Facebook Pixel: Privacy
Which data the Facebook Pixel plugin for Shopware 6.7 transmits to Meta: browser pixel and Conversions API, what is hashed and what is not (IP address, user agent), and what to state in your privacy policy.
Facebook Pixel: Privacy
Live Demo: Try this and other plugins live — no installation, no risk: demo.markus-michalski.net
The plugin transmits data to Meta (Facebook). This page shows exactly what that data is. It is not legal advice.
Privacy: With the Conversions API, the visitor's IP address and user agent are not hashed. They are sent to Meta in plain text. Only the email address and phone number are hashed with SHA-256.
Browser pixel
| What | Where to | When |
|---|---|---|
Meta script fbevents.js is loaded |
connect.facebook.net |
As soon as the pixel is output (see Consent and cookies) |
| Pixel ID and event data (see Events and data) | Meta, through the Meta script | On every event |
Image for browsers without JavaScript (noscript) |
www.facebook.com/tr with Pixel ID and ev=PageView |
On every page on which the pixel is output, also in Klaro mode |
What the Meta script collects beyond that is determined by Meta. This includes what Meta learns from cookies, the IP address and the user agent of the browser.
Conversions API (server-side)
Only when the Conversions API is active and the event meets all conditions (see Conversions API). Data is sent to graph.facebook.com.
Field (user_data) |
Content | Treatment |
|---|---|---|
client_ip_address |
Visitor's IP address, falling back to 0.0.0.0 |
Not hashed |
client_user_agent |
Browser user agent, truncated to 512 characters | Not hashed |
em |
Email address | SHA-256, lowercased and trimmed beforehand |
ph |
Phone number | SHA-256, reduced to digits beforehand |
fbc |
Value of the _fbc cookie, if present and in the expected format |
unchanged |
fbp |
Value of the _fbp cookie, if present and in the expected format |
unchanged |
In addition, event_source_url (full URL of the page, including the query string) and custom_data (the event data) are sent. The access token is in the request body.
Only the email address and phone number go through hashing. The IP address and user agent are deliberately sent unchanged, because Meta expects them that way.
When are email and phone number included?
| Event | Phone number | |
|---|---|---|
| PageView, ViewContent, ViewCategory, AddToCart | of the customer of the current session | never |
| InitiateCheckout | of the customer of the current session | from the active billing address of that customer |
| Purchase | of the orderer (also for guest orders) | from the billing address of the order |
"Customer of the current session" means: as soon as the Shopware session is assigned to a customer (customer account or guest customer with an active session), that customer's email address is sent along, hashed. Visitors without an assigned customer send neither email nor phone number, except on Purchase.
Temporary storage in the queue
Until the consumer processes the message, it sits in Shopware's message queue. The message contains the IP address, user agent, URL and the hashed values for email and phone number. Email address and phone number are never stored there in plain text.
Notes for your privacy policy
- Name Meta as a recipient and describe both the browser pixel and the server-side transmission.
- State that with the Conversions API the IP address and user agent go to Meta in plain text, while email and phone number are transmitted hashed.
- Obtain consent before the first data transmission. The plugin only does this if you enable the Klaro integration or the cookie consent check, see Consent and cookies.
- The plugin creates no tables of its own for visitor data. Data is only buffered in the message queue, see above.