Verid

Optional. Daily Magento P&L uses an Integration token — no module and no pixel. Install the snippet only if you want campaign attribution or funnel stages.

The Verid pixel attributes purchases to campaigns when your thank-you / success page fires a purchase event with order and campaign identifiers. Architecture is consent-first at the network layer: the Magento install snippet is a local bootstrap that does not request Verid until marketing consent is granted. Only then does the same snippet start the tracker (inline — no extra Magento files, works behind Hyva / Magento CSP) and send events. Campaign attribution and profit conversion upload remain Beta until a production Purchase test is verified.

Install

In Settings → Tracking pixel, copy the full bootstrap block into Magento HTML Head. Do not paste a bare <script src="…/verid.js"> — that would expose visitor IP to Verid before opt-in.

Consent (required)

Paste only the Settings bootstrap. It does not contact Verid until marketing consent is granted. Built-in CMP bridges (no extra Magento files):

Amasty GDPR Cookie — allow-all → accept; save without Marketing / withdraw → revoke; return visit reads saved groups.
Cookiebot consent.marketing
Google Consent Mode ad_storage

You can still call the API explicitly:

verid.setConsent("accept", { policyVersion: "2026-08-13" });
verid.setConsent("revoke");

If the store has no cookie banner we understand (Amasty, Cookiebot, or Google Consent Mode deny), the pixel loads. If that banner is present, we wait for marketing accept and stay silent on reject.

Consent metadata vs legal proof

Each accepted POST may include a client-supplied consent object (status, policyVersion, ts, domain, category). Verid stores this as attribution metadata only — it is not legal proof, not an audited consent record, and can be spoofed by any script. Legally demonstrable consent must live in your store CMP. Server still requires consent.status = "granted" as a self-assertion gate before accepting events.

Purchase contract

orderId (required) — Magento increment id; idempotency key with store. Reloads do not create a second Purchase.
revenue / currency / orderDate — optional; no email, phone, or address in the browser payload.
click ids — optional; captured after marketing consent from landing URL / storage.

Success page must expose the increment id via a theme/module template (data-verid-order / window.veridOrderId) — not a CMS static block with PHP. See docs/guides/magento-purchase-pixel.md. Without the hook, the tracker falls back to parsing Luma .checkout-success confirmation text. Marketplace / M2E orders never get a pixel Purchase (they still sit in Magento P&L). Stripe/PayPal often skip a visible payment step — use checkout → Purchase, not PaymentStarted.

<!-- No customer PII — increment id only -->
<div data-verid-order="000000123" data-verid-currency="EUR" style="display:none"></div>
<script>window.veridOrderId = "000000123";</script>

// Or after consent + tracker load:
verid.track("Purchase", { orderId: "000000123", revenue: 99.5, currency: "EUR" });

Test increment ids may use the prefix VERIDTEST-. TagCraft manual runbook: docs/guides/tagcraft-purchase-test-runbook.md.

Origin allowlist

Pixel POSTs must match the store allowlist (Settings hosts, or Magento base URL hostname). CORS never uses Access-Control-Allow-Origin: * — only an allowlisted Origin is echoed. If both Origin and Referer are missing (some non-browser clients), the request is rejected: Verid does not claim browser authenticity in that case. Prefer fetch with CORS over sendBeacon when you need a reliable Origin header.

See Cookies and Data & DPA. Verid does not claim to satisfy every jurisdiction by itself.

What you get