Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Ecomtrack is an ecommerce ad attribution and tracking tool that combines first party and server side tracking to attribute store revenue to ad campaigns on Meta, TikTok and Google.
Ecomtrack is an ecommerce ad attribution and tracking tool that helps online stores understand which advertising campaigns actually generate revenue. It connects platforms such as Shopify, WooCommerce and custom stores with ad networks like Meta, TikTok and Google, using a mix of first party and server side tracking to recover conversions that browser based pixels often miss.
Ecomtrack was built to address the attribution gaps created by changes such as Apple iOS 14.5 and the general decline of third party cookies, which left advertisers with incomplete and misattributed conversion data. By setting first party tracking cookies on the store domain and forwarding conversion events from its servers directly to ad platforms, Ecomtrack reconstructs the link between an ad click and a purchase. The result is more accurate reporting on return on ad spend across Meta, TikTok and Google.
Ecomtrack relies on first party cookies and identifiers stored in the visitor browser to recognise returning users and stitch together their journey from ad click to checkout. It captures click identifiers from ad platforms, page and event data, order and revenue values, and technical attributes such as IP address and user agent. On the server side, this information is matched and forwarded to the advertising platforms so that conversions can be attributed to the correct campaign. Because the data can identify individuals and is used for profiling, it qualifies as personal data under the GDPR.
A common misconception is that server side tracking escapes consent obligations. It does not. The ePrivacy Directive requires consent for storing or reading information on a device, which covers the first party cookies Ecomtrack sets, and the GDPR governs the subsequent processing of the personal data collected. Sharing conversion data with advertising platforms for measurement and profiling is a processing activity in its own right and needs a valid legal basis. For advertising and analytics purposes, that basis is consent rather than legitimate interest.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Before any Ecomtrack cookie is set or any conversion event is sent to an ad platform, the visitor must give prior, informed and freely given consent. In practice this means the tracking should fire only after a positive choice in your consent banner, with no tracking on pages where consent has been refused or not yet given. Where supported, conversion data forwarded server side should respect the consent signal, for example through consent mode style logic, so that events are not sent for users who declined advertising cookies.
Because Ecomtrack forwards conversion data to Meta, TikTok and Google, personal data is typically transferred to the United States. These transfers require a valid mechanism such as the EU US Data Privacy Framework or Standard Contractual Clauses with supplementary measures. Your privacy policy should name the platforms that receive data, explain the purpose, and describe the transfer safeguards so that visitors understand where their data goes.
To deploy Ecomtrack compliantly, integrate it with a consent management platform so that both client side cookies and server side event forwarding are gated by consent. Document the cookies and identifiers in your cookie policy, disclose the data sharing with ad platforms, and keep records that demonstrate consent was obtained. Review data retention, sign the relevant data processing terms, and confirm that transfer safeguards are in place for data sent to the United States.
Websites using Ecomtrack must obtain user consent under GDPR regulations.
DPIA considerations
Ecomtrack processes personal data for advertising attribution, combining first party identifiers with server side transmission of conversion events to ad platforms. Because this involves systematic tracking of online behaviour and profiling for advertising, a data protection impact assessment is recommended. The assessment should cover the cross border transfer of conversion data to Meta, TikTok and Google in the United States.
Sample consent text
We use Ecomtrack to measure the performance of our advertising and to share conversion data with platforms such as Meta, TikTok and Google. These cookies and this processing run only with your consent.
Third-party domains contacted
ecomtrack.ioconnect.facebook.netanalytics.tiktok.comgoogleads.g.doubleclick.netCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _ect_visitor | First party | 12 months | Stores a unique first party visitor identifier so Ecomtrack can recognise returning users and stitch their journey across sessions for attribution. |
| _ect_click | First party | 90 days | Stores the advertising click identifier captured from the landing URL so a later purchase can be attributed to the originating ad campaign. |
| _ect_session | First party | 30 minutes | Maintains the current browsing session and links page views and events to the same visit for accurate conversion attribution. |
| _ect_attribution | First party | 180 days | Retains attribution data such as source, campaign and timestamp so revenue can be assigned to the correct channel over a longer conversion window. |
Ecomtrack uses cookies for user preferences — inform visitors with a consent banner.
Ecomtrack sets first party cookies on your store domain to recognise returning visitors and link an ad click to a later purchase. These typically include a visitor or click identifier and attribution values, stored in the browser to support cross session tracking. Because they are used for advertising and analytics, they require consent.
Yes. The first party cookies Ecomtrack sets are not strictly necessary, so the ePrivacy Directive requires prior consent before they are stored or read. Server side forwarding of conversion data to ad platforms also needs consent, so tracking should fire only after the visitor accepts in your consent banner.
The legal basis is consent under Article 6(1)(a) of the GDPR. Advertising attribution and the sharing of conversion data with platforms such as Meta, TikTok and Google rely on the user freely agreeing to it. Legitimate interest is not an appropriate basis for this kind of advertising and profiling.
Yes. When Ecomtrack forwards conversion data to Meta, TikTok and Google, personal data is typically transferred to the United States. These transfers should rely on a valid mechanism such as the EU US Data Privacy Framework or Standard Contractual Clauses with supplementary measures, and they should be disclosed in your privacy policy.
A data protection impact assessment is recommended. Ecomtrack involves systematic tracking of online behaviour and profiling for advertising, combined with cross border data transfers, which are factors that point towards a DPIA. The assessment helps you document risks and the measures taken to mitigate them.
Connect Ecomtrack to a consent management platform so that both client side cookies and server side event forwarding are gated by consent. Disclose the tool in your cookie and privacy policies, name the ad platforms that receive data, and keep records of consent. Confirm that transfer safeguards are in place for data sent to the United States.
Yes. Other server side attribution and conversion tracking tools exist, including platforms that integrate with Meta Conversions API, Google Enhanced Conversions and the TikTok Events API. From a privacy standpoint, the key is not the brand but whether consent is respected and whether data transfers are properly safeguarded.
Yes. Your cookie policy should list the first party cookies and identifiers Ecomtrack uses, their purpose and duration, and the fact that conversion data is shared with advertising platforms. Keeping this disclosure accurate and current is part of meeting your transparency obligations under the GDPR and ePrivacy.