Shopify Attribution Cookies Explained: _shopify_sa_p, _shopify_sa_t, and UTM Tracking

Shopify Attribution Cookies Explained: _shopify_sa_p, _shopify_sa_t, and UTM Tracking

Short answer, checked on 28 September 2026: Shopify does not document _shopify_sa_p or _shopify_sa_t. Neither cookie appears in Shopify's cookie policy, last updated 18 September 2026, or in Shopify's developer changelog. Any page that tells you exactly what they store, or how long they last, is guessing.

That included an earlier version of this page. It said both cookies lasted 30 days and listed the fields inside them. Shopify documents neither, so both claims are gone.

What Shopify does document is where marketing attribution lives: on the order, in the customer journey, not in a cookie you can read.

What Shopify's cookie policy lists today

One wrinkle. Shopify's developer changelog of 4 August 2025 says storefronts stopped setting _shopify_y and _shopify_s on 1 January 2026 and points developers to the Web Pixels clientId instead, while the policy still lists both. When two Shopify documents disagree about a cookie, don't build reporting on that cookie.

Third-party cookie databases describe _shopify_sa_p and _shopify_sa_t as short-lived marketing and referral cookies. The popular reading of "p" as a persistent first touch and "t" as a temporary last touch has no Shopify source.

Where Shopify's attribution actually lives

Every online store order carries a customer journey. In the Admin API, CustomerJourneySummary holds:

• firstVisit: "The customer's first session going into the shop."
• lastVisit: "The last session before an order is made."
• daysToConversion: the number of days between the first session and the order.
• momentsCount: how many sessions and other moments came before the order.

Each visit, a CustomerVisit, records its source (a platform such as Facebook or Google, email, direct, a website domain, a QR code or unknown), referrerUrl, landingPage, occurredAt, a referralCode taken from a ref, source or r parameter, and utmParameters gathered from the URL. That is a documented first touch and last touch for every order, and you can export it.

In the admin, the same data is the order's conversion summary: where the first visit came from, the number of visits in the last 30 days, and the days between the first and most recent visit. When cookies were blocked, Shopify shows a limited summary, or none.

How Shopify credits a sale

Shopify offers five attribution models, and which one you see first depends on where you look. In the marketing reports under Analytics, Last click is selected by default when a report has sales metrics and marketing dimensions. In the Marketing section's activity data, the default is Last non-direct click. Same store, same orders, two defaults.

Both pages work on 30 days: the marketing activity data uses a 30-day lookback, and in the reports a visitor who doesn't buy within 30 days gets a new first interaction. Attribution data can take up to 24 hours to update. A buyer whose first visit came 31 days before the order falls outside that window, whichever channel found them. The attribution window entry covers how that choice moves credit.

How UTM parameters get in

UTM parameters on the landing URL are what fill utmParameters on a visit. Without them, Shopify works from the referrer, which a redirect, an in-app browser or a privacy setting can strip, and the visit reads as direct or unknown. The one part you fully control is the link, so tag every paid, email and influencer link with one naming scheme. The free UTM builder keeps it consistent.

Where cookie-based attribution breaks, on any store

1. Safari. Since ITP 2.1 (February 2019), "all persistent client-side cookies, i.e. persistent cookies created through document.cookie, are capped to a seven day expiry." A Safari buyer who returns after a week can look like a new visitor.
2. Devices. Cookies live in one browser. A click on a phone and a purchase on a laptop are two strangers.
3. Views. A visit starts with a click. Someone who watched five ads and then searched your name is credited to the search. See view-through conversions.
4. Consent. When a visitor blocks cookies, the conversion summary is limited or missing.

None of these shows up as a warning. The report just grows more confident about the channels it can still see, and every ad platform reports its own number with the same confidence.

What to do with it

• Export customerJourneySummary for last quarter's orders and count the orders whose first visit came from a different source than the last. That share is how often a last click model hands the credit to a channel that didn't start the journey.
• Switch the marketing report between first click and last click for the same quarter. Channels whose credit swings hard between the two are the ones worth testing.
• Before a big budget change, run a holdout test: pause one channel in part of your market for two weeks and compare store orders.

The first finding is free and runs in your browser; the full read is €99 once, excluding VAT.