Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Monitus is an ecommerce analytics suite that enhances Google Analytics for Volusion stores, adding enhanced ecommerce tracking through cookies and tags.
Monitus is a United States based ecommerce analytics suite that historically served Volusion stores. It extends Google Analytics with enhanced ecommerce reporting, giving merchants a clearer view of product performance, funnels and revenue. Monitus achieves this by injecting tracking tags into store pages and forwarding structured event data to Google Analytics. It positions itself as an analytics enhancement layer rather than a standalone advertising network.
Monitus relies on Google Analytics cookies such as _ga, _gid and _gat, which store pseudonymous identifiers used to recognise returning browsers and to throttle request rates. It also tracks page views, product interactions, cart activity and completed purchases, including order values and identifiers. This information can be linked to a single device or visitor over time, which makes it personal data under the GDPR. Where transactional details are attached, the profile becomes more identifying and therefore more sensitive.
Storing and reading analytics cookies on a user device requires prior consent under Art. 5(3) of the ePrivacy Directive, since these cookies are not strictly necessary to deliver the service. The associated profiling and analytics processing must also satisfy the GDPR, which means a valid lawful basis, transparency and respect for data subject rights. Because Monitus channels data into Google Analytics, the controller must account for Google as a processor and for the international transfer that follows. Regulators across Europe have repeatedly scrutinised Google Analytics deployments, so careful configuration is essential.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent is the appropriate lawful basis for this analytics activity, and it must be freely given, specific, informed and unambiguous. The Monitus and Google Analytics tags should be blocked until the visitor actively opts in through a consent management platform. Pre ticked boxes, implied consent or simply continuing to browse do not meet the standard. Users must also be able to withdraw consent as easily as they gave it, after which tracking must stop.
Both Monitus and Google Analytics process data in the United States, which is a third country for European users. Transfers can rely on the EU US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses supported by a transfer impact assessment and supplementary measures. The controller should confirm the current certification status of each recipient and document the chosen mechanism. Features such as IP truncation and reduced data retention help lower the risk associated with these transfers.
Map every cookie and tag that Monitus and Google Analytics deploy, then gate them behind a compliant consent banner. Maintain a data processing agreement with the relevant providers and record the transfer mechanism for the United States. Configure data minimisation options, set conservative retention periods and disclose the tools clearly in the cookie policy. Finally, test the consent flow regularly to ensure that no tracking fires before the visitor agrees.
Websites using Monitus must obtain user consent under GDPR regulations.
DPIA considerations
Because Monitus performs systematic behavioural tracking of website visitors and combines it with transactional data that can identify individuals, a data protection impact assessment is recommended. Assess the volume of profiling, the international transfer of data to Google and Monitus servers in the United States, and the effectiveness of consent gating. Document the lawful basis, retention periods and the supplementary measures applied to the US transfers.
Sample consent text
We use Monitus and Google Analytics to understand how visitors browse and shop on our store. These tools set cookies and may transfer data to the United States. They run only after you accept analytics cookies.
Third-party domains contacted
monitus.netwww.google-analytics.comwww.googletagmanager.comstats.g.doubleclick.netCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _ga | third party | 2 years | Stores a pseudonymous client identifier used by Google Analytics to distinguish visitors for the enhanced ecommerce reports that Monitus produces. |
| _gid | third party | 24 hours | Stores a short lived visitor identifier used by Google Analytics to distinguish visitors within a single day. |
| _gat | third party | 1 minute | Used by Google Analytics to throttle the request rate and limit the volume of data collected on high traffic stores. |
| monitus_session | first party | Session | Maintains the Monitus tracking session so that browsing and purchase events on the Volusion store are correctly attributed. |
Monitus collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Monitus relies mainly on the Google Analytics cookies _ga, _gid and _gat, which store pseudonymous identifiers and control the request rate. It may also set a first party session cookie to keep ecommerce events associated with the right visit. None of these cookies are strictly necessary, so they require consent.
Yes. Because Monitus uses analytics cookies that are not strictly necessary, prior consent is required under Art. 5(3) of the ePrivacy Directive. The Monitus and Google Analytics tags must stay blocked until the visitor actively opts in, and consent must be as easy to withdraw as it was to give.
The appropriate legal basis is consent under Art. 6(1)(a) GDPR, combined with the prior consent requirement of the ePrivacy Directive for cookie storage. Legitimate interest is generally not suitable here because the activity involves non essential tracking and profiling. The consent must be freely given, specific, informed and unambiguous.
Yes. Monitus and Google Analytics process data on infrastructure in the United States, which is a third country for European visitors. Transfers should rely on the EU US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses with a transfer impact assessment and supplementary measures.
A data protection impact assessment is recommended because Monitus performs systematic behavioural tracking and links it to transactional data. The assessment should weigh the scale of profiling, the US transfers and the residual risk to visitors. Documenting the safeguards demonstrates accountability to supervisory authorities.
Block all Monitus and Google Analytics tags behind a consent management platform so nothing fires before opt in. Sign a data processing agreement, record the US transfer mechanism, and enable data minimisation features such as IP truncation. Test the consent flow regularly and keep the cookie inventory up to date.
European hosted or privacy focused analytics tools such as Matomo, Plausible or Fathom can reduce or remove third country transfers and, in some configurations, operate without consent based cookies. These options may offer less native Volusion ecommerce depth, so evaluate the trade off between functionality and privacy. Any replacement still needs a documented lawful basis and clear disclosure.
List the Monitus and Google Analytics cookies by name, purpose and duration, and identify Google and Monitus as recipients in the United States. Explain that consent is required and describe how visitors can withdraw it. Keep the policy synchronised with the actual tags deployed and review it whenever the configuration changes.