How Pandectes can block third-party services and apps based on consent status

Overview

Pandectes provides multiple ways to control third-party services based on a visitor’s consent choices.

Auto Blocker is just one of these tools. Because Shopify stores load scripts in different ways, such as theme files, app blocks, Google Tag Manager, server-side platforms, or custom pixels, the correct control method depends on how the service was added to your store.

When prior consent is required, Pandectes can:

• Hard block: Prevent an external script, iframe, pixel, or inline script from loading or running until consent is given.
• Send consent signals: Send the visitor’s consent state to compatible platforms or custom implementations, such as Google Consent Mode v2 or Meta.
• Synchronize privacy APIs: Automatically synchronize supported visitor consent choices with Shopify’s native Customer Privacy API.

Strictly necessary services can remain available. Functionality, Performance, and Targeting services should be configured using the appropriate method below.

For information about when prior consent is applied, see Consent Model & Regions.

Blocking vs. Consent Signaling - What’s the difference?

There are some differences between blocking and consent signaling.

• Hard blocking: Stops the code from loading or running in the visitor’s browser.
• Consent signaling: Allows a compatible service to load but communicates an allowed or denied consent state so the platform knows how it should behave.

Consent signaling does not always mean that the service is completely blocked. Some compatible platforms may still load in a restricted mode or send limited cookieless signals when consent is denied. The receiving tag, app, platform, or custom code must be configured to correctly use the consent signal.

Choose the Right Method for Your Setup

Not sure how a service is installed? Check the following areas in Shopify Admin:

• Online Store → Themes → Edit code
• Online Store → Themes → Customize → App embeds
• Settings → Customer events
• Apps and sales channels
• Your Google Tag Manager container
• Your third-party or server-side analytics platform

The table below provides a quick overview. Use the section number to find the detailed setup instructions that follow.

A store can use more than one method. For example, Google Analytics may be installed through GTM while another marketing script is loaded directly from the theme.

How consent handling works

When consent is required under the store’s configured consent model:

1. Pandectes reads the visitor’s current choices.
2. The applicable consent state is made available to the configured services.
3. Services without the required consent remain blocked or receive a denied consent signal.
4. When the visitor changes a category, Pandectes updates the consent state.

Blocking and consent signaling are different mechanisms:

• Blocking prevents a resource or inline script from running.
• Consent signaling informs another platform of the visitor’s choices.
• The receiving tag, app, platform, or custom code must be configured to use the signal.

Updating consent does not automatically unload every script that has already run or reverse data that has already been transmitted. Depending on the service, additional implementation or a page reload may be required when consent is changed.

The numbered sections below explain how to configure each method. Start with the section that matches how the service is installed in your store.

1. Script loaded directly from the theme

Use Auto Blocker for external scripts, iframes, and pixels loaded from URLs in your Shopify theme.

Auto Blocker provides:

• Predefined rules for popular services.
• Custom rules for services that are not listed.
• Category-based control for Functionality, Performance, and Targeting services.

To configure it:

1. Go to Settings → Auto blocker.
2. Enable Auto Blocker.
3. Enable the predefined services used by your store or add a custom rule.
4. Assign each rule to the appropriate category.
5. Save the changes.

Auto Blocker must be active, and the service URL must match an enabled rule.

Services added manually to theme.liquid, or injected by legacy apps that do not use an app embed, may also require the manual Auto Blocker setup. The Pandectes rules script must load before the service that needs to be controlled.

For installation and testing instructions, see the Auto Blocker setup guide.

For services that are not included in the predefined list, see How to set up Custom Blocking Rules.

2. Tags managed through Google Tag Manager

Use the official Pandectes CMP Template when services are managed directly through Google Tag Manager.

The template initializes and updates the consent state inside the GTM container. Each tag must still be configured to respond to the appropriate consent permissions.

In general:

1. Add the Pandectes CMP Template to the GTM container.
2. Run it using Consent Initialization – All Pages.
3. Configure the consent requirements of the other tags.
4. Configure the relevant Google Consent Mode settings in Pandectes.
5. Check for duplicate Google tags or page-view events.
6. Test the container before publishing it.

For the complete setup, see Integration with Google Tag Manager – Official Pandectes Template.

Google Consent Mode: Advanced vs. Basic Mode

Google Consent Mode and hard blocking should be configured according to the behavior required by the store.

• Advanced Mode: Google tags can load with denied consent and may send limited cookieless signals for measurement and modeling.
• Basic Mode: Google tags remain blocked until the visitor grants the required consent.

Do not enable Google Auto Blocker rules when the intended setup requires Google tags to load in Advanced Mode. Hard blocking the tags would prevent Advanced Mode from operating as intended.

For more information, see:

• Using Google Consent Mode Integration
• Checking if Google Consent Mode is properly implemented

3. Third-party and server-side analytics platforms

Use this method when Google Tag Manager or another tracking implementation is managed through a third-party or server-side analytics platform.

Examples include:

• Elevar, Analyzify, Stape, LittleData, Taggrs, Analyzely, etc
• Other Server Side Tracking providers
• Third-party analytics or tag-management platforms

These platforms may require:

• The Pandectes CMP Template inside the GTM container.
• Additional consent checks for individual tags.
• A provider-specific Pandectes integration.
• Consent forwarding between the browser-side and server-side containers.
• Custom handling for non-Google tags.

A consent signal does not automatically control every browser-side or Server Side Tag. Each tag must be configured to respond to the appropriate consent state. For example, Google Consent Mode settings may control Google tags but may not automatically prevent Meta, TikTok, Pinterest, or other custom server-side tags from running. Review the provider’s installation method and configure the required consent checks before publishing the container.

For platform-specific guidance, see here.

4. Inline scripts written in theme code

Scripts written directly inside theme.liquid, a theme section, or a snippet may not have an external URL that Auto Blocker can match before the code runs. These scripts require manual script blocking and changes to the relevant theme file.

See the Manual Script Blocking Guide for the required implementation.

After publishing the changes, confirm that the script:

• Does not run before the required consent is available.
• Runs after the visitor grants the relevant category.
• Responds correctly when the visitor updates their choices.
• Does not create duplicate events if it is initialized again.

A consent update does not automatically stop or unload every script that has already executed. Custom implementations may require additional logic or a page reload when consent is changed or withdrawn.

5. Services loaded through Shopify Custom Pixels

For services installed through Shopify Customer Events, Pandectes can publish the Pandectes_Consent_Update event to the Shopify custom-pixel environment. The custom pixel can subscribe to this event and run its code according to the visitor’s current consent choices.

To use this method:

1. Go to Settings → Integrations in Pandectes.
2. Enable Pandectes Custom Event.
3. Create or update the custom pixel under Shopify Settings → Customer events.
4. Configure the pixel to subscribe to the Pandectes consent event.
5. Run the service only when the required consent is available.
6. Add logic for subsequent consent updates where required.

Enabling the event does not automatically control the custom code. The custom pixel must read the event and apply the appropriate logic.

For the full example and pixel setup, see Use Pandectes Consent Event with Shopify Custom Pixel.

6. Services with a dedicated Pandectes integration

Some providers have their own consent APIs, signals, or implementation requirements. These services may require a dedicated Pandectes integration instead of a generic blocking rule.

Examples include:

• Google Consent Mode
• Meta/Facebook Pixel
• Microsoft Consent Mode
• Microsoft Clarity
• Amazon Consent Signal
• Rakuten CMP
• Klaviyo
• Pandectes Events

Go to Settings → Integrations, select the relevant provider, and complete its configuration.

For an overview of the available options, see Introduction to integrations.

A dedicated integration normally sends the required consent state to the provider. If the provider’s script is also loaded directly from the theme, a separate Auto Blocker rule may still be required. Do not assume that a consent signal automatically blocks every service. Each tag, app, platform, or custom implementation must be configured to respond to the appropriate consent state.

7. Shopify Customer Privacy API

Pandectes integrates with Shopify’s Customer Privacy API as part of its core consent functionality. When a visitor submits or updates their preferences, Pandectes synchronizes the supported consent state with Shopify. Shopify apps and app pixels that support Shopify’s privacy framework can then adjust their tracking behavior. No separate activation is required in Pandectes. This method applies only to Shopify-managed services and apps that support the Customer Privacy API. It does not automatically control unrelated scripts added directly to the theme.

For more information, see Shopify Customer Privacy API.

Example: A store using multiple installation methods

Suppose a store uses:

• Google Analytics through GTM.
• Server-side tracking through Stape.
• A Meta Pixel loaded directly from the theme.
• A custom analytics service inside a Shopify Custom Pixel.
• A Shopify app pixel that supports the Customer Privacy API.

The store would use:

1. The Pandectes CMP Template and the appropriate consent requirements for the Google Analytics tag.
2. The required GTM consent checks and server-side configuration for Stape.
3. The dedicated Meta integration, an Auto Blocker rule, or both, depending on how the Meta Pixel is installed.
4. The Pandectes Consent Event for the Shopify Custom Pixel.
5. The Shopify Customer Privacy API for the compatible app pixel.

When the visitor changes their preferences, Pandectes updates each configured mechanism. Each service then remains blocked, becomes available, or adjusts its behavior according to its implementation and the visitor’s choices.

Test your implementation

Always test the final implementation after configuring or changing consent handling.

1. Open the store in a clean incognito or private-browser session.
2. Test from a region where prior consent is required.
3. Before interacting with the banner, check the browser’s Network and Application tabs.
4. Confirm that each service is either blocked or receives the intended denied signal.
5. Accept only one consent category and confirm that only the corresponding services become active.
6. Change or withdraw consent and verify the updated behavior.
7. Check for duplicate requests, cookies, pixels, and page-view events.
8. Repeat the test after theme updates, app installations, GTM changes, or custom-code changes.

For Google services, also test the implementation using Google Tag Assistant and see Checking if Google Consent Mode is properly implemented. Visitors should also have an accessible way to review or change their choices, such as a Cookie settings link in the storefront footer.

See How to Re-open the Cookie Banner with a Menu Link.

Recommended handover checklist

Agencies and developers should document each configured service before handing the store back to the merchant.

The final documentation should also record:

• Any custom Auto Blocker rules.
• Any manually modified theme files.
• The GTM containers and tags that were updated.
• Any server-side tags that require additional consent checks.
• Any services using consent signaling instead of hard blocking.
• Any required testing steps after future theme, app, or tracking changes.

Summary

Pandectes does not rely on a single blocking method.

It provides:

• Auto Blocker rules.
• Google Tag Manager and Google Consent Mode integrations.
• Third-party and server-side platform integrations.
• Manual script blocking.
• Shopify Custom Pixel events.
• Provider-specific integrations.
• Shopify Customer Privacy API synchronization.

The method required for each service depends on how the service is installed, which consent category it belongs to, and whether it supports consent signals. For stores using several tracking technologies, each installation method should be reviewed and tested separately.

Updated on: 27/07/2026