Consent

Use this page when you need the exact rules for Cevoid session creation and the ca_session cookie. If you only want the operational setup steps, use Session tracking instead.

Every tracked event carries a session_id for the current page runtime. The SDK only writes that session to the ca_session cookie, so it lasts across page loads, when both of these are true:

1. enableSessionTracking is enabled
2. The consent checks resolve to granted

If consent is denied, events can still be sent, but ca_session is not written, so the session_id lasts only for the current page runtime. Cevoid only uses sessions stored in ca_session to connect widget activity with completed orders.

On a non-Shopify site with no GTM consent entry and no window.cevoidTrackingConsent value, the consent checks default to granted.

The current Cevoid session cookie name is ca_session.

cevoid_sid is the legacy cookie name. The SDK will migrate an existing legacy cookie into ca_session and clean up the old cookie when possible.

If your storefront requires cookie disclosures before analytics storage is enabled, document ca_session in your cookie policy before you turn on session tracking in production.

When session tracking is enabled, the SDK checks up to three sources, described below. Consent resolves to granted only when every check resolves to granted. If none of these sources are present on a non-Shopify site, the overall consent result defaults to granted.

If Shopify is not present, this check defaults to granted.

If Shopify is present, the SDK tries to load the consent-tracking-api feature and waits up to 5 seconds:

• if the feature loads, it uses window.Shopify.customerPrivacy.userCanBeTracked()
• if feature loading fails or times out, the Shopify check resolves to denied

If window.dataLayer is missing, is not an array, or holds no consent command, this check defaults to granted.

If consent commands are present, the SDK reads analytics_storage from the latest ['consent', 'default' | 'update', {...}] style entry that sets it:

• analytics_storage === 'granted' means granted
• any other value means denied

If consent commands are present but none of them sets analytics_storage, this check resolves to denied.

If this global is missing, this check defaults to granted.

If it is present:

• 'granted' means granted
• any other value means denied

If consent resolves to granted, the SDK:

• creates or refreshes ca_session
• uses a 30-minute rolling expiry
• keeps the same session_id on tracked events across page loads

Cookie attributes:

• Name: ca_session
• Path: /
• SameSite: Lax
• Domain: only set when you pass cookieDomain

If consent resolves to denied:

• the SDK removes ca_session and the legacy cevoid_sid cookie
• the SDK does not create ca_session
• tracked events can still be sent
• those events carry a session_id for the current page runtime only

If consent is granted but the browser blocks cookie writes, the SDK falls back to an in-memory session for the current page runtime.

That fallback:

• does not persist across full page reloads
• still allows a session value to be attached during the current runtime

When enableSessionTracking is enabled, tracked events are deferred until consent resolution finishes.

After consent resolves:

• if granted, the SDK creates or refreshes the session and then sends the deferred events
• if denied, the SDK sends the deferred events without writing ca_session

Result:

• consent defaults to granted
• ca_session is created if session tracking is enabled

Result:

• no ca_session is created
• events can still be sent, with a session_id for the current page runtime only

Result:

• no persistent ca_session
• in-memory session fallback for the current runtime only