Customer privacy utilities occasionally returning false positives

What is the location of your example repository?

No response

Which package or tool is having this issue?

Hydrogen

What version of that package or tool are you using?

"@shopify/hydrogen": "2026.4.0",

What version of React Router 7 are you using?

"react-router": "7.14.0",

Steps to Reproduce

I am trying to prevent some scripts from firing before consent has been given, but the utilities given to check if consent is given are sometimes returning true before consent has been given. It seems to be a bit flaky and doesn't happen all the time. I'm using the default Shopify cookie banner. I've tried using canTrack and customerPrivacy returned from useAnalytics(), as well as calling window methods directly. These specifically:

• window.Shopify?.customerPrivacy.analyticsProcessingAllowed()
• customerPrivacy?.analyticsProcessingAllowed()
• canTrack()

Steps to reproduce:

1. Log the result of those ☝️ invocations on page load
2. Load a page, before having accepted cookies
3. You might see them return true (might take a few reloads)

Expected Behavior

The utilities should return false, since no consent has been given

Actual Behavior

The utilities [sometimes] return true:

If I then call the window method directly (without reloading or giving consent), it correctly returns false.

If I refresh the page (still without giving consent), the utilities correctly return true:

Start with the useAnalytics customerPrivacy and canTrack entry points, then compare their page-load results with window.Shopify.customerPrivacy.analyticsProcessingAllowed() while using the default Shopify cookie banner. Reproduce the intermittent pre-consent true result across reloads; done when all utility paths consistently return false before consent and the existing behavior remains correct afterward.