Consent & Privacy

How Converlay handles consent via the Shopify Customer Privacy API — no custom banner needed, anonymous tracking before consent, Consent Mode v2 on every event.

How it works

1. The pixel loads for every visitor — its [customer_privacy] configuration declares no required consent purpose, so no data is lost while the banner is on screen
2. Until consent is granted, Converlay tracks anonymously: ephemeral identifiers, no localStorage, no personal data
3. When the visitor grants consent, persistent identity switches on and events carry full match data
4. Inside the pixel, init.customerPrivacy provides initial consent state and customerPrivacy.subscribe() tracks live changes
5. Consent flags are mapped to Google Consent Mode v2 format and included in every event payload

Consent mapping

Shopify consent flags are mapped to Google Consent Mode v2 signals:

Consent in event payloads

Every event forwarded to destinations includes a consent_data object:

• analytics: true/false — whether analytics tracking is allowed
• marketing: true/false — whether marketing tracking is allowed
• ad_user_data: true/false — whether user data can be sent to ad platforms
• ad_personalization: true/false — whether personalized ads are allowed

Per-destination routing

Converlay uses consent signals to decide which destinations receive each event. For example, if a visitor has granted analytics consent but denied marketing consent, events will be sent to GA4 but not to Meta or TikTok.

GDPR & CCPA compliance

• GDPR — Without consent, events carry no personal data and no persistent identifiers, and they are only routed to destinations the visitor's consent allows — enforced server-side on every event
• CCPA — Converlay honors Global Privacy Control (GPC) opt-out signals: ad destinations are blocked for GPC visitors, and all PII is hashed before forwarding
• Data retention — Event data is retained for 90 days for dashboard display, then automatically deleted
• Data deletion — Uninstalling the app triggers deletion of all stored data for that shop

Third-party consent platforms (CMPs)

Converlay reads consent exclusively from Shopify's Customer Privacy API, so any consent platform — OneTrust, Cookiebot, iubenda, Pandectes — works as long as it writes the visitor's choice into that API. Most Shopify-native consent apps do this automatically.

A banner that only manages consent on the page (for example via gtag or a script blocker) without syncing to Shopify is invisible to Converlay: visitors keep being tracked as if they had made no choice.

Connecting iubenda

iubenda's standard embed does not sync with Shopify by itself — it needs the Shopify-specific callbacks. The easiest way to add them:

1. Install the CMP Insert Code app from the Shopify App Store
2. Paste your iubenda Privacy Controls and Cookie Solution snippet into the app and enable the theme app extension if prompted — the app adds the Shopify callbacks automatically
3. Leave iubenda's autoblocking disabled: on Shopify, the native Customer Privacy API handles blocking

Prefer a manual setup? Follow iubenda's Shopify integration guide to add the onPreferenceExpressedOrNotNeeded callback yourself.