Tracking modes

Each site has a tracking mode. You choose it in the site's Settings tab, under Tracking mode. The dashboard always shows which mode a site is in.

Private (the default)#

• No cookies and nothing stored in the browser.
• Each visitor gets a hash made from a salt that changes every day, the site, the IP address and the browser's user agent. The IP address is never stored.
• The same person on the next day counts as a new visitor.
• Ad click ids (gclid, gbraid, wbraid, fbclid) are read on the landing page and kept with that visit's events only.
• The attribution report can only tie a sale to a source within the same visit.

Private mode is built so that in most places you do not need a consent banner for it. We are not your lawyer, so check the rules where you and your visitors are.

90-day tracking#

90-day tracking is on paid plans: Solo, Studio, Agency and Custom. Free does not include it. The script keeps a random first-party id and the latest click ids on your own domain for 90 days. So a sale on day 3 ties back to the ad or short link clicked on day 1.

What it stores, on your domain only:

Each is a first-party cookie and a copy in localStorage. A new Google click replaces older Google click ids; a Meta fbclid stays until a newer one comes. If Meta's own pixel set _fbp or _fbc cookies, the script reads them too, so conversions sent to Meta match better.

• The id lives on your domain, not on ours. It is not shared across sites, and Datacenter cannot follow a person from one site to another.
• Profiles build on this id. Call datacenter('identify', { email }) on signup or checkout, and the person's visits join one profile.
• Your own server receives the _dc_id cookie. Send it as visitor.id with the Events API to tie a server sale to earlier visits.
• Safari keeps a cookie set by a script for at most 7 days, and may clear script-set storage after 7 days without a visit. A visitor who comes back within 7 days keeps their id; after a longer gap in Safari, the next visit starts a new id. Once someone gives their email, every id they used joins one profile, so their history stays together.
• Serving the tag from your own tracking address does not change this. That address points to Datacenter, and Safari caps cookies set through an address that points elsewhere at 7 days as well (WebKit).
• It stores data on the visitor's device. In many places that needs consent first. In the EU and UK this usually means a consent banner.

You are responsible for consent on your site. Datacenter gives you a switch to wait for it.

The tag

90-day tracking uses its own tag. Copy it from the site's Settings tab after you switch:

<script defer data-site="shop.example.com" data-mode="attribution" src="https://datacenter.so/sa.js?d=shop.example.com"></script>

Keep the plain tag (s.js) after you switch, and visits still count, but no id is kept and no one gets a profile. Datacenter notices this from the visits it receives and shows a warning with the tag to paste.

If you switch back to Private, the 90-day tag keeps working but stores nothing. You can swap it back to the plain tag when you like. If the plan ends, the site works as Private.

Wait for consent#

Turn on Wait for consent in the site's settings. The script then stores nothing, and sends nothing to Meta from the browser, until your consent tool tells it to. Until then it works like Private mode.

No consent tool yet? Turn on Datacenter's simple cookie banner in the same Settings tab. It turns on Wait for consent and needs no code.

// Call this when the visitor agrees, for example from your consent banner.
datacenter('consent', true);

// Call this when they say no, or take consent back. It deletes what was stored.
datacenter('consent', false);

Before consent, datacenter('identify', ...) does nothing too.

Many consent tools let you run a line of code when a category is accepted. Put this line there. The script remembers the yes for 90 days, so you only need to call it when the visitor answers.

Honest notes on consent#

• Private mode does not store anything on the device and keeps no id across days. That is why it usually needs no banner. It still processes the IP address in memory to make the daily hash.
• 90-day tracking stores an id and click ids on the device. Rules like the EU ePrivacy Directive usually ask for consent before that, unless it is strictly needed for a service the visitor asked for. Measuring ads is usually not.
• Sending conversions to Meta shares the visitor's IP address, browser and click ids with Meta, plus hashed email and phone when you send them. That usually needs consent in the EU and UK in either mode, and a line in your privacy policy everywhere.
• Customer profiles keep hashed emails and phones, and the email, name and phone number encrypted unless you turn Show contact details off. Name this in your privacy policy. You can delete a customer or forget an email at any time.
• Server events you send with the Events API are yours to justify. Send only what your privacy policy covers.

When unsure, use Private mode, or 90-day tracking with Wait for consent on.

Which one to pick#

You can switch a site between modes at any time. Switching does not change data you already have.