The GDPR misconception
Many Shopify merchants believe GDPR means they cannot run effective ad tracking in Europe. That is wrong. GDPR does not prohibit tracking. It requires that personal data be processed lawfully, transparently, and with appropriate consent. With the right setup you can track well and stay compliant.
What GDPR actually requires for tracking
For marketing tracking (pixels, CAPI, remarketing), you need consent from EEA visitors before processing personal data. Show a consent banner before marketing pixels fire, give a genuine choice, and respect the decision. Document what you collect, how long you keep it, and who you share it with in your privacy policy.
For server-side CAPI, you act as a processor on behalf of merchants. Each merchant is the controller for their customers’ data. Layer Insights is positioned as a CCPA Service Provider and GDPR data processor. Merchants control what is sent. We process only as instructed.
The two-state tracking model
When consent is granted, send full events with advanced matching, hashed email, phone, name, address, and click IDs. That gives maximum EMQ. When consent is denied, still send events, but with an empty user_data object and the limited_data_use flag. No PII is transmitted. Event value and currency stay, which lets platforms use aggregate modeling. For Google, Consent Mode v2 sends cookieless pings for modeled conversions. That is required for EEA traffic under Google’s EU User Consent Policy.
Google Consent Mode v2 Advanced
Consent Mode v2 is mandatory for Google Ads advertisers targeting EEA users as of March 2024. Basic mode only fires the Google tag when consent is granted. Advanced mode fires regardless, but sends cookieless pings when consent is denied. Layer Insights implements Advanced mode, which is required to benefit from modeled conversions for denied users. Signals passed are ad_storage, analytics_storage, ad_user_data, and ad_personalization, denied by default, granted when the user accepts marketing cookies.
Retention, deletion, and your privacy policy
Under GDPR you must answer access and erasure requests. Layer Insights handles Shopify GDPR webhooks. customers/data_request exports data. customers/redact deletes associated event data. Your privacy policy should mention that you use Layer Insights for analytics and ad attribution, that hashed event data goes to Meta, Google, TikTok, Pinterest, Snapchat, and LinkedIn, that first-party cookies _lf_id and _lf_session are set, and that users can withdraw consent via your banner.