Consent and visitor tracking

Where to find the setting

Open a site from Sites, choose Settings, and scroll to Visitor tracking and consent. The card holds two things: whether adfit measures this site at all, and how it recognizes visitors while it does.

Turn measurement on or off

The switch Measure visitors and conversions on this site controls everything below it. When it is off, adfit stops measuring on this site: no visitor data, no A/B results. Personalizations and pageview counting keep running.

• Turning it off ends every running experiment on the site. adfit asks you to confirm first.
• Turning it back on starts new runs for your published campaigns. The earlier runs stay in the run history.
• While it is off, the Performance page shows Measurement is off instead of your campaigns.

The two tracking modes

Cookieless only (default)

adfit stores no visitor id and nothing that identifies the visitor. Visitors are counted with a hash that changes daily. adfit builds the hash from the visitor's IP address and browser details and keeps the key behind each day's hash for two days only, so a visitor can be recognized on the day of their visit and on the day after; after that, the hash can no longer be matched to that visitor's later visits. adfit deletes the stored visits and conversions that carry the hash after 90 days.

The trade off is length of memory: a visitor who comes back on a later day may be counted again, as a new visitor. Which version they see then depends on your Variant persistence setting, because the group is kept in the stored version in their browser, not in the count:

• With Session, the stored version ends when the tab is closed, and None stores none. A visitor who matches the campaign again after that is assigned to a group again and may end up in the other group.
• With Persistent, the stored version keeps the visitor in the same group for up to 30 days, so they can be counted again in the same group. See Visitors measured without a stored id.

Stored id with consent

adfit waits for your consent tool. When a visitor accepts, your tool calls window.adfit.consent(true) and adfit then remembers that visitor with a random id in their browser for 30 days.

Without consent, adfit measures that visitor the cookieless way, exactly as in the default mode above. Once they accept, adfit recognizes them with the stored id instead for the tests they reach after accepting. If your consent tool treats a refusal as "no measurement at all", call window.adfit.optOut() on refusal instead of window.adfit.consent(false).

Switch modes with the radio buttons and press Save changes. The change does not end your running experiments.

Connect your consent tool

Any tool that can run a script when a visitor accepts will work, Cookiebot, Usercentrics and Complianz among them. Put the adfit call into the script your tool runs on acceptance:

window.adfit.consent(true)

And when a visitor declines or withdraws:

window.adfit.consent(false)

Which call belongs to a refusal depends on what your consent tool asks the visitor for:

• Consent to recognize visitors with a stored id: on refusal, call window.adfit.consent(false).
• Consent to statistics in general: on refusal, call window.adfit.optOut() (see Let visitors object).

A minimal example, using whatever event or callback your consent tool documents for acceptance:

// runs in your consent tool's "on accept" callback
window.adfit.consent(true);

• Calling it on every page load after acceptance is fine. The calls are idempotent.
• A given consent is remembered for 12 months. After that, adfit waits for a fresh signal from your tool.
• window.adfit.consent(false) deletes the stored id immediately. adfit keeps measuring in the cookieless way, exactly like the default mode.
• The calls do nothing harmful in the cookieless mode, so you can leave them in place if you switch modes later.

Let visitors object

For a visitor who wants no measurement at all, adfit has a second call you can put behind a link in your privacy policy:

window.adfit.optOut()

What it does, and what it deliberately does not do:

• It stops the measurement for that visitor: no visitor data, no conversions, no A/B counting.
• It deletes the stored id immediately, if there was one.
• Personalization keeps working. As long as their browser keeps the objection, visitors who opted out see the personalized version, so objecting does not cost them the experience you built.
• Visitors who opted out still use your pageview allowance whenever a personalization is applied to their page, the same as every other visitor. See What counts as a pageview.
• Visitors who opt out stay opted out until they clear their browser data. The objection does not expire, and window.adfit.consent(false) does not undo it.

In browsers that do not let adfit store anything, an objection cannot be saved. See Browsers that do not let adfit store anything.

The adfit snippet has to run on the page with the link. This link checks that and tells the visitor the result:

<a href="#" id="adfit-opt-out">Object to measurement</a>
<script>
  document.getElementById("adfit-opt-out").addEventListener("click", function (event) {
    event.preventDefault();
    var adfit = window.adfit;
    if (adfit && typeof adfit.optOut === "function") {
      adfit.optOut();
      this.textContent = "Done. adfit no longer measures your visits to this website in this browser for statistics or A/B tests.";
    } else {
      this.textContent = "Your objection could not be saved on this page. Please try again later.";
    }
  });
</script>

What adfit keeps in a visitor's browser

adfit uses your browser's web storage, never a cookie. In both modes it keeps:

• The version a visitor was shown (the personalization and, for each campaign the visitor matched while adfit was measuring it, the group), so the same visitor does not flip between versions from page to page. It can contain a random local value that never leaves the browser and identifies nobody. That value is created only when an A/B test with a holdback runs, and it is kept afterwards until the stored version expires. How long it is kept is your Variant persistence setting, described on Snippet behavior.
• A small sending buffer for measurement events, so nothing is lost when a page is closed quickly.
• The consent state for your site, once your tool or the visitor sets one.
• A visitor's objection, if they opted out. It contains no id, does not expire, and applies to every adfit setup on the same website address.
• Short-lived entries for the current tab: a copy of the settings adfit loaded for each page, so it can prepare that page again right away, and small markers that note whether a page has already reported that the snippet is connected, or that sending has paused for this tab, for example after an error. In a small sample of visits, one more marker lets the snippet also report the structure of the other pages opened in this tab. They contain no id and end when the tab is closed.

Only in the consent mode, and only after a visitor accepts, adfit adds a random id, stored for 30 days. It is not derived from anything about the visitor, it is never put into a URL, and it is deleted the moment consent is withdrawn or a visitor opts out.

Conversions are attributed for as long as adfit remembers the visitor's variant, which is why the persistence setting also decides how late a conversion can still count.

Browsers that do not let adfit store anything

Some browsers, or their privacy settings, do not let a site store anything. To find out, adfit briefly writes an empty test entry and removes it right away. In those browsers:

• adfit does not measure the visitor. Personalization still runs, but adfit may not keep the same version from page to page. Pages still count towards your monthly pageview allowance.
• This happens the same way in both groups of an A/B test, so it does not tilt the comparison. Fewer visitors are measured, and your results describe visitors whose browsers allow storage.
• An objection cannot be saved. If the visitor allows storage later, they need to object again.
• Because the objection is not saved, a visitor who opted out can see your original while an A/B test with a holdback runs.

Your legal texts

Your legal texts stay your responsibility. You decide what your site tells visitors, in which language, and where your privacy policy links to the opt out.

Related

• Reading A/B results: what the tracking mode changes about your numbers.
• Snippet behavior: the variant persistence setting and what the snippet does on a page.
• Privacy & security: how adfit handles your own account data.