Consent and privacy for ads
What shoppers see and choose, what is kept with and without consent, Global Privacy Control, how long ad-click data is kept and how to answer privacy requests.
What it is
Ad tracking uses cookies and personal data, so most countries' laws say how and when you may use it. The app and the CFI Order Attribution plugin are built consent first: nothing about a shopper's ad click is kept unless the shopper agreed, and nothing is sent to an ad platform without that agreement.
This guide explains the whole chain from the shopper's side to yours: the banner, what the plugin keeps, what reaches the ad platforms, how long it is kept, and how to export or erase one person's data.
Why it matters: in the EU, the UK and many other places, tracking without consent can bring fines and complaints. A clean set-up also builds trust, and still gives you useful campaign totals, because even a "no" keeps the campaign name (without anything that identifies the person).
Note Example: an EU store has 1,000 orders in a month. 620 shoppers accepted marketing cookies. Those 620 orders carry click ids and can be sent to ad platforms. The other 380 keep only "facebook / paid_social / autumn-sale". The ROAS report still credits all 1,000 orders to their campaigns; only the 620 are ever sent anywhere.
The app does not give legal advice. The templates on the Privacy & compliance tab are starting points to review with your adviser.
Who it is for
- Shop owners, who are the controller of their shoppers' data (Cash Flow Inventory processes it on their instructions)
- Whoever answers privacy requests in the business
- Advisers and agencies checking a shop's set-up
Before you start#
- Install a consent banner on the shop. Tools that support the WP Consent API (for example Complianz, CookieYes, Cookiebot) are read automatically; OneTrust and Google Consent Mode are read too.
- Install the plugin. See The CFI Order Attribution plugin.
- Only the business owner can export or erase a person's data and change how long data is kept.
Step by step#
- In WordPress, open WooCommerce › Settings › CFI Attribution and set Where consent is needed.
- Copy the Suggested text for your privacy policy into your privacy policy.
- In the app, open Integrations › CFI Order Attribution and the Privacy & compliance tab.
- Read the line Law used: … Ad tracking: …. It comes from your business's country.
- Download or Print the templates you need: DPIA outline — ad attribution, Record of processing (RoPA) entry, Data processing note — CFI as processor, Privacy-policy paragraph and Cookie list — CFI Order Attribution plugin.
- Add the plugin's cookies from the cookie list to your banner, under marketing.
- In the app, open Settings › People & access › Access policy and choose Keep ad-click data. Then choose Save.
What your shoppers see#
- Your consent banner, on the first visit. The plugin itself shows no banner; it obeys yours.
- After an order, optionally How did you hear about us? (optional) on the order-received page, if you switched the prompt on.
- No other change. With a "no", the shop works exactly the same.
What each choice means#
| Shopper's situation | What the plugin keeps on the order | Sent to ad platforms? |
|---|---|---|
| Said yes to marketing | Click ids, campaign tags, landing page, referrer, Meta and TikTok browser ids, IP address and browser at checkout, the checkout event id, the consent decision | Yes, with contact details hashed |
| Said no | The campaign label only (platform, tags, landing page path, referring site) and the consent decision | Never |
| Browser sends Global Privacy Control | Same as "no" | Never |
| No choice made yet, in a region that needs a yes | Same as "no" | Never |
| Outside the opt-in regions, with Notice is enough outside opt-in regions, did not object | Same as "yes" | Yes |
The opt-in regions are the EEA, the UK, Switzerland, Quebec, South Korea, China, Brazil, India and Japan, and any shopper whose country can't be told. With Ask everyone first (recommended), every shopper is treated as opt-in.
The Meta Pixel, when the plugin loads it, also waits for the "yes". A refusal deletes the plugin's cookies and Meta's _fbp and _fbc. For buyers in US states with privacy laws, Limited Data Use is added automatically.
The plugin's cookies
| Name | Purpose | Kept |
|---|---|---|
| cfi_attr | The ad click ids and campaign tags of the visit and earlier visits (no name, e-mail or address) | The plugin's cookie days (30 by default) |
| cfi_eid | One random checkout event id, so browser and server events count once | The session |
| cfi_vid | A random visitor id; only its hashed form is sent to Meta | The plugin's cookie days |
| _fbp, _fbc | Meta's browser id and ad-click id, set by the Meta Pixel | As Meta sets them |
| _ttp | TikTok's browser id, read only | As TikTok sets it |
All are marketing cookies, set only after consent.
How long data is kept#
- Checkout identifiers (Meta and TikTok browser ids, IP address, browser, checkout event id, click ids) are cleared after 90 days, long enough for a cash-on-delivery order to be delivered.
- Click-level data (click ids, campaign tags, landing pages, referrers, the visits before each order) is kept for the period in Keep ad-click data: 13 months by default, from 30 days to 2 years. There is no "keep for ever". Older data is removed every night; the purge keeps a private backup for 30 days.
- The order and its totals always stay. Campaign totals stay true.
How to answer a privacy request#
- Open the customer (Sales › Customers, then the customer).
- Open the menu and choose Export personal data. A file with everything the business holds about the person downloads, including their order attribution and visits.
- To erase, choose Erase personal data… and confirm Erase. Erasure is refused while money is still open with the person.
Erasure deletes the person's visits and removes every identifier from their orders' attribution. The consent decision stays as proof, and the campaign label stays so campaign totals remain true. Invoices and payments stay, because the law requires them. Both actions are written to the audit log.
Daily use#
A cash-on-delivery shop in Bangladesh
Bangladesh's Personal Data Protection Ordinance 2025 starts its duties in stages, and the app's register treats ad tracking there as consent first. Keep Ask everyone first (recommended) and a simple banner. Phone numbers are hashed before they are sent.
An EU store with cookie consent
Use a certified banner that supports the WP Consent API or Google Consent Mode. Keep Ask everyone first (recommended). Download the DPIA outline and the record of processing, complete them with your adviser, and keep them on file.
A retailer selling in several countries
The app picks the law from your business's country. If you sell into the EU from outside it, keep "ask everyone first": a shopper's location, not yours, decides which rules apply to them.
Good practice#
- Ask everyone first unless your adviser says otherwise.
- Keep the shortest retention you can work with. 13 months covers a year-on-year comparison.
- Answer privacy requests from the customer's page, so the attribution is covered too.
- Review the templates when you connect a new ad platform; they list your connected platforms.
Troubleshooting#
| What you see | Why | What to do |
|---|---|---|
| Almost every order has no click id | The banner does not tell the plugin the choice | Use a banner that supports the WP Consent API, or set Custom CMP variable name in the plugin |
| Allow pop-ups to print the template. | The browser blocked the print window | Allow pop-ups for the app, then Print again |
| Not chosen yet, so the recommended 13 months applies. | Retention was never chosen | Choose a period and Save |
| Export personal data is missing | Only the business owner sees it | Ask the owner |
| Erasure refused | Money is still open with the person | Settle or write off first |
Limits and what is not there yet#
- Consent is one "marketing" decision today. After the 2026-11 update, Google receives the two Consent Mode signals for ad user data and ad personalisation separately, Microsoft is never sent an event without an explicit consent value, and erasing a person also stops any of their conversion events still waiting to be sent.
- Reading IAB TCF consent strings and showing a "Global Privacy Control honoured" note on the shop are planned.
- Shopify orders carry no consent decision, so they are never sent to ad platforms.
- Templates are not legal advice.
Questions#
Does "no" mean the order is not attributed?
The order still keeps its campaign label, so reports stay complete. It just never carries anything that identifies the person, and it is never sent to an ad platform.
Is Global Privacy Control respected?
Yes. A browser that sends it is always treated as "no".
Who is the controller?
Your business is the controller of your shoppers' data. Cash Flow Inventory is the processor. The Data processing note — CFI as processor template explains this.
Can I keep ad data for ever?
No. The longest period is 2 years.