Install freeBlock every tracker until your shoppers say yes
The auto-blocker stops tracking scripts, iframes and pixels before they set a single cookie, then releases each one the moment the visitor consents to its category. No code, no tag rewiring, just rules you switch on.
What is cookie auto-blocking?
Cookie auto-blocking holds back third-party scripts until the visitor gives consent. Under the GDPR and the ePrivacy Directive, non-essential cookies need prior consent: a banner alone isn’t enough if Google Analytics or the Meta Pixel has already fired behind it. Blocking the scripts themselves is the only way to make sure nothing tracks before the visitor says yes.
Three ways to block, one blocker
- One click
Popular services
Ready-made rules for Google, Meta, TikTok, Klaviyo and more. Tick the services you use and they wait for consent.
- Any domain
Custom rules
Block any script, iframe or pixel by its URL or domain, and choose the cookie category that releases it.
- Developers
Manual markup
Mark a script in your theme with its cookie category. It stays blocked even if the app’s scripts fail to load.
Popular services, blocked in one click
Each service comes with its rule and its cookie category already set. Select only the ones your store uses, and each is released when the visitor accepts its category.
- Google Tag Manager
- Google Analytics
- Facebook Pixel
- Hotjar
- YouTube
- Klaviyo
- PayPal
- Vimeo
- Google Pay
- Bing Ads
- DoubleClick
- AdRoll
- Google Ads Conversion
- Snapchat
- TikTok
Custom rules for everything else
A third-party app that runs before consent, or a script added to your theme? Add a rule with its domain, and every script and asset from that domain waits for consent.
- Target script tags, iframes or pixels
- Match an exact URL, or a whole domain such as clarity.ms
- Pick the provider from the list, or set your own
- Choose the cookie category that releases it
Works however your scripts load
Out of the box, the auto-blocker covers every app that loads as an app embed or an app pixel. For scripts pasted into your theme, or older apps that inject their own code, one line at the top of your theme brings them under the same rules.
- App embeds and app pixels, automatically
- Scripts in theme.liquid and legacy apps, with one line
- Google Tag Manager, through the Pandectes template
Manual markup for developers
Change a script’s type and add its cookie category. Pandectes runs it once the visitor consents to that category. It is lighter than auto-blocking and works even if the app’s own scripts are slow to load.
<script type="javascript/blocked"
data-cookiecategory="functionality"
src="https://domain.com/app.js">
</script>How it works
Scan your store
The cookie scanner finds every cookie and tracker on your store and sorts them into categories.
Pick what to block
Select the popular services you use and add custom rules for anything else.
Turn on the blocker
Activate the auto-blocker, and every selected tracker waits for the visitor’s consent.
Auto-blocking questions, answered
Why do I need to block cookies before consent?
The GDPR and the ePrivacy Directive require prior consent for non-essential cookies. If analytics or advertising scripts run as the page loads, they set cookies before the visitor has chosen anything, whatever the banner says. Blocking the scripts is the only way to make the banner’s choice real.
Which services can Pandectes block in one click?
Google Tag Manager, Google Analytics, the Facebook Pixel, Hotjar, YouTube, Klaviyo, PayPal, Vimeo, Google Pay, Bing Ads, DoubleClick, Pinterest, AdRoll, Google Ads conversion tracking, Snapchat, TikTok and Twitter. Anything else can be blocked with a custom rule.
How do I block a script that isn’t in the list?
Open your store, find the script in your browser’s Network tab, and note its domain. Then go to All settings > Auto blocker > Custom rules, click Add new, and enter the domain, such as clarity.ms. Every script and asset from that domain then waits for consent. Never add your own store’s domain, or a service the store needs to work.
What happens with an opt-out banner?
With an opt-in banner, blocked scripts run only after consent. With an opt-out banner, they run from the start, and are blocked from the next page load once the visitor declines.
How can I check the blocker works?
Open your store in a private window and look at the cookies before you accept: the blocked services’ cookies should be missing. A blocked script may still appear in the Network tab, because the browser requests it, but it doesn’t run until consent.
Can I block scripts without the auto-blocker?
Yes. Set the script’s type to javascript/blocked and add data-cookiecategory with the value functionality, performance or targeting. Pandectes runs the script once the visitor consents to that category.
Why merchants choose Pandectes
Privacy compliance that installs in minutes, keeps your store fast and grows with you.
- 185k+
- stores installed Pandectes
- 3,000+
- five-star reviews
- 17m+
- consents recorded every day
- 35
- privacy laws covered
Loved by Shopify merchants
Built for Shopify, and one of the most installed and highest-rated privacy apps in the Shopify App Store.
3,000+Fast at any scale
From a first store to millions of visitors a day, with no slowdown for your shoppers.
Every privacy law
GDPR, CCPA/CPRA, LGPD, PIPEDA, APPI and 30 more, with the right banner for each region.
A global cookie dictionary
Every cookie on your store is matched to our database and categorised for you.
Proof of consent
A downloadable record of every consent, ready if a regulator asks.
Real people, 24/7
Our team answers by chat and email around the clock.
Make your Shopify Store's use of cookies and online tracking compliant today
Try for freeRecent Posts
Website Compliance Under the Louisiana Data Privacy Act
The Louisiana Data Privacy Act takes effect on January 1, 2027. Who it applies to, the consumer rights and opt-outs websites must support, notices, assessments and penalties.
Google's EU User Consent Policy Audit: The 8 Checks and How to Pass Them
Google is auditing consent on sites that advertise in Europe. The 8 issues it flags, how to fix each one on Shopify, and what agencies managing client accounts need to do.
GDPR Cookie Banners: What Your Website Needs to Get Right
What a GDPR-compliant cookie banner needs: valid opt-in consent, equal Accept and Reject buttons, granular choices, consent logs and Google Consent Mode v2, plus the mistakes that draw fines.