Cookies and consent
Personizely recognizes returning visitors with one first-party cookie, _ply, and uses browser storage to remember variation assignments and widget frequency. It sets no third-party cookies. On Shopify, Personizely follows the visitor's choice in Shopify's customer privacy settings. On other platforms, you control consent by deciding when the snippet loads. This page explains what to declare in your cookie policy and what happens when a visitor declines.
Cookies Personizely sets
All cookies are first-party: they're set on your own domain by the Personizely snippet.
Cookie | Purpose | Duration | Set when |
|---|---|---|---|
_ply | Visitor ID. Recognizes a returning visitor so they keep seeing the same variations, frequency rules work and conversions are attributed | Cookie lifetime setting: 1 year by default, up to 5 years | Every visitor, on the first page view |
_ply_coupon | Holds the coupon code to auto-apply. Functional, non-identifying | Until the coupon's time limit ends, or the cookie lifetime if it has none | Shopify, when a Coupon and discount codes with auto-apply is shown |
_ply_preview_theme | Remembers the theme variation a visitor is assigned to. Functional, non-identifying | Cookie lifetime | Shopify, only during Theme testing (Shopify), for visitors in the test |
_ply_h | Carries a visitor's assignment across a redirect to another subdomain. Short-lived. Functional, non-identifying | Up to 5 minutes; removed when the destination page loads | Split URL testing (redirect tests) and redirect campaigns that send visitors to another subdomain |
ply_debug | Turns on console logging for troubleshooting | As you set it | Never by Personizely; only when you set it yourself while testing. See Verify and troubleshoot your installation |
The _ply cookie is set on your main domain, so www.example.com and shop.example.com share the same visitor.
Cookie lifetime
Set it in Settings → Tracking → Cookie lifetime: 1, 2, 3, 4 or 5 years. The default is 1 year. A visitor who returns after their cookie has expired is a new visitor: they get a new variation assignment and count again toward your visitor quota. A longer lifetime keeps returning visitors consistent for longer; a shorter one may be required by your privacy policy.
The new lifetime applies to cookies set or renewed after you save.
Browser storage
Besides cookies, Personizely uses the browser's local and session storage on your domain to remember variation assignments, widget frequency (such as "show once per session"), the visitor's remembered traffic-source values (referrer, entry page and UTM parameters) and the current session. Storage stays in the visitor's browser and is never shared with other sites. Like cookies, it's cleared when the visitor clears their site data. See Visitor identity, sessions and storage.
Consent on Shopify
Personizely follows the visitor's choice in Shopify's customer privacy settings, which your consent banner or Shopify's own banner controls. The choice is read on page load and whenever the visitor changes it.
Visitor's analytics consent | What Personizely does |
|---|---|
Given, or not required in their region | Normal behavior: the cookie is set and the visitor is remembered across visits |
Declined | No _ply cookie is written. Widgets and campaigns keep working, but the visitor is only recognized for the current browser session, so a later visit counts as a new visitor. Their events are recorded without their IP address |
On Shopify Hydrogen storefronts, consent follows Shopify's customer privacy settings in the same way.
The visitor's country and city are still determined for targeting and reports when consent is declined; the IP address itself isn't stored.
On Shopify, _ply is only written once the visitor allows analytics, so list it in your cookie policy as an analytics cookie that keeps the visitor's experience consistent (the same prices, content and offers on every page) and measures results.
Shopify's add-to-cart and checkout tracking
Personizely's Shopify web pixel, which records add-to-cart and checkout events, runs only when Shopify's privacy settings allow analytics. For visitors who decline, those events aren't received. Purchases are still attributed from Shopify's order data when the order can be matched to the visitor. See Shopify order tracking and profit.
Change user consent automation
A widget can act as your consent banner on Shopify with the Change user consent automation. When the visitor clicks a button or submits a form, the selected categories are recorded as granted in Shopify's customer privacy settings:
Option | What it does | Values / default |
|---|---|---|
Privacy consent to change | The consent categories to grant | Measure performance (analytics), Personalize marketing (marketing), Store your preferences (preferences); all selected by default |
Unselected categories aren't changed, so the automation never withdraws consent. It needs Shopify's customer privacy features to be active on your storefront, as they are when you use Shopify's cookie banner. Personizely and other apps that follow Shopify's privacy settings pick up the new choice immediately. See Shopify widget automations.
Consent on other platforms
On Wix, WordPress, Webflow, Square and custom sites, Personizely doesn't read your consent banner. If your policy requires consent before analytics cookies are set, load the Personizely snippet only after the visitor accepts, through your consent tool or tag manager:
- Consent management platforms (Cookiebot, OneTrust, Usercentrics, Complianz and others): put the snippet in the category you use for analytics or personalization, so the tool loads it after consent.
- Google Tag Manager: fire the Personizely tag on a consent trigger. See Install with a script tag or Google Tag Manager.
Visitors who don't consent then see your original site: no campaigns, no widgets, and they aren't tracked or counted toward your quota. Visitors who consent mid-visit get Personizely from the next page load.
Loading the snippet only after consent means content tests can't hide the original content before the page shows, so those visitors may see a brief flicker on the first page after they accept. See Performance and flicker.
Listing Personizely in your cookie policy
A typical entry:
Field | Value |
|---|---|
Provider | Personizely (first party, set on your domain) |
Cookies | _ply, plus _ply_coupon, _ply_preview_theme and _ply_h if you use those features |
Purpose | Recognize returning visitors to keep A/B test variations, personalized content and popup frequency consistent, and measure conversions |
Category | Functional (the experience stays consistent) and analytics (conversion measurement) |
Duration | _ply: your cookie lifetime setting (1 year by default) |
Other storage | Local and session storage used to remember assignments and widget frequency |
Integrations you add can set their own cookies. For example, reCAPTCHA (Google) and embedded YouTube or Vimeo videos set cookies from their providers. Declare them separately.
Behavior details and limitations
- No third-party cookies. Personizely doesn't track visitors across other websites.
- Different domains are different visitors. example.com and example.co.uk can't share a cookie.
- Clearing cookies resets the visitor. They get a new visitor ID, possibly a different variation, and count again toward your quota.
- Consent fields in forms are separate. Marketing consent checkboxes in widget forms record the visitor's consent to email or SMS marketing. They don't change how Personizely stores data. See Form element.
- Bots and crawlers don't get the cookie: Personizely doesn't run for them.
Troubleshooting
- Your consent tool lists an unknown _ply cookie → it's Personizely's visitor ID. Categorize it as described above.
- Variations change between visits → the visitor's cookie was cleared or expired, or your consent tool blocks it. Check Settings → Tracking → Cookie lifetime and your consent tool's category for Personizely.
- No Personizely on your non-Shopify site until the visitor accepts → expected when your consent tool loads the snippet after consent.