Visitor identity, sessions and storage
Personizely recognizes a visitor by a random ID stored in a first-party cookie on your domain, together with data kept in the visitor's browser storage. A visitor is therefore one browser on one device: the same person on their phone and their laptop counts as two visitors until they're Identifying visitors. This page explains when a visitor is new, what a session is, how long the cookie lasts, how consent on Shopify changes things, and how visitors behave across subdomains.
Available on: all platforms. Consent handling differs on Shopify (see Consent).
How a visitor is recognized
- First page view. If the browser has no Personizely visitor ID, the visitor is new. Personizely creates a visitor profile and stores its ID in a first-party cookie.
- Later page views and visits. The snippet reads the ID from the cookie, so the visitor keeps their history, profile fields, remembered traffic-source values and campaign assignments.
- Every page view extends the cookie. The cookie's expiry is renewed when the visitor views a page, so it runs for the full lifetime after their most recent page view, not after their first visit.
On Shopify, Personizely recognizes the visitor consistently with Shopify's own storefront analytics where that's available, so a visitor counted by Shopify and by Personizely is the same visitor. Logged-in Shopify customers are also identified by their customer account (see Identifying visitors).
A visitor counts as new again when any of these happen:
- They clear their cookies or site data, or use a private window.
- They use a different browser or device.
- The cookie expires because they haven't viewed a page for longer than the cookie lifetime.
Opening your site in several tabs at once on a first visit doesn't create duplicate visitors.
Sessions
A session (also called a visit) lasts while the visitor has your site open in at least one browser tab. It ends when they close every tab of your site. Opening your site again after that starts a new session.
- There's no inactivity timeout. A tab left open overnight is still the same session the next morning. This differs from Google Analytics, which ends a session after 30 minutes of inactivity, so session counts won't match GA.
- Tabs share the session. A tab opened while another tab of your site is open joins the same session.
- Reloading or navigating doesn't end a session.
These features use the session:
Feature | What "session" means for it |
|---|---|
First visit filter, is now | True for every page of the visitor's first session |
Visit history filter | Counts sessions |
Page view, Goal, Event and Widget history, During this session | Counts only within the current session |
Frequency rule rule, for current session | Pauses the widget until the session ends |
Lasts for the session |
What's stored in the browser
Personizely uses a first-party cookie and browser storage on your domain. No third-party cookies are used.
Storage | Holds | Lasts |
|---|---|---|
First-party cookie | The visitor ID | The cookie lifetime (default 1 year), renewed on each page view |
Browser storage, persistent | A copy of the visitor's profile used for targeting and Dynamic text (personalization variables): remembered traffic-source values, first and last visit times, and profile fields the visitor has provided, such as email or name; campaign assignments; widget state such as frequency counters | Until the visitor clears site data |
Browser storage, session | Session ID and session events, location used by {geo.*} dynamic text, company data, website data | Until the session ends |
For the list of cookies to declare in a consent banner or cookie policy, see Cookies and consent.
The visitor's full profile and history are stored on Personizely's servers against the visitor ID. Clearing the browser doesn't delete them; it only means the browser is no longer linked to that profile. To delete a visitor's data, see GDPR and data deletion.
Cookie lifetime
Option | What it does | Values / default |
|---|---|---|
Cookie lifetime (Settings → Tracking) | How long a visitor is remembered after their last page view | 1 year (default), 2 years, 3 years, 4 years, 5 years |
A longer lifetime keeps returning visitors in their A/B test arms and keeps their history for longer. Check your privacy policy and local rules before raising it: some regulators expect analytics cookies to last no more than 13 months. A change applies to cookies written from then on, which is every visitor's next page view.
Consent
- Shopify: Personizely follows the visitor's choice in Shopify's customer privacy settings. A visitor who declines analytics consent gets no visitor cookie. Widgets and campaigns still run, but the visitor is recognized only for the current browser session, so each new session counts as a new visitor and may be assigned a different variation. Their events are recorded without their IP address.
- Other platforms: Personizely doesn't read your consent banner. If your policy requires consent first, load the snippet only after the visitor accepts.
See Cookies and consent for details and what to declare in your cookie policy.
Domains and subdomains
- Subdomains share the visitor. The cookie is set on your main domain, so example.com, www.example.com and shop.example.com see the same visitor ID.
- Sessions and browser storage are per subdomain. Browsers keep storage separate for each subdomain. Moving from www.example.com to shop.example.com starts a separate session there, and campaign assignments, widget frequency and website data are kept separately on each. See How visitors are assigned to variations.
- Different domains are different visitors. example.com and example.co.uk can't share a cookie, so a visitor moving between them is a new visitor on the second domain, unless they're identified there by email.
- Shopify checkout. The visitor's campaign variations travel with the cart, so checkout and order attribution work even though checkout runs on Shopify's domain.
Behavior details and limitations
- Cross-device recognition needs identification. Profiles merge when the same email or phone is identified on two devices, but each browser keeps its own cookie and its own campaign assignments.
- Browser privacy features. Some browsers limit how long cookies set by scripts can last. Safari's tracking prevention, for example, can delete them after 7 days without a visit. Those visitors may become new visitors sooner than the cookie lifetime.
- Bots aren't visitors. The snippet doesn't run for recognized bots, so they don't get an ID or count toward your visitor quota. See Traffic filtering and bots.
- No visitor ID while disabled. With ?ply_disable=1 or while tracking is paused, the snippet doesn't run, so no cookie is written.
Examples
- Long consideration cycles: a furniture store with 6-week purchase cycles keeps the default 1-year lifetime, so visitors who return after a month are still in the same test arm.
- Separate blog subdomain: a store with blog.example.com and www.example.com targets returning visitors by "First visit is now" in a don't match group. A reader of the blog who goes to the store counts as returning, because the visitor is shared, but starts a new session on the store.
Troubleshooting
- The same person appears as many visitors → they use several devices or browsers, or browse in private windows. Identification by email merges their profiles.
- Returning visitors are treated as new → the cookie was cleared or capped by the browser, or the visitor moved to a different domain.
- Session counts are lower than in Google Analytics → Personizely sessions have no 30-minute inactivity timeout.