Session tracking and consent

Cevoid's widgets record what visitors do with them on your store, such as viewing a post or clicking a product tag. Session tracking links those events into visits with a cookie, so Cevoid can count unique visitors and link orders to the content a visitor saw. Your visitors' consent decides who gets the cookie.

Navigate to Analytics → Reports → Setup guide⁠ to manage session tracking.

Cevoid's widgets send events to Cevoid on their own, with nothing to install beyond the widgets. They send events whether session tracking is on or off.

In galleries and cards, a view counts each time the widget or a post comes into view on the screen, including when the visitor scrolls back to it.

Upload forms run on Cevoid's own upload page, so their sessions are separate from the sessions on your store.

A session is one visit to your store. Cevoid links the events in a session together, which is how it counts unique visitors and links an order to the posts a visitor saw before buying.

• Session tracking off: each page view is a session of its own. Events are still sent, but they can't be linked across pages or to an order.
• Session tracking on: Cevoid sets the ca_session cookie for visitors who allow it. The cookie lasts 30 minutes and renews with every event, so a session ends after 30 minutes without activity.

Session tracking is needed for:

• Post reach and Post clappers, which count unique visitors
• Attribution: only trackable sessions, the ones with the session cookie, can be linked to an order

Session tracking is off by default. Before you enable session tracking, make sure your site passes your visitors' consent to Cevoid, as described in How consent works.

1. Navigate to Analytics → Reports → Setup guide⁠
2. Copy the cookie name ca_session and its description under Add cookie policy in the Session tracking card
3. Add the cookie and its description to your website's cookie policy
4. Enable the switch under Enable session tracking. The Session tracking requirement shows Completed.

Copy the description from the dialog, so it matches what the app shows. Today it reads:

Collects statistics from the visitor's interaction with Cevoid galleries on the website, such as post views, gallery views, post clicks, product clicks and statistics about order value after checkout.

The dialog doesn't show how long the cookie lasts: 30 minutes, renewed with every event, or 10 years when Cevoid's Shopify checkout web pixel sets it.

The switch applies to galleries, cards, and upload forms. Loyalty program widgets always run with session tracking on, and an analytics SDK your developer installs has its own setting. If you disable session tracking later, galleries and cards stop setting the cookie once their cached settings expire, which can take up to 3 hours.

Loyalty program widgets always run with session tracking on, whatever the switch in Analytics → Reports → Setup guide⁠ says. They still check consent, so they set the ca_session cookie only for visitors who allow it.

If your store shows loyalty program widgets, list the ca_session cookie in your cookie policy even when session tracking is off.

When session tracking is on, Cevoid checks the visitor's consent before it sets the ca_session cookie. Cevoid reads the visitor's choice from three sources:

• Shopify's Customer Privacy API, on Shopify stores
• Google consent mode, from the analytics_storage setting
• Cevoid's own consent flag, window.cevoidTrackingConsent, which your developer can set from your cookie banner

Every source on the page must allow tracking. A source that isn't on the page is skipped. Your developer connects your cookie banner to one of these sources, as described in Pass consent to Cevoid.

Consent is read once per page load. When a visitor accepts or declines your cookie banner, Cevoid applies the choice from the next page they open.

Consent decides only whether Cevoid sets the ca_session cookie. Cevoid's widgets send their events either way, with the device type, browser language, and page URL. Without the cookie, each page view is a session of its own, so the visitor's events can't be linked across pages or to an order.

Cevoid's widgets read consent once, when they load, so make the visitor's choice available before they load. Cevoid combines every source it finds on the page, and all of them must allow tracking. If the consent check itself throws an error, Cevoid treats consent as given.

On Shopify storefronts, Cevoid loads Shopify's Customer Privacy API and uses userCanBeTracked(). If the API fails to load or takes longer than 5 seconds, Cevoid treats consent as declined.

Cevoid reads the consent commands in window.dataLayer. The newest consent command that sets analytics_storage decides: granted allows the cookie, and any other value declines it. If there are consent commands but none of them sets analytics_storage, Cevoid treats consent as declined.

gtag('consent', 'default', { analytics_storage: 'denied' })
// After the visitor accepts:
gtag('consent', 'update', { analytics_storage: 'granted' })

Objects pushed straight to the data layer, such as dataLayer.push({ analytics_storage: 'granted' }), aren't read.

Set window.cevoidTrackingConsent before Cevoid's widgets load. granted allows the cookie, and any other value declines it. A missing or empty value counts as allowed.

<script>window.cevoidTrackingConsent = 'denied'</script>
<!-- After the visitor accepts: -->
<script>window.cevoidTrackingConsent = 'granted'</script>

A value you change after the widgets have loaded applies from the next page load.

If you install Cevoid's analytics SDK yourself, it runs its own consent check and has its own session tracking option. The switch in the Cevoid app doesn't affect it. See Consent and Set up session tracking in the developer docs.

On Shopify, sales tracking is Cevoid's checkout web pixel (see Report requirements). Shopify, not Cevoid, decides when the pixel runs, based on the customer's consent. Cevoid has three Shopify apps. Two of them have a checkout web pixel, and where your store asks for consent, their pixels need different permissions:

To check the pixel in Shopify, navigate to Settings → Customer events in your Shopify admin. In the App pixels list, the Cevoid pixel in use shows Connected. See Shopify's App pixels⁠.

When the customer has no ca_session cookie, the checkout web pixel sets one with a 10-year expiry. Cevoid's widgets can later use that cookie as the visitor's session.

Use these details when you complete your privacy policy.

Cevoid doesn't hash these identifiers. It keeps widget events for 2 years. Upload form events, and the orders that sales tracking reports, have no set retention period.

Cevoid stores this on the visitor's device:

Review widgets and the review form don't set the ca_session cookie.

Cevoid's widgets also send each event as a browser event on your page, named cevoid: followed by the event name, such as cevoid:post.click. A developer can listen for these events and forward them to Google Analytics or Google Tag Manager. Cevoid has no built-in Google Analytics connection. Review widgets and review forms send no browser events.

Browser events are sent whether or not session tracking is on, and whatever the visitor's consent. The Shopify checkout web pixel sends no browser events, and upload forms send theirs on Cevoid's upload page, not on your store. See Forward events to Google Analytics in the developer docs.