Attributing orders via the checkout

If your shop reports an order without a consent decision, for example “Buy it now” without a cart, Metrunio counts it for revenue reconciliation and attributes it to no channel. If the same person consented in the same checkout, attribution is permitted. Order attribution via the checkout makes that connection, and only when it is proven.

What you need

• The Shopify app: the pixel reports the checkout identifier on completion, and the webhook reports the same identifier with the order.
• The Shopware plugin from version 1.1.0: the finish page and the purchase from the server carry the same identifier.
• Your own integration: the same identifier as checkoutRef on the conversion in the SDK and as checkout_ref on the purchase in the server API.
• Consent texts that mention linking orders and revenue to visits and advertising contacts (sample text below). If yours do not say that yet, adapt them and collect consent again, for example by raising the version of your banner. A note in the privacy policy does not extend consent already given.

Switching it on

1. 01In the portal, open “Privacy” in the “More administration” group. The card is called “Order attribution via checkout”. Only the Admin role may do this. If the card is missing, order attribution via checkout is not yet available for your account.
2. 02For each website, enter the identifier of the version of your consent texts, such as a date, confirm that they mention the attribution, and save.
3. 03Tick the box at the bottom and enable order attribution. Both are recorded in the log.

When an order is attributed

• The order came from the server without a decision, not after a refusal and not from the historical import.
• Website, environment, order number and checkout identifier match the event from the browser, and exactly one browser carries them.
• The browser event arrives within 24 hours of the order and carries consent to analytics and marketing.
• The consent existed at the latest at the time of purchase, has not been narrowed since and carries an identifier of your texts that you had confirmed. An identifier confirmed later does not apply retroactively.

Metrunio never stores the checkout identifier in plain text, only as a hash with a secret key, and for no more than 24 hours: next to the order from the time of the order, on the browser event from the time it arrives. If the attribution succeeds, Metrunio deletes the matching record immediately, otherwise in the next maintenance run. Backups expire on their own schedules; even after a restore, expired matching data is not used again. The rest of the event is kept as long as your other raw data.

If any of this is missing, only this order stays unattributed and still counts towards revenue. The order of arrival does not matter: whether the browser event or the order comes first, it is attributed exactly once. If the person withdraws or narrows their consent, Metrunio deletes the attributed order and blocks the order number.

Once the order is attributed, its time is the moment the browser completed the checkout. The attribution model then distributes it across the visits and ad contacts before it, including those on the same day. Without attribution, Metrunio knows only the day of such an order.

Sample text for your cookie banner

For the description of the statistics and marketing category; adapt it to your tone: “We use Metrunio to measure which visits and advertising contacts lead to orders. To do so, we link your order and its value to the visits and advertising contacts that preceded it, even if our shop system reports the order.”

Text block for your privacy policy

Attribution of orders. If you have consented to performance measurement (statistics and marketing), we and our processor Metrunio (Kokolorum GmbH) link your order and its value to the visits and advertising contacts that preceded it. This also applies if our shop system reports the order. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via [cookie settings]; the attribution is then deleted.

Second text block: the temporary matching record

For every order without a decision, Metrunio first creates a matching record, even if no matching browser event arrives later. You need a legal basis of your own for this, as a rule your legitimate interest based on your own balancing, and a notice in your privacy policy. Use the following text only if your balancing came out in favour, and insert your contact route: “For orders for which our shop system transmits no tracking decision, we temporarily keep the order reference, a checksum of the checkout identifier formed with a secret key and the exact time of the order for matching purposes. This also happens if no matching browser event arrives later. The basis is our legitimate interest, established after balancing (Art. 6(1)(f) GDPR), in correctly attributing orders for which valid consent already existed at the time of purchase even when the reports arrive at different times. Orders are attributed to visits or advertising contacts only where consent is demonstrated that existed at the latest at the time of purchase; after a transmitted refusal no such record is created. The matching data is used for no more than 24 hours and then deleted in regular operation; backups expire on their own schedules. You may object to this processing on grounds relating to your particular situation via [contact route].”