Privacy and consent
What is stored
For each event Virling stores: the time, the path without its query string, the referrer host, UTM tags, the channel, the country, the device type, the browser name, a visitor ID and a session ID. For goals, the goal name.
It does not store IP addresses, full user agents, full referrer URLs, or anything a visitor types.
The visitor cookie
| Property | Value |
|---|---|
| Name | virling_vid |
| Content | A random ID, not derived from the visitor |
| Lifetime | One year |
| Scope | First-party, path /, on your site’s domain |
| Flags | SameSite=Lax, plus Secure on HTTPS |
It is readable by your own code on purpose, so you can pass it into checkout. To use no cookie at all, see Cookieless mode.
Global Privacy Control
Add data-respect-gpc to the tag and the script sends nothing when the browser has Global Privacy Control turned on (navigator.globalPrivacyControl).
Bots
Events from user agents that look automated are dropped: an empty user agent, or one containing bot, crawl, spider, slurp, headless, lighthouse, preview, curl/, wget/, python-, go-http, phantomjs or facebookexternalhit.
Rate limit
Each site accepts up to 200 events per second by default. Events over the limit are dropped. Change it with --events-per-second or VIRLING_EVENTS_PER_SECOND.
Consent banners
Whether you need consent for the virling_vid cookie depends on your jurisdiction and how you use the data. Guidance on consent wording is Not available yet, and these docs are not legal advice. If you only want to load the script after consent, add the tag from your consent tool’s callback, and include data-site on it as usual.