Shopify Detox Scan Report

This public sample is an anonymized composite built from real external Detox Scan evidence. It shows the current report format without publishing a merchant's identity or any captured personal values. The scans used no Shopify admin access, installed no app, and made no code changes.

Screenshots are included in client reports; they're removed from this public sample to keep the scanned stores anonymous.

Highest Priority Findings

1. Subscription add-to-cart was silently dropped - High

The scan added a subscription item to a throwaway cart through Shopify's own cart API. The add request returned 200 with a selling plan, but the follow-up cart read did not include the variant. A shopper could appear to start a subscription while the cart quietly drops the item.

The first fix is to reproduce the selling-plan handoff, then confirm that subscription items survive from product form through cart drawer, cart page, upsells, and checkout.

2. Optional tracking continued after rejection - High

In region-verified EU, UK, and California runs, the consent probe rejected optional tracking, reloaded the storefront, and compared the resulting browser traffic. Optional analytics or advertising requests continued after the reject action, and the preference control could not be reopened reliably.

This is an observed technical behavior, not a legal conclusion. The next step is to trace consent state across the consent manager, Shopify Customer Privacy API, and each optional tracker, then review the result with the merchant's privacy advisor.

3. Accessibility barriers appeared across key states - High

Automated WCAG 2.2 A/AA signal testing covered the homepage, product, collection, and cart at desktop and mobile sizes. It found missing accessible names and image alternatives, contrast failures, visible controls removed from keyboard order, focus reaching hidden content, and accessibility blockers inside the consent interface.

Automation cannot establish WCAG conformance or replace assistive-technology testing. It does provide a focused remediation list and identifies which controls and page states need manual review first.

4. Duplicate analytics were confirmed, not guessed - Medium

The network log showed one GA4 tag sending page_view more than once per page load and found overlapping tag-manager ownership. That can inflate sessions, conversion rates, and ROAS decisions even when checkout itself is working.

The fix is to choose one owner for analytics bootstrapping, remove the duplicate source, and re-test the event stream on the pages that matter.

5. Privacy hygiene and legacy layers need cleanup - High

The privacy-hygiene pass found redacted contact, session, and token-like values in request URLs. The broader scan also found app leftovers, product-page console errors, poor real-user layout stability, duplicate embeds, and legacy JavaScript.

The report keeps only redacted data classes, query keys, destinations, and counts. Remove sensitive values from URLs, confirm which third parties receive them, then prune stale app layers around the buying path.

Coverage Snapshot

Important Boundaries

• Accessibility findings are automated signals against WCAG 2.2 A/AA, not a certification or full manual audit.
• Consent and privacy findings describe observed behavior in the recorded test context, not GDPR, CCPA, or other legal advice.
• Inconclusive checks stay marked for human review instead of being presented as confirmed failures.

My Read

Confirm the subscription failure first. Then align consent, tracking, and URL-data handling with the merchant's privacy advisor; fix the highest-impact accessibility barriers; and clean up analytics and app ownership. That protects revenue, shopper access, and data quality.