Shopify Cookies Explained: What _shopify_y Actually Tracks

Update, September 2026: this retirement is complete. A live storefront now returns _shopify_essential, cart_currency and localization, and neither _shopify_y nor _shopify_s is among them. We verified this directly in September 2026.

We made a video walkthrough of this change, including the live check on a real storefront:

TL;DR

_shopify_y was the cookie behind Shopify's own visitor counts, a first-party identifier with a one-year lifetime, paired with _shopify_s, a 30-minute session cookie. They powered Shopify Analytics, which is exactly why Shopify Analytics never matches GA4: different cookies, different identity, different session rules. Shopify retired both on storefronts on January 1, 2026 in favor of the Web Pixels API. That is done, not pending: load any Shopify store today and neither cookie is set. So any guide telling you to read _shopify_y from the browser is pointing at a cookie that is not there. You cannot use _shopify_y for your own attribution anyway, it is Shopify-internal, and the modern way to capture identity is the pixel client ID, not the cookie.

Key Takeaways

• _shopify_y was a first-party visitor cookie (one-year lifetime in Shopify's policy); _shopify_s was a 30-minute session cookie. Both fed Shopify Analytics.
• Shopify retired _shopify_y and _shopify_s on storefronts on January 1, 2026, moving visitor and session identity to the Web Pixels API. Verified live: a storefront request today returns _shopify_essential, cart_currency and localization, and neither retired cookie.
• These cookies are why Shopify Analytics and GA4 report different visitor and session numbers. Two cookie systems, two identities, two session definitions.
• A Shopify store sets a small set of its own cookies for analytics, marketing, essential function, consent, and cart, alongside any platform cookies your pixels add.
• _shopify_y is Shopify-internal. You cannot read it for your own attribution, and you should not try. The supported source of a stable visitor ID is the Web Pixels API client ID.
• Hydrogen and headless storefronts had an upgrade deadline of April 30, 2026. That date has passed, so a storefront that never did the upgrade has had unreliable visitor and session attribution in Shopify Analytics ever since.

What is _shopify_y?

_shopify_y was Shopify's unique-visitor cookie. Until January 1, 2026 it was set first-party on the storefront, and its job was to recognize the same browser across visits so Shopify could count one person as one visitor rather than as a new visitor every session. Shopify's cookie policy lists it with a one-year lifetime, which is what made it a "visitor" cookie rather than a "session" one: it persisted long enough to tie return visits to the same identifier.

The value was opaque and Shopify-controlled. It existed for Shopify Analytics, the visitor and returning-visitor numbers in your Shopify dashboard were built on it, not for you to parse. That distinction matters, and it comes back in the last section.

What is _shopify_s?

_shopify_s was the session half of the pair. Where _shopify_y tracked the visitor over a year, _shopify_s tracked a single session, with a 30-minute rolling expiry: each new activity extended it, and 30 minutes of inactivity ended the session. That is how Shopify decided where one visit stopped and the next began. Shopify stopped setting it on January 1, 2026, and there is no replacement value.

Together they encoded Shopify's model of "who" and "when this visit": _shopify_y was the person, _shopify_s was the current visit. Shopify Analytics counted sessions and visitors off these two cookies, with its own definitions baked in, which is the root of a reconciliation problem most merchants hit.

Are _shopify_y and _shopify_s going away?

They are already gone, and this is the part most existing guides get wrong. Shopify's developer changelog stated that from January 1, 2026, Shopify would no longer set the _shopify_y and _shopify_s cookies on merchant storefronts. That shipped. The cookie policy still lists both with their one-year and 30-minute lifetimes, so you will see conflicting information depending on which Shopify page you land on.

Your own store settles it in ten seconds. Request any Shopify storefront and read the response headers: what comes back is _shopify_essential, cart_currency and localization. Neither retired cookie appears, with or without tracking consent granted, and the same is true on unrelated Shopify stores, so this is platform-wide rather than a per-store setting. Visitor and session identity now live in the Web Pixels API.

For most merchants this is invisible plumbing. For anyone who built attribution or analytics that reads _shopify_y from document.cookie, it was a deadline, and it has passed. Shopify's guidance is to stop reading the cookie and use the Web Pixels API client ID, which is the supported, durable source of a visitor identifier. Hydrogen and headless storefronts had a firmer cutoff: Shopify warned that without the relevant upgrade by April 30, 2026, visitor and session attribution would not be reliable in Shopify Analytics. That deadline has passed, so if nobody did that work, those numbers have been degrading since spring rather than about to. The same upgrade pressure runs through cross-domain and headless tracking, where identity is hardest to keep stable.

Which cookies does a Shopify store actually set?

It helps to separate Shopify's own cookies from the ones your marketing pixels add. Shopify's storefront cookies, from its cookie policy, are a short and purposeful list:

Your pixels add their own, and these are platform cookies, not Shopify's. The durations below are the platforms' own published defaults and should be read as approximate rather than Shopify-official:

Click identifiers like rdt_cid and the Google Ads gclid, gbraid, and wbraid family are URL parameters a pixel captures, not cookies the store sets. The point of the split: a handful of these cookies are Shopify's and a handful belong to whichever ad platforms you run, and only the first set is governed by Shopify's own policy.

What happens to these cookies under consent?

Cookies do not all fire unconditionally. When a store has privacy rules configured, Shopify's Customer Privacy API carries the visitor's consent state, and _tracking_consent is where that decision is stored. Pixels are expected to read that signal and act on it.

In practice, browser events respect Shopify's Customer Privacy API signals, so marketing cookies and the events that depend on them are gated by the visitor's choice rather than firing for everyone. The essential cookies a store needs to function are treated differently from analytics and marketing cookies, which is the distinction most consent banners present to a shopper. The exact behavior depends on how the store's privacy rules and consent banner are configured, so the cookie list above describes what can be set, not what fires before a visitor has chosen.

Can you use _shopify_y for your own attribution?

No, and this is the most common mistake the _shopify_y query hides. The cookie is Shopify-internal: the value is Shopify's to define and change, it was retired on storefronts in January 2026, and it was never an identifier you were meant to read for your own tracking. Building attribution on it means building on a foundation Shopify has already moved.

The supported approach is the Web Pixels API client ID, the stable visitor identifier Shopify exposes to pixels through its standard events. That is what a modern Shopify tracking setup consumes, and it is the reason Shopify Analytics and GA4 visitor counts never match: each system identifies visitors with its own mechanism. For the broader shift away from third-party cookies and toward first-party and server-side identity, see first-party cookies on Shopify.

This is where a tracking app earns its place. WeltPixel Conversion Tracking captures the platform identifiers that matter, the GA4 client ID, the Meta and TikTok click IDs, the Google Ads gclid family, and the Reddit click ID, and bridges them to server-side events, so a purchase still matches the buyer even when cookie lifetimes shorten or consent settings cut the browser story short. It does not read _shopify_y for your attribution, because that was never the right source.

FAQ

What is the _shopify_y cookie used for?

It was Shopify's first-party visitor cookie, used by Shopify Analytics to recognize a returning browser and count unique visitors. Shopify's policy still lists a one-year lifetime, but the cookie was retired on storefronts in January 2026 and is no longer set.

What is the difference between _shopify_y and _shopify_s?

_shopify_y identified the visitor over the long term (one year). _shopify_s identified a single session with a 30-minute rolling expiry. One is "who," the other is "this visit."

Why don't my Shopify Analytics numbers match GA4?

Because they count from different cookies. Shopify used _shopify_y and _shopify_s with its own visitor and session definitions until January 1, 2026, and now identifies visitors through the Web Pixels API instead; GA4 uses _ga and _ga_* with its own. Two independent systems will not produce the same totals.

Can I read _shopify_y to track my customers?

No. It is Shopify-internal, its value can change, and it was phased out on storefronts in January 2026. Use the Web Pixels API client ID, which is the supported source of a stable visitor identifier.

Capture identity where it is stable

Shopify's own cookies are changing under you, which makes the browser a shaky place to anchor attribution. WeltPixel Conversion Tracking captures the platform identifiers that survive, the GA4 client ID, Meta and TikTok click IDs, the Google Ads gclid family, and Reddit's click ID, and bridges them to server-side events, so identity holds even as cookie lifetimes and consent rules tighten.

Install WeltPixel Conversion Tracking on the Shopify App Store

Sources

1. Shopify Cookie Policy
2. Shopify Changelog: _shopify_y and _shopify_s cookies will no longer be set
3. Shopify Help Center: Customer privacy settings