Yes, a sandboxed pixel has less reach than a classic tracking tag, because it runs in a web worker with limited globals and no page access. It can still send the events it receives to an outside endpoint, so you must still decide which pixels to allow and what data they get.
What a sandboxed pixel is
Shopify's documentation describes pixels as JavaScript snippets that run on the online store and collect behavioral data, called customer events. Web pixel app extensions load in a strict sandbox using web workers. Shopify only guarantees a few globals: self, console, timer functions, and fetch with related globals. Many other globals are overwritten to be undefined. Features that scrape or write to the DOM do not work, and traditional pixels that use browser APIs such as window.document will not run in this environment.
The documentation says the sandbox is designed to give merchants and customers control over what data is accessible to app developers. It also says pixels honor the customer's consent signals. In regions that require consent, callbacks run only after consent is given and earlier events are replayed.
Classic tag versus sandboxed pixel
| Aspect | Classic tag in page | Sandboxed pixel |
|---|---|---|
| Runs where | Main page context | Web worker |
| Can read page fields | Yes | No, by design |
| Can write to the page | Yes | No |
| Can send data out | Yes | Yes, via fetch with CORS |
| Consent handling | Left to each tag | Follows the platform's consent signals |
What risk remains
The sandbox limits what a pixel can read from the page. It does not remove the data it is given. A pixel subscribed to purchase events receives order values and product details, and it can send them anywhere that allows cross origin requests. So the approval decision is still yours.
Steps for a store owner
- List all pixels and tags, noting which are sandboxed and which are classic scripts.
- Prefer the sandboxed form where a vendor offers one, and retire old copy and paste snippets.
- For each pixel, write down the events it receives and what each event contains.
- Remove pixels for campaigns that ended.
- Re-check after app updates, since a pixel can change what it sends.
- Never place classic tags on payment steps. See what a third party script can do on your page.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how an inventory lists what a project pulls in.
Quick check
Does the sandbox mean a pixel cannot leak order data?
No. It limits page access, but the pixel receives event data and can send it out through fetch.
Do pixels respect cookie consent?
Shopify documents that they follow the customer privacy signals. Test your own consent settings to confirm.
Sources
Safeguard can inventory the dependencies and scripts a web app loads, and you can run the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
