Privacy and security
Do I need a cookie banner for Metrunio?
Yes: Metrunio measures visits and ad contacts only with consent, so it belongs in your cookie banner and your privacy policy together with its storage entries. Without consent it accepts at most purchases and refunds for revenue reconciliation, without browser, customer or advertising identifiers. The legal framework is Section 25 TDDDG: storing and reading information on a device generally requires consent.
Do I need consent and an entry in the cookie banner for Metrunio?
Metrunio is built so that consent-based measurement is the normal case: without consent an event is not stored, and the consent state is present per event and available for analysis. The exception is purchases and refunds your server reports without consent: without a decision in the banner and, only with an activated additional instruction, after a refusal. They are stored for revenue reconciliation without browser, customer or advertising identifiers; you can switch this off under Privacy.
What you state in the cookie banner
- Service: Metrunio, a service of Kokolorum GmbH, Industriering Ost 66, 47906 Kempen, Germany. Metrunio processes the data on your behalf.
- Purpose: measuring which visits and ad contacts preceded an order or lead, and distributing the revenue across them by a rule.
- Category: the visitor ID needs consent to analytics (statistics), the view ID for seen ads consent to marketing. You map how the categories are called in your banner during setup.
| Name | Type and lifetime | Needs |
|---|---|---|
| metrunio_anonymous_id | localStorage, no fixed expiry; removed on withdrawal | consent to analytics |
| metrunio_session | sessionStorage, until the tab is closed | consent to analytics |
| metrunio_queue | localStorage, until the waiting events have arrived | a decision in the banner |
| metrunio_consent_pending | localStorage, until the decision has been reported | a decision in the banner |
| metrunio_view | cookie of the measurement address, 30 days | consent to marketing |
| metrunio_aid | cookie on your domain, 13 months (Safari seven days), only with your own measurement domain; valid on all subdomains | consent to analytics |
What each entry is for, and what else Metrunio stores, is in “Which data is stored?”. For revenue reconciliation there is a separate building block for your privacy policy.
EDPB Guidelines 2/2023 address tracking pixels and tracking links under the same ePrivacy rules; they therefore also cover impression pixels and click redirects.
Legal note
We are preparing a building block “Measurement with Metrunio” for your privacy policy; until then, use the details above and agree your text with your data protection adviser.
Legal note
This description is no substitute for legal advice. The legal notice, privacy policy and consent concept of your website are for you to review with your own legal adviser; the legal basis per signal and purpose must be documented.
Last reviewed on 17 Oct 2026
Also asked
- Do I need a cookie banner?
- What do I have to state about Metrunio in the cookie banner?
- Does Metrunio have to be in the privacy policy?
- TDDDG
- Is this GDPR compliant?
- ePrivacy
Related articles
- What happens without consent?
Is nothing really stored without consent?
By default, Metrunio stores nothing without matching consent, not even a raw event, and the tracking script sends nothing before a decision. One documented case differs: purchases and refunds your server reports without consent count towards measured revenue for revenue reconciliation, with their order number and without browser, customer or advertising identifiers, and are not attributed. After a refusal this only applies with an activated additional instruction. Without consent on the ad side, the click redirect passes on only the campaign, no click ID.
- Which data is stored?
What exactly does Metrunio hold about my website’s visitors?
Pseudonymous identifiers, event data with timestamps, campaign and click identifiers, and conversion values. No raw IP addresses; event fields are not meant to hold plain-text names or contact details. Detected email addresses and phone numbers cause rejection; the automatic check does not detect every kind of personal data, though.
- How do I connect my consent tool?
Which consent tools behind my cookie banner are supported, and how do I map the categories?
In “Setup” you select your consent tool, the tool behind your cookie banner; for the common systems the categories are pre-filled. Other CMPs and custom consent APIs can be mapped freely.
- Where is the data processed?
Is there a data processing agreement, and where are the servers?
Application, database and analytics storage are planned for the europe-west3 region (Frankfurt); what goes beyond that, such as logs and support access at the cloud provider, is listed in the sub-processor list under “Documents”. You conclude the data processing agreement with us in the portal under “Privacy” or in the Shopify app; nothing is measured before that. We have our own agreements with our sub-processors.
- Privacy policy text block: revenue reconciliation
What does my privacy policy need to say about revenue reconciliation?
Your privacy policy must name revenue reconciliation as a purpose of its own alongside tracking, with the legal basis (legitimate interest under Art. 6(1)(f) GDPR), the data, Metrunio as processor, the retention period and how to object. Metrunio’s privacy policy does not inform your buyers. The block below is a draft for you to adapt.