{"title":"Cookie management and privacy compliance","slug":"cookie-management-and-privacy-compliance","url":"https://support.storeconnect.com/articles/cookie-management-and-privacy-compliance","url_markdown":"https://support.storeconnect.com/articles/cookie-management-and-privacy-compliance.md","subtitle":null,"summary":"Set up GDPR-style cookie consent using Script Blocks, Cookies, and Compliance Groups. Configure the privacy banner, manage required vs optional cookies, and handle UTM tracking integration.","type":"Help_Documentation","video_url":"","keywords":"cookie management, privacy compliance, GDPR, cookie consent, script blocks, compliance groups, cookie banner, UTM tracking, required cookies, optional cookies, privacy settings, javascript tracking","last_modified":"2026-08-21T07:12:35+0000","body_markdown":"## What is privacy compliance?\n\nPrivacy compliance is the catch-all term for a number of requirements imposed on websites in various territories, e.g.: GDPR in the EU, and SCA in the UK. The basic aim of these requirements is to enable the user to understand how their web interactions are being tracked, what information is being collected, and how it is being shared. Visitors must also be able to disable any of these features except those that are strictly required for the website to work.\n\n## Set up the cookies banner scripts\n\nOur implementation assumes that cookies are set by some custom javascript on the site. So we need to know what script is responsible for each cookie.\n\nTo achieve this we have created 3 new objects:\n\n1.  **`Script_Blocks__c`**\n2.  **`Cookies__c`**\n3.  **`Compliance_Groups__c`**.\n\nThe basic working premise of the cookies and compliance feature is as such:\n\n-   A **Script Block** is a container for any script e.g. Google analytics would be put in a Script Block, and Facebook Pixel would be put in another Script Block and so on.\n-   You assign a privacy sensitive Script Block to a **Cookie**. This designates the Script Block as a managed cookie-type script.\n-   And finally, the Cookie is assigned to a **Compliance Group** such as \"Marketing Cookies\" and so on.\n\n### Script blocks\n\nA Script Block is where JavaScript code snippets such as Google Analytics, Facebook Pixel, or similar would be inserted. Conversely, **Script Blocks** can be used for any JavaScript code independent of the cookies and compliance system.\n\n-   `Active__c` - boolean\n-   `Content__c` - long text, where the JS code goes\n-   `Global__c` - boolean\n-   `Position__c` - number, for ordering\n-   `Store_Id__c` - lookup, Store\n\n**Global**, **Active** script blocks will be reproduced in the **Store's** section, in position order.\n\n![Adding a Script Block](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677816/documentation-media/adding-a-script-block.png)\n\n*‌Image: Adding a Script Block*\n\n### Cookies\n\n**Cookies** are the JavaScript code snippets typically used by web developers to help create a better end-user experience. They are saved to an end-user's internet browser when they visit a website with cookies enabled.\n\n-   `Active__c` - boolean\n-   `Compliance_Group_Id__c` - lookup, Compliance\\_Group\n-   `Display_Name__c` - string\n-   `Information_Markdown__c` - text\n-   `Position__c` - number, for ordering\n-   `Script_Block_Id__c`, lookup, Script\\_Block\n\n### Compliance groups\n\n**Compliance Groups** are a way to group cookies by function, and a way to mark certain cookies as required. If a cookie is required, it is automatically enabled and cannot be disabled.\n\n-   `Active__c` - boolean\n-   `Display_Name__c` - string\n-   `Information_Markdown__c` -text\n-   `Position__c` - number, for ordering\n-   `Required__c` - boolean\n-   `Store_Id__c` - lookup, Store\n\n## Implement privacy compliance\n\nOnce you have set your scripts you must then:\n\n1.  Configure each of the components of the cookie and compliance feature\n2.  Then enable it\n\n### Configure cookies\n\nCookies need to belong to both a **Compliance Group** and a **Script Block** in order to have any effect on the site.\n\nThey can be turned off by unchecking the `Active` check box\n\nThe following fields are used in the Cookie management screen to provide the user with info about what the cookie does:\n\n-   `Position` defines the order the cookies are listed in within their **Compliance Group**\n-   `Display_Name`\n-   `Information_Markdown`\n\nMultiple cookies can be attached to the one **Script Block**. This is useful when a 3rd party script is responsible for multiple cookies. If this occurs, it should be noted that the script will only show if all cookies attached to it are enabled.\n\n![New Cookie](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677818/documentation-media/new-cookie.png)\n\n*‌‌Image: Adding a Cookie*\n\n### Configure compliance groups\n\n**Compliance Groups** must belong to a Store.\n\nThey can be turned off by unchecking the `Active` check box.\n\nThey can be marked as required (enabled always) by checking the `Required` check box.\n\nThe following fields are used in the Cookie management screen to provide the user with info about the group of cookies:\n\n-   `Position` defines the order the Compliance Groups are listed in\n-   `Display_Name`\n-   `Information_Markdown`\n\n![New Compliance Group](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677819/documentation-media/new-compliance-group.png)\n\n*‌‌Image: Adding a Compliance Group*\n\n## Configure the compliance banner\n\n![Privacy Compliance](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677820/documentation-media/privacy-compliance.png)\n\n*‌‌Image: Privacy Compliance*\n\nThe Store object has two other fields related to the configuring of Privacy Compliance on the website:\n\n-   Privacy Banner Content, and\n-   Privacy Settings Content\n\nThese fields allow the Store admin to supply the content that shows in both the Banner and the Settings screen.\n\nIn our default themes, the banner will consist of three things:\n\n1.  The content from Privacy Banner Content\n2.  An Accept All button\n3.  A Manage Cookies button\n\nApart from the button labels, all the text in the banner comes from content in Salesforce.\n\n![Sample Cookie Banner](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677821/documentation-media/sample-cookie-banner.png)\n\n*‌‌Image: Sample Cookie Banner*\n\nLikewise, the Settings screen will consist almost entirely of content supplied by the Store admin:\n\n-   the content from Privacy Settings Content as an introductory heading\n-   the list of Cookies grouped by Compliance Group where each group shows the group Display Name and any Information Markdown, and each Cookie also shows the Display Name and its Information Markdown\n-   a **Save Settings** buttons\n-   an **Enable All** and **Save** button\n\nAll text except for the button labels and the enable/disable toggles comes from content in Salesforce.\n\n![Sample Settings Screen Collapsed](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677822/documentation-media/sample-settings-screen-collapsed.png)\n\n*‌Image: Sample Settings Screen Collapsed*\n\n![Sample Settings Screen Expanded](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677824/documentation-media/sample-settings-screen-expanded.png)\n\n*‌Image: ‌Sample Settings Screen Expanded*\n\n## Enable privacy compliance\n\nThe Privacy Compliance features will only work if they are enabled on the Store.\n\nTo enable it, go to the Privacy Compliance section on the Store layout and check the **Enable Privacy Compliance** checkbox:\n\n![Privacy Compliance Checkbox](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677825/documentation-media/privacy-compliance-checkbox.png)\n\n*‌Image: ‌Privacy Compliance Checkbox*\n\nOnce the Privacy Compliance feature has been enabled:\n\n1.  A privacy banner will be shown on the Store to tell the user about cookies, allow them to accept all cookies or open the cookie settings to manage the cookies in greater detail.\n\n2.  Only **Script Blocks** independent of the cookies and compliance system; those linked to *required* **Compliance Groups**; and cookies accepted by the End-User will be included in the HTML  tag.\n\n\nIf the user never bothers to **accept all** or **manage** cookies, the banner will stay there and only the independent JavaScripts or *required* (necessary) cookies will be included.\n\nIf they **do** accept or manage the cookies, the banner will no longer show and the independent JavaScripts, *required* (necessary) and User Accepted cookies will be included. This only lasts for the browser session. If they revisit the site on another occasion after closing the browser, they will get the banner again.\n\n## Privacy compliance with social and ad source tracking\n\nEnabling Privacy Compliance will disable **UTM tracking**. To enable it, add a cookie with the internal name `STORECONNECT_UTM_TRACKING`.\n\nIf a cookie with that name is enabled, UTM tracking will no longer be disabled by **Privacy Compliance** (ie it may still be disabled for other reasons though, see that feature for more details).\n\nFind out more about our [UTM Tracking feature](utm-tracking-codes)\n\n![Privacy and UTM Tracking](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677826/documentation-media/privacy-utm-tracking.png)\n\n*‌‌Image: Privacy and UTM Tracking*\n\n## Terms\n\n**Cookie:** HTTP cookies (also called web cookies, Internet cookies, browser cookies, or simply cookies) are small blocks of data created by a web server while a user is browsing a website and placed on the user's computer or other device by the user's web browser. Cookies are placed on the device used to access a website, and more than one cookie may be placed on a user's device during a session (Wikipedia). See [Cookie management and privacy compliance](cookie-management-and-privacy-compliance) for help on setting custom cookies and managing privacy compliances.\n\n**Store:** A \"store\" is a website built within StoreConnect / Salesforce with its own unique domain name or path. `[https://example.com](https://example.com)` would be a store, and `[https://getstoreconnect.com](https://getstoreconnect.com)` would be another store. You could also have paths such as `[https://example.com/eu](https://example.com/eu)` for a website dedicated to Europe, or `[https://example.com/au](https://example.com/au)` as another website dedicated to Australia. You access the Store's configuration page by navigating to the **StoreConnect Config** app then selecting **Stores** from the dropdown menu.\n\n**tag:** Used to contain metadata such as the title of the page, its description, and any relevant keywords. Scripts (code), links to scripts and CSS files (for page styling) may also be contained in the tag.\n\n**UTM Tracking Code:** Urchin Tracking Module (UTM) codes are very common and broadly used to track website clicks and performance of marketing activities. They were originally developed by a software analytics company, \"Urchin Software Corp\" who were purchased by Google Corp. They in turn developed the Urchin software into what is now called, \"Google Analytics\"."}