and sends the correct default consent states before the visitor makes a choice.
How to fix it
Align the Shopify Customer Privacy settings with the third-party consent tool's regional settings and default consent states. If needed, ask the consent-tool provider or your implementation team to correct the integration.
After making the changes, test the store without accepting cookies and confirm that front-end events are not tracked. Then accept cookies and confirm that tracking works as expected.
For more information, see Shopify's customer privacy settings.