The California Consumer Privacy Act (CCPA) and similar US state privacy laws give consumers the right to understand how their personal information is used, request access to their data, request deletion, and opt out of the sale or sharing of personal information.

For Shopify stores, this means providing clear privacy notices, honoring consumer choices, and maintaining records of consent and opt-out requests.

Hoppy GDPR EU Cookie Banner includes several features designed to support these requirements, including:

• Data Sales Opt-Out controls
• Consent logging
• Region targeting
• Cookie scanning and classification
• Data request handling
• Global Privacy Control (GPC) support

This guide walks through the recommended setup process for creating a CCPA-focused privacy experience on your storefront.

✅ Before You Begin

Before configuring your banner:

• Install the Hoppy GDPR EU Cookie Banner app.
• Ensure you have access to Shopify Admin and Theme Editor.
• Create and publish a Privacy Policy page.
• Understand which cookies and tracking tools your store uses.

⚠️ This guide is intended to help configure the app and does not constitute legal advice. For legal requirements specific to your business, consult a privacy professional.

🛠️ Step 1 — Enable the App Embed

The cookie banner cannot appear on your storefront unless the App Embed is enabled.

How to Enable

Navigate to:

Shopify Admin → Online Store → Themes → Customize → App Embeds

Then:

➡️ Locate Cookie PopUp/Banner

➡️ Enable the App Embed

➡️ Click Save

Expected Result

The cookie banner becomes eligible to display on your storefront.

🛠️ Step 2 — Create and Publish a Cookie Banner

After enabling the App Embed, create your banner configuration.

How to Configure

➡️ Open Hoppy GDPR EU Cookie Banner

➡️ Click Create New Cookie Banner

➡️ Configure the banner content

➡️ Click Save

➡️ Click Publish

Expected Result

The banner becomes active on your storefront.

⚠️ Saving alone does not make the banner live.

🛠️ Step 3 — Choose the Appropriate Banner Type

CCPA does not require the same consent model as GDPR, but visitors should still have a clear way to manage privacy preferences.

How to Configure

Navigate to:

Banner Settings → Behavior → Banner Type

Recommended Options

Accept / Decline

Provides a simple and clear choice between accepting or declining.

Suitable for most CCPA-focused implementations.

Preferences

Provides additional control by allowing visitors to manage:

• Analytics
• Marketing
• Functional
• Data Sales preferences

Expected Result

Visitors can easily understand and manage their privacy choices.

⚠️ Banner types such as Accept Only or Informative generally provide less privacy control.

🛠️ Step 4 — Configure Region Targeting

You can choose whether privacy controls appear only for visitors from states with privacy legislation or for all visitors.

How to Configure

Navigate to:

Banner Settings → Region

Then:

➡️ Select US State Laws

or

➡️ Configure specific regions manually

Covered States

California

Virginia

Colorado

Connecticut

Utah

Expected Result

Privacy controls appear only for the targeted visitors.

Many merchants choose to display privacy controls globally to maintain a consistent visitor experience.

🛠️ Step 5 — Enable Data Sales Opt-Out

One of the most important CCPA requirements is allowing visitors to opt out of the sale or sharing of personal information.

How to Configure

Navigate to:

Banner Settings → Behavior → Data Sales Opt-Out

Enable one or both of the following options:

Show Checkbox at Consent Banner

Show Checkbox at Preference Popup

Expected Result

Visitors can select:

Do Not Sell or Share My Personal Information

When selected, the app automatically updates the corresponding consent settings and notifies supported integrations.

🛠️ Step 6 — Add a Privacy Policy Link

CCPA requires businesses to explain how personal information is collected, used, shared, and managed.

How to Configure

Navigate to:

Banner Settings → Behavior → Privacy Policy Link

Available Options

Auto Generate Privacy Policy

The app automatically creates a location-based privacy policy link.

Use Specific Privacy Policy

Allows you to select an existing policy page from your Shopify store.

Expected Result

Visitors can review your privacy practices directly from the banner.

Your Privacy Policy should clearly explain:

• Information collected
• Purposes of collection
• Third-party sharing practices
• Consumer rights
• Data sales opt-out process

🛠️ Step 7 — Scan and Classify Cookies

Understanding which cookies and trackers exist on your storefront is an important part of privacy compliance.

How to Configure

Navigate to:

Cookie Scanner & Manager

Then:

➡️ Run a scan

➡️ Review discovered cookies

➡️ Verify category assignments

➡️ Update any incorrect classifications

➡️ Add missing cookies manually if necessary

Expected Result

All cookies are categorized appropriately and documented correctly.

Cookies marked as Unclassified should be reviewed manually.

🛠️ Step 8 — Verify Consent Logging

CCPA requires businesses to maintain records of privacy-related choices.

How to Check

Navigate to:

GDPR EU Cookie Banner → Consent Logs

Information Stored

Consent records include:

• Consent selections
• Data Sales preferences
• Timestamp
• Event ID
• Page URL
• Anonymized IP information

Expected Result

Privacy choices are recorded automatically whenever visitors interact with the banner.

🛠️ Step 9 — Enable Data Request Handling

Consumers have the right to request access, modification, and deletion of personal information.

How to Access

Navigate to:

Consent Logs → Data Requests

Supported Request Types

• Access Account Information
• Edit Account Information
• Delete Account Information

Expected Result

Visitors can submit privacy-related requests and merchants can manage them through the app.

🛠️ Step 10 — Enable Global Privacy Control (Recommended)

Global Privacy Control (GPC) is a browser-based privacy signal that communicates a visitor's preference not to have personal information sold or shared.

Many privacy regulations expect businesses to respect this signal.

How to Configure

Navigate to:

Integrations → Global Privacy Control

Then:

➡️ Enable GPC

➡️ Save changes

Expected Result

When a browser sends a GPC signal:

Marketing → Denied

Sale of Data → Denied

These settings are applied automatically before supported integrations initialize.

🛠️ Step 11 — Add Translations (Optional)

If your store serves multilingual audiences, translations can help ensure privacy notices remain understandable.

How to Configure

Navigate to:

GDPR EU Cookie Banner → Translation

Then:

➡️ Add a language

➡️ Translate banner content

➡️ Translate Data Sales Opt-Out labels

➡️ Activate the translation

Important

The language must already exist in:

Shopify Admin → Settings → Languages

Expected Result

Visitors see privacy controls in their preferred language whenever a matching translation is available.

🛠️ Step 12 — Test the Entire Setup

Before considering the setup complete, verify the visitor experience thoroughly.

Recommended Testing Process

➡️ Open the storefront in an Incognito window.

➡️ Simulate a visitor from a covered US state if using region targeting.

➡️ Confirm the banner appears.

➡️ Verify the Data Sales Opt-Out checkbox is visible.

➡️ Save consent preferences.

➡️ Review Consent Logs.

Verify That

✅ Consent records are created.

✅ Privacy Policy links function correctly.

✅ Data Request forms are accessible.

✅ Data Sales preferences are recorded correctly.

✅ GPC signals are respected when present.

⚠️ Important Compliance Notes

Provide a Clear Opt-Out

Visitors should be able to easily opt out of the sale or sharing of personal information.

Honor Opt-Out Requests Promptly

Once a visitor opts out, that choice should be respected immediately.

Do Not Discriminate Against Consumers

Privacy choices should not result in unfair treatment of visitors.

Maintain Privacy Records

Review Consent Logs regularly and retain records appropriately.

Respect Global Privacy Control

If GPC is enabled and detected:

Marketing → Denied

Sale of Data → Denied

These settings override previously granted consent.

Review Cookie Usage Regularly

Cookies, integrations, and tracking technologies often change over time.

Periodic scans help ensure your classifications remain accurate.

🎉 Final Result

✅ Visitors can easily opt out of the sale or sharing of personal information.

✅ Privacy controls are displayed to the appropriate visitors.

✅ Data Sales preferences are captured and stored.

✅ Privacy Policy information is accessible from the banner.

✅ Cookie classifications remain organized and reviewable.

✅ Consumer privacy requests can be managed through the app.

✅ Global Privacy Control signals are respected automatically.

Following these steps helps create a transparent privacy experience while supporting CCPA requirements and similar US state privacy laws. ✨

Updated on: 14/07/2026