Set up consent for your storefront.

Five steps to connect your store

You need access to the CYBEXO dashboard and permission to manage your Shopify theme and customer privacy settings.

1. Create your CYB App

   Open the CYBEXO dashboard, create an App for your Shopify storefront, and add its domain. Configure your banner, applicable regions, IAB TCF options, and Google Consent Mode.

   Copy its CYB App ID, which begins with CYB-. Older App IDs need a new CYB App; changing the prefix of an old ID does not migrate it.

2. Enable the app embed

   In Shopify, go to Online Store → Themes → Customize → App embeds. Enable Consent management under Cybexo CMP.

   Paste your CYB App ID. Under Google integration, select Google Tag Manager and enter your GTM container ID. Save the active theme. If your store uses the cybexo.settings_id shop metafield, its value takes priority over the text field.

3. Keep one consent installation

   Remove an old direct CYBEXO script or another CMP installation from this theme. Check any tag-manager integration as well. A second consent manager can create competing banners and signals.

   After an upgrade, confirm that the embed is still enabled and contains your current CYB App ID.

4. Align Shopify privacy settings

   Open Settings → Customer privacy. Configure consent regions to match where your CYBEXO banner asks for consent. Use CYBEXO as the storefront banner and avoid displaying a competing Shopify cookie banner.

   Keep Shopify’s data-sale opt-out page and Global Privacy Control settings configured separately for applicable regions.

5. Connect GTM, then test

   In the chosen container, install the current CYBEXO CMP Gallery template. Use the same CYB App ID and fire one CMP tag on Consent Initialization – All Pages. Preview and publish the container. The app embed loads that container, and the template sets native Google defaults before loading the single managed CMP. Keep Google Consent Mode enabled in CYBEXO.

   Remove duplicate container snippets, standalone CMP loaders and competing Google consent writers. Load measurement only after native defaults. The embed cannot reorder existing theme scripts; check the actual storefront in Tag Assistant.

   Existing Direct Google tags installations keep their selected mode and require separate live verification. They are not automatically migrated. The native-GTM setup was verified with Web CMP 1.5.57 on October 11, 2026; later site or runtime changes require the affected checks to be repeated. Merchants do not select an engine release.

   Test a fresh visit in a region where consent is required. Check acceptance, rejection, individual choices, reopening settings, and withdrawal. Verify your Google tags in Tag Assistant and repeat after a reload. Use the checklist below before relying on a store’s production configuration.

How choices reach Shopify

The embed records a Shopify choice after a visitor completes a choice in CYBEXO. Loading the page, ordinary restoration, or regional defaults does not create a new Shopify decision. A visitor’s completed choice in another open tab is synchronized, including Shopify categories, without another CYBEXO decision or receipt.

If CYBEXO asks for a fresh decision after an earlier choice expires or becomes invalid, Shopify may still hold its earlier platform choice. The embed does not invent a new decision on page load; the visitor’s next completed choice updates Shopify.

Check the experience your visitors receive

• A fresh visit shows one banner where consent is required, and Google consent starts denied.
• Accepting or rejecting updates the expected Shopify categories and Google signals.
• Withdrawing advertising personalization does not silently withdraw a separately permitted Analytics choice.
• Withdrawing Analytics stops Analytics permission while keeping other permitted choices intact.
• Saved choices survive a reload, and visitors can reopen settings to change or withdraw consent.
• Google Tag Assistant shows denied defaults processed before Google initialization, then the expected states after acceptance and withdrawal.
• The data-sale opt-out page and Global Privacy Control retain their independent behavior.

If something needs attention