Shafayet
All work

CookieType

Consent that actually blocks trackers, built for how Shopify stores are really assembled.

The CookieType scanner results: six cookies found on a store, each with its provider, purpose, duration and category.
Built at
RedCircle
Role
Lead engineer
Timeline
2025 to present
Stack
React, Hono, Cloudflare Workers, Next.js, Shopify App Extensions
Live
cookietype.com

Most cookie banners are theatre. They appear, they record a click, and the trackers they claim to gate have already fired. For a merchant that is worse than useless: it looks like compliance while the exposure is unchanged. CookieType starts by finding out what the store actually loads.

The problem

A Shopify storefront is not one codebase. It is a theme, plus apps injecting their own scripts, plus whatever the merchant pasted into a custom script field. A consent tool that only controls what the merchant deliberately configured misses most of what is running — which is why the scanner comes first, classifying each cookie it finds by provider, purpose and duration.

One regime does not fit everywhere

GDPR, CCPA, VCDPA and PIPEDA do not want the same thing, so a banner that behaves identically everywhere is wrong somewhere. Regional behaviour is configuration rather than a separate product: the merchant picks where the banner appears, and geotargeting resolves the visitor’s rules.

The CookieType region selector with a world map, offering worldwide display or specific regions, and smart geotargeting.
Where the banner shows, and whose rules apply when it does.

What the shopper sees

The banner is deliberately small and the preferences modal does the real work — categories explained in plain language, each expandable to the actual cookies it covers.

The CookieType consent bar on a storefront, offering accept all, reject all and preferences.
Reject is as easy to reach as accept, which is the part most banners get deliberately wrong.
The CookieType preferences modal with strictly necessary, analytics, marketing and functional categories, each expandable to show its cookies.
Each category expands to the cookies it actually covers.

A regulator does not ask whether a banner was shown; it asks what a specific visitor consented to and when. So every choice is recorded against a consent ID with its region, device and per-category outcome, and the log exports.

CookieType analytics showing banner displays, acceptance and rejection rates, and a consent records table with per-visitor decisions and a CSV export.
The acceptance rates are for the merchant; the consent records are for the auditor.

How it works

Blocking has to happen before third-party scripts get a chance to run, which is why the banner is worker-backed rather than a script the theme loads alongside everything else. Being one tick late is the difference between consent and a record of consent.