Storefronts
Cookies and consent
What the storefront stores with the visitor, the consent banner, scripts that wait for consent and order links without a key in analytics.
Where: The banner shows in the storefront. The cookie policy is the cookies page under Storefronts › [storefront] › Pages.
What is stored with the visitor
| Storage | Contents | Required |
|---|---|---|
| Cart | Lines and currency, in the browser's local storage | Necessary |
| Currency and country | The bs_currency cookie in storefronts with several currencies and the bs_country cookie from the checkout and the country picker (Choose country). One year each | Necessary |
| Consent | The visitor's choice in the banner, per storefront. Valid for 12 months. Then the banner asks again | Necessary |
| Order link | The bs_order cookie with the key from the link in the order email. Applies only to that order's pages, for one hour after the last visit there. Scripts on the page cannot read it | Necessary |
| Discount code | bunstack:checkout:discount in the tab: the code the customer added in the cart or the checkout, or that came with a link. Removed when the tab closes or the order is placed | Necessary |
| Statistics and marketing | The GTM container under Storefronts › [storefront] › Analytics and your <script src> tags under Code › HEAD · SITE and HEAD · PAGE, for example a pixel. The ecommerce events to dataLayer, see Tracking and Google Tag Manager | After "Accept all" |
| Sent events | bunstack:ga4:orders in local storage: id and time of the 50 latest orders from the browser, so each order's purchase is sent once. bunstack:ga4:checkout in the tab: which cart the latest begin_checkout was for | After "Accept all" |
| Error monitoring | Sentry receives error reports. With "Accept all" also session recording and performance measuring | Error reports always. Recording and measuring after "Accept all" |
The consent banner
The banner shows on the first visit, in the storefront's theme and language. It has two buttons:
| Button | What happens |
|---|---|
| "Only necessary" | The storefront works. No scripts for statistics or marketing run |
| "Accept all" | The GTM container and the code under HEAD · SITE and HEAD · PAGE load. The storefront sends ecommerce events to dataLayer |
In a Swedish storefront the buttons read "Endast nödvändiga" and "Acceptera alla". The visitor changes the choice with the "Cookie settings" link in the footer ("Cookie-inställningar" in Swedish).
- No scripts run before the choice.
- The checkout and the order pages show no banner. When the visitor has already chosen "Accept all", the scripts run there too.
- Google Consent Mode gets "denied" until the visitor chooses "Accept all".
The storefront's script policy runs scripts only from the allowed hosts. The designer does not save a script from another host.
Order links and analytics
The link in the order emails (/orders/<id>?t=…) has a key that opens the order. The storefront removes the key from the address before the page loads and puts it in the bs_order cookie. GTM, Google Analytics, a pixel and Sentry see only /orders/<id>.
The events the storefront sends have no key and no details about the buyer. The discount code is not in the address either. A link with ?code=, for example in a newsletter, still works: the storefront moves the code into the tab before the container loads.
Set GTM to remove query strings on pages under /orders, so that no other parameter there reaches your analytics.
See also
- Export and erasure of a customer's data: GDPR for customers.
- BunStack as data processor, sub-processors and backups: Data and security.