Live Demo: Try this and other plugins live — no installation, no risk: demo.markus-michalski.net
The plugin transmits data to Meta (Facebook). This page shows exactly what that data is. It is not legal advice.
Privacy: With the Conversions API, the visitor's IP address and user agent are not hashed. They are sent to Meta in plain text. Only the email address and phone number are hashed with SHA-256.
| What | Where to | When |
|---|---|---|
Meta script fbevents.js is loaded |
connect.facebook.net |
As soon as the pixel is output (see Consent and cookies) |
| Pixel ID and event data (see Events and data) | Meta, through the Meta script | On every event |
Image for browsers without JavaScript (noscript) |
www.facebook.com/tr with Pixel ID and ev=PageView |
On every page on which the pixel is output, also in Klaro mode |
What the Meta script collects beyond that is determined by Meta. This includes what Meta learns from cookies, the IP address and the user agent of the browser.
Only when the Conversions API is active and the event meets all conditions (see Conversions API). Data is sent to graph.facebook.com.
Field (user_data) |
Content | Treatment |
|---|---|---|
client_ip_address |
Visitor's IP address, falling back to 0.0.0.0 |
Not hashed |
client_user_agent |
Browser user agent, truncated to 512 characters | Not hashed |
em |
Email address | SHA-256, lowercased and trimmed beforehand |
ph |
Phone number | SHA-256, reduced to digits beforehand |
fbc |
Value of the _fbc cookie, if present and in the expected format |
unchanged |
fbp |
Value of the _fbp cookie, if present and in the expected format |
unchanged |
In addition, event_source_url (full URL of the page, including the query string) and custom_data (the event data) are sent. The access token is in the request body.
Only the email address and phone number go through hashing. The IP address and user agent are deliberately sent unchanged, because Meta expects them that way.
| Event | Phone number | |
|---|---|---|
| PageView, ViewContent, ViewCategory, AddToCart | of logged-in customers | never |
| InitiateCheckout | of logged-in customers | from the billing address of logged-in customers |
| Purchase | of the orderer (also for guest orders) | from the billing address of the order |
Visitors who are not logged in send neither email nor phone number, except on Purchase.
Until the consumer processes the message, it sits in Shopware's message queue. The message contains the IP address, user agent, URL and the hashed values for email and phone number. Email address and phone number are never stored there in plain text.