GDPR is same in whole EU. Ruling about country's specific laws is relegated to local Data Protection Authorities. That's why Facebook was able to get away with Irish DPA from ruling against it. There was even a suggestion of foul play.
In theory, a DPA in your country must make a ruling. That's why Google Analytics is officially "illegal" in certain, but not all EU countries.
That said, it would be weird if subsequent rulings were not in line with previous.
The politicians, the courts or agencies like the one that send letter to the author of this article.
I would say it is the politicians. By making laws.
Since the GDPR is the same in all EU countries, Shopify is either illegal in all EU countries or in none, right?